Iowa ICDPA

The ICDPA covers “personal data,” also called personal information or PI, which Iowa defines as: “any information that is linked or reasonably linkable to an identified or identifiable individual.” The definition exempts de-identified information and information made publicly available by government records, the media, or the consumer.

Iowa’s definition of sensitive PI includes the following, except to the extent such data is used in order to avoid discrimination on the bases of a protected class that would violate a federal or state anti-discrimination law:

• Racial or ethnic origin;
• Religious beliefs;
• Mental or physical health diagnosis;
• Sexual orientation;
• Citizenship or immigration status.

It then also includes:

• Genetic or biometric data processed for identification purposes;
• PI collected from a known child; and
• Precise geolocation data.

Where a controller processes de-identified data, Iowa requires it to take reasonable measures to ensure the data cannot be associated with an individual. Notably, Iowa does not require what most other state’s do for de-identified data, that controllers publicly commit to maintaining such data without an attempt to re-identify it. The obligations on sharing it with processors are also somewhat watered down, requiring controllers to monitor processors’ contractual obligations related to pseudonymous data but not explicitly requiring the controller to include prohibitions on re-identifying the information in such contracts.

Iowa also exempts pseudonymous data from all privacy rights requests where the controller can show it keeps information that would allow the data to be re-identified separate and subject to technical and organizational controls that prevent its use for re-identification.

In a word: NO!

However, controllers must present consumers with clear notice and opportunity to opt-out of the processing of their sensitive PI prior to processing it.

Parental consent is required to process PI about a known child (under 13). COPPA verifiable parental consent is sufficient, but not required.

A privacy notice must include:

• The categories of PI processed;
• The purpose for processing PI;
• The categories of third parties with which PI is shared;
• The categories of PI that are shared with third parties;
• The methods for a consumer to exercise their rights (see below) and appeal a decision on their rights request; and
• Description of targeted advertising and selling activities including a procedure for opting out of the processing for these purposes.

Iowa uses the more limited definition of ‘sale’ as the exchange for monetary consideration.

There are limits on the definition of “sale” to ensure that certain business functions are not unintentionally impeded by this law. Examples of activities deemed not to be a sale include: the disclosure of PI to provide a product or service requested by the consumer, the disclosure of PI to an affiliate, disclosure of PI intentionally made public, and the disclosure of PI as part of a merger or bankruptcy.

The Iowa attorney general (AG) has sole enforcement authority. Under the Iowa law the AG may bring an enforcement action after providing a 90-day notice (the longest on record) and an opportunity for the business to cure the alleged violation(s). This cure period does not sunset. Actions can be brought that seek injunctive relief (the company must stop certain behaviors) and/or civil penalties, with fines up to $7,500 plus attorney’s fees, investigative costs, and any other relief the court determines appropriate.