SSB 1071

This bill relates to consumer data protection. The bill contains several definitions. The bill defines “controller” to mean a person that, alone or jointly with others, determines the purpose and means of processing personal data. The bill defines “identified or identifiable natural person” to mean a person who can be readily identified, directly or indirectly. The bill defines “personal data” to mean any information that is linked or reasonably linkable to an identified or identifiable natural person, but does not include de-identified data or publicly available information. The bill defines “process” or “processing” to mean any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. The bill defines “processor” to mean a person that processes personal data on behalf of a controller. The bill defines “pseudonymous data” to mean personal data that cannot be attributed to a specific natural person without the use of additional information. The bill defines “publicly available information” to mean information that is lawfully made available to the general public through certain records or information that a business has reasonable basis to believe is lawfully made available under certain conditions. _____ consumer’s preferences or interests, with exceptions. The bill defines “third party” to mean a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. The bill contains other defined terms. The bill provides that persons conducting business in the state or producing products or services targeted to Iowans that annually control or process personal data of over 99,999 consumers or control or process personal data of 25,000 consumers with percent of gross revenue derived from the sale of the personal data shall be subject to the provisions of the bill. The state and political subdivisions of the state, financial institutions or data subject to the federal Gramm-Leach-Bliley Act of 1999, certain organizations governed by rules by the department of health and human services, certain federal governance laws and the federal Health Insurance Portability and Accountability Act, nonprofit organizations, higher learning institutions, and certain protected information and personal data collected under state or federal laws are exempt from provisions in the bill. The bill provides consumers have personal data rights that may be invoked at any time. Consumers or the parent of a child may submit a request to a controller for a copy of the controller’s information relating to personal data. The controller shall comply with such requests to confirm or deny whether the controller is processing the personal data, to provide the consumer with a copy of their personal data, and to remove the consumer or child from personal data processing. The bill requires that controllers provide responses to defined personal data requests within days of a consumer initiating a request. Responses to personal data requests shall be provided to a consumer free of charge up to twice per year except where requests are overly burdensome or manifestly unfounded. _____ consumer of the reason for the extension. The bill provides that controllers are not required to comply with requests where a controller is unable through commercially reasonable efforts to verify the identity of the consumer submitting the request. The bill requires that controllers permit consumers to access an appeals process except in cases that are unable to be authenticated and provide consumers with information regarding the appeals process in situations where a consumer’s request is denied. The bill provides that controllers must disclose to the consumer the types of data being collected and obtain consent from the consumers regarding the collection of personal data and sensitive personal data processing. Controllers must securely store personal data of consumers through administrative, technical, and physical security practices. Controllers shall not discriminate against consumers that exercise consumer data rights as provided in the bill by denying a consumer goods or services, charging different prices, or providing lower quality goods with exceptions. Contract provisions that require consumers to waive rights defined by the bill will be considered void and unenforceable. The bill provides that controllers give consumers reasonably accessible and clear privacy notices that inform consumers of the information regarding personal data transfer and purposes and the methods for consumers to exercise rights. The bill provides that controllers selling personal data to third parties or using targeted advertising must clearly disclose such activity and the right for the consumer to opt out of such sales or use. The bill requires a controller to create a method for private and secure processing of consumer requests. The bill requires processors and the assigns or subcontractors of processors to assist controllers in complying with duties created by the bill. _____ by the bill. The bill identifies exceptions where controllers or processors are not required to comply with a consumer rights request pursuant to the bill. The bill requires controllers disclosing pseudonymous or de-identified data to exercise reasonable oversight of contractual commitments regarding such data. The bill provides that the bill shall not restrict controller or processor abilities to improve business or function. Controllers or processors sharing personal data with third parties are not liable for the noncompliance of third parties if the controller or processor did not have personal knowledge of the violation or intent to commit a violation, nor is a third party liable for violations of a controller or processor. The bill provides that if a controller seeks certain exemptions, the controller bears the burden of demonstrating that the controller qualifies for the exemption and the exemption complies with the requirements in the bill. The bill shall not require a business, consumer, or other party to disclose trade secrets. The bill provides that the attorney general shall investigate controllers and processors upon reasonable cause for violations of provisions of the bill. The attorney general shall provide days’ notice to a controller or processor including the reason for which the entity is subject to an investigation and permit the entity to cure the defect prior to filing a civil action. A controller or processor found to be in violation of provisions of the bill is subject to a civil penalty of up to $7,500 per violation.16C. The attorney general shall recover reasonable expenses for expenses related to the investigation. The bill provides that a rule, regulation, code, ordinance, or other law adopted regarding processing of personal data is preempted by the bill. _____ The bill takes effect January 1, 2025.