22.3A Access to data processing software.
1. As used in this section: a. “Access” means the instruction of, communication with, storage of data in, or retrieval of data from a computer.
b. “Computer” means an electronic device which performs logical, arithmetical, and memory functions by manipulations of electronic or magnetic
impulses, and includes all input, output, processing, storage, and communication facilities which are connected or related
to the computer including a computer network. As used in this paragraph, “computer” includes any central processing unit, front-end processing unit, miniprocessor, or microprocessor, and related peripheral
equipment such as data storage devices, document scanners, data entry terminal controllers, and data terminal equipment and
systems for computer networks.
c. “Computer network” means a set of related, remotely connected devices and communication facilities including two or more computers with capability
to transmit data among them through communication facilities.
d. “Data” means a representation of information, knowledge, facts, concepts, or instructions that has been prepared or is being prepared
in a formalized manner and has been processed, or is intended to be processed, in a computer. Data may be stored in any form,
including but not limited to a printout, magnetic storage media, disk, compact disc, punched card, or as memory of a computer.
e. “Data processing software” means an ordered set of instructions or statements that, when executed by a computer, causes the computer to process data,
and includes any program or set of programs, procedures, or routines used to employ and control capabilities of computer hardware.
As used in this paragraph “data processing software” includes but is not limited to an operating system, compiler, assembler, utility, library resource, maintenance routine,
application, computer networking program, or the associated documentation.
2. a. A government body may provide, restrict, or prohibit access to data processing software developed by the government body or
developed by a nongovernment body and used by a government body pursuant to a contractual relationship with the nongovernment
body, regardless of whether the data processing software is separated or combined with a public record. A government body
shall establish policies and procedures to provide access to public records which are combined with its data processing software.
A public record shall not be withheld from the public because it is combined with data processing software. b. A government body shall not acquire any electronic data processing system for the storage, manipulation, or retrieval of public
records that would impair the government body’s ability to permit the examination of a public record and the copying of a
public record in either written or electronic form.
c. If a public record is only available as a part of or in combination with data processing software in order to permit the examination
or copying of the public record, the government body shall bear the cost of separation of the public record from the data
processing software.
d. An electronic public record shall be made available in the format in which it is readily accessible to the government body
if that format is useable with commonly available data processing or database management software. The government body may
make a public record available in a specific format requested by a person that is different from that in which the public
record is readily accessible to the government body and may charge the reasonable costs of any required processing, programming,
or other work required to produce the public record in the specific format in addition to any other costs allowed under this chapter.
e. The cost chargeable to a person receiving a public record separated from data processing software under this subsection shall not be in excess of the charge under this chapter unless the person receiving the public record requests that the public record be specially processed or produced in a format
different from that in which the public record is readily accessible to the government body.
f. A government body may establish payment rates and procedures required to provide access to data processing software, regardless
of whether the data processing software is separated from or combined with a public record. Proceeds from payments may be
considered appropriated receipts, as defined in section 8.2. The payment amount shall be calculated as follows: (1) The amount charged for access to a public record shall be not more than that required to recover direct publication costs,
including but not limited to editing, compilation, and media production costs, incurred by the government body in developing
the data processing software and preparing the data processing software for transfer to the person. The amount shall be in
addition to any other fee required to be paid under this chapter for the examination and copying of a public record. If a person accesses a public record stored in an electronic format that
does not require formatting, editing, or compiling to access the public record, the charge for providing the accessed public
record shall not exceed the reasonable cost of accessing that public record. The government body shall, if requested, provide
documentation which explains and justifies the amount charged. This subparagraph shall not apply to any publication for which
a price has been established pursuant to another section, including section 2A.5.
(2) If access to the data processing software is provided to a person for a purpose other than provided in subparagraph (1), the
amount may be established according to the discretion of the government body, and may be based upon competitive market considerations
as determined by the government body.
3. A government body is granted and may apply for and receive any legal protection necessary to secure a right to or an interest
in data processing software developed by the government body, including but not limited to federal copyright, patent, and
trademark protections, and any trade secret protection available under chapter 550. The government body may enter into agreements for the sale or distribution of its data processing software, including marketing
and licensing agreements. The government body may impose conditions upon the use of the data processing software that is otherwise
consistent with state and federal law.
96 Acts, ch 1099, §15; 98 Acts, ch 1224, §18; 99 Acts, ch 207, §12; 2003 Acts, ch 35, §38, 49; 2011 Acts, ch 127, §45, 89; 2015 Acts, ch 42, §2; 2024 Acts, ch 1185, §109
22.7 Confidential records.
The following public records shall be kept confidential, unless otherwise ordered by a court, by the lawful custodian of the
records, or by another person duly authorized to release such information:
1. Personal information in records regarding a student, prospective student, or former student maintained, created, collected
or assembled by or for a school corporation or educational institution maintaining such records. This subsection shall not be construed to prohibit a postsecondary education institution from disclosing to a parent or guardian information
regarding a violation of a federal, state, or local law, or institutional rule or policy governing the use or possession of
alcohol or a controlled substance if the child is under the age of twenty-one years and the institution determines that the
student committed a disciplinary violation with respect to the use or possession of alcohol or a controlled substance regardless
of whether that information is contained in the student’s education records. This subsection shall not be construed to prohibit a school corporation or educational institution from transferring student records electronically
to the department of education, an accredited nonpublic school, an attendance center, a school district, or an accredited
postsecondary institution in accordance with section 256.9, subsection 44.
2. Hospital records, medical records, and professional counselor records of the condition, diagnosis, care, or treatment of a
patient or former patient or a counselee or former counselee, including outpatient. However, confidential communications between
a crime victim and the victim’s counselor are not subject to disclosure except as provided in section 915.20A. However, the department of health and human services shall adopt rules which provide for the sharing of information among
agencies and providers concerning the maternal and child health program including but not limited to the statewide child immunization
information system, while maintaining an individual’s confidentiality.
3. Trade secrets which are recognized and protected as such by law.
4. Records which represent and constitute the work product of an attorney, which are related to litigation or claim made by or
against a public body.
5. Peace officers’ investigative reports, privileged records or information specified in section 80G.2, and specific portions of electronic mail and telephone billing records of law enforcement agencies if that information is
part of an ongoing investigation, except where disclosure is authorized elsewhere in this Code. However, the date, time, specific
location, and immediate facts and circumstances surrounding a crime or incident shall not be kept confidential under this section, except in those unusual circumstances where disclosure would plainly and seriously jeopardize an investigation or pose a
clear and present danger to the safety of an individual. Specific portions of electronic mail and telephone billing records
may only be kept confidential under this subsection if the length of time prescribed for commencement of prosecution or the finding of an indictment or information under the
statute of limitations applicable to the crime that is under investigation has not expired.
5A. a. A crisis intervention report generated by a law enforcement agency regarding a person experiencing a mental health crisis,
substance use disorder crisis, or housing crisis, when the report is generated for the specific purpose of providing crisis
intervention information to assist peace officers under any of the following circumstances: (1) De-escalating conflicts.
(2) Referring a person experiencing a mental health crisis, substance use disorder crisis, or housing crisis to a mental health
treatment provider, substance use disorder treatment provider, homeless service provider, or any other appropriate service
provider.
b. A crisis intervention report generated for the purposes of this subsection shall be made available to the person who is the subject of the report upon the request of the person who is the subject
of the report, and may be provided to a mental health treatment provider, substance use disorder treatment provider, homeless
service provider, or any other appropriate service provider in connection with a referral for services.
c. Crisis intervention reports generated for the purposes of this subsection are not peace officers’ investigative reports under subsection 5.
d. Notwithstanding other provisions of this subsection, the date, time, specific location, and immediate facts and circumstances surrounding a crime or incident shall not be kept
confidential under this subsection, except where disclosure would pose a clear and present danger to the safety of the person subject to the crisis intervention
report or the safety of others.
e. For the purposes of this subsection: (1) “Crisis intervention report” or “report” means a report generated by a law enforcement agency using a prescribed form created by the department of justice to record
the following information relevant to assess the nature of a crisis: (a) Any biological or chemical causes of the crisis.
(b) Any observed demeanors and behaviors of the person experiencing the crisis.
(c) Persons notified in relation to the crisis.
(d) Whether suicide or injuries occurred in relation to the crisis and the extent of those injuries.
(e) Whether weapons were involved in the crisis and a description of the weapon.
(f) The disposition of the crisis intervention and any crime committed.
(2) “Housing crisis” means a situation where a person is experiencing homelessness, a lack of adequate or safe housing, or is in imminent danger
of homelessness or lack of adequate or safe housing.
6. Reports to governmental agencies which, if released, would give advantage to competitors and serve no public purpose.
7. Appraisals or appraisal information concerning the sale or purchase of real or personal property for public purposes, prior
to the execution of any contract for such sale or the submission of the appraisal to the property owner or other interest
holders as provided in section 6B.45.
8. Economic development authority information on an industrial prospect with which the authority is currently negotiating.
9. Criminal identification files of law enforcement agencies. However, records of current and prior arrests and criminal history
data shall be public records.
10. A claim for compensation and reimbursement for legal assistance and supporting documents submitted to the state public defender
for payment from the indigent defense fund established in section 815.11, as provided in section 13B.4A.
11. a. Personal information in confidential personnel records of government bodies relating to identified or identifiable individuals
who are officials, officers, or employees of the government bodies. However, the following information relating to such individuals
contained in personnel records shall be public records, except as otherwise provided in section 80G.3: (1) The name and compensation of the individual including any written agreement establishing compensation or any other terms of
employment excluding any information otherwise excludable from public information pursuant to this section or any other applicable provision of law. For purposes of this paragraph, “compensation” means payment of, or agreement to pay, any money, thing of value, or financial benefit conferred in return for labor or services
rendered by an official, officer, or employee plus the value of benefits conferred including but not limited to casualty,
disability, life, or health insurance, other health or wellness benefits, vacation, holiday, and sick leave, severance payments,
retirement benefits, and deferred compensation.
(2) The dates the individual was employed by the government body.
(3) The positions the individual holds or has held with the government body.
(4) The educational institutions attended by the individual, including any diplomas and degrees earned, and the names of the individual’s
previous employers, positions previously held, and dates of previous employment.
(5) The fact that the individual resigned in lieu of termination, was discharged, or was demoted as the result of a disciplinary
action, and the documented reasons and rationale for the resignation in lieu of termination, the discharge, or the demotion.
For purposes of this subparagraph, “demoted” and “demotion” mean a change of an employee from a position in a given classification to a position in a classification having a lower pay
grade.
b. Personal information in confidential personnel records of government bodies relating to student employees shall only be released
pursuant to 20 U.S.C. §1232g.
12. Financial statements submitted to the department of agriculture and land stewardship pursuant to chapter 203 or chapter 203C, by or on behalf of a licensed grain dealer or warehouse operator or by an applicant for a grain dealer license or warehouse
license.
13. The records of a library which, by themselves or when examined with other public records, would reveal the identity of the
library patron checking out or requesting an item or information from the library. The records shall be released to a criminal
or juvenile justice agency only pursuant to an investigation of a particular person or organization suspected of committing
a known crime. The records shall be released only upon a judicial determination that a rational connection exists between
the requested release of information and a legitimate end and that the need for the information is cogent and compelling.
14. The material of a library, museum or archive which has been contributed by a private person to the extent of any limitation
that is a condition of the contribution.
15. Information concerning the procedures to be used to control disturbances at adult correctional institutions. Such information
shall also be exempt from public inspection under section 17A.3. As used in this subsection disturbance means a riot or a condition that can reasonably be expected to cause a riot.
16. Information in a report to the department of health and human services, to a local board of health, or to a local health department,
which identifies a person infected with a reportable disease.
17. Records of identity of owners of public bonds or obligations maintained as provided in section 76.10 or by the issuer of the public bonds or obligations. However, the issuer of the public bonds or obligations and a state or
federal agency shall have the right of access to the records.
18. Communications not required by law, rule, procedure, or contract that are made to a government body or to any of its employees
by identified persons outside of government, to the extent that the government body receiving those communications from such
persons outside of government could reasonably believe that those persons would be discouraged from making them to that government
body if they were available for general public examination. As used in this subsection, “persons outside of government” does not include persons or employees of persons who are communicating with respect to a consulting or contractual relationship
with a government body or who are communicating with a government body with whom an arrangement for compensation exists. Notwithstanding
this provision: a. The communication is a public record to the extent that the person outside of government making that communication consents
to its treatment as a public record.
b. Information contained in the communication is a public record to the extent that it can be disclosed without directly or indirectly
indicating the identity of the person outside of government making it or enabling others to ascertain the identity of that
person.
c. Information contained in the communication is a public record to the extent that it indicates the date, time, specific location,
and immediate facts and circumstances surrounding the occurrence of a crime or other illegal act, except to the extent that
its disclosure would plainly and seriously jeopardize a continuing investigation or pose a clear and present danger to the
safety of any person. In any action challenging the failure of the lawful custodian to disclose any particular information
of the kind enumerated in this paragraph, the burden of proof is on the lawful custodian to demonstrate that the disclosure
of that information would jeopardize such an investigation or would pose such a clear and present danger.
19. Examinations, including but not limited to cognitive and psychological examinations for law enforcement officer candidates
administered by or on behalf of a governmental body, to the extent that their disclosure could reasonably be believed by the
custodian to interfere with the accomplishment of the objectives for which they are administered.
20. Information concerning the nature and location of any archaeological resource or site if, in the opinion of the state archaeologist,
disclosure of the information will result in unreasonable risk of damage to or loss of the resource or site where the resource
is located. This subsection shall not be construed to interfere with the responsibilities of the federal government or the state historic preservation
officer pertaining to access, disclosure, and use of archaeological site records.
21. Information concerning the nature and location of any ecologically sensitive resource or site if, in the opinion of the director
of the department of natural resources after consultation with the state ecologist, disclosure of the information will result
in unreasonable risk of damage to or loss of the resource or site where the resource is located. This subsection shall not be construed to interfere with the responsibilities of the federal government or the director of the department
of natural resources and the state ecologist pertaining to access, disclosure, and use of the ecologically sensitive site
records.
22. Reports or recommendations of the Iowa insurance guaranty association filed or made pursuant to section 515B.10, subsection 1, paragraph “a”, subparagraph (2).
24. Reserved.
25. Financial information, which if released would give advantage to competitors and serve no public purpose, relating to commercial
operations conducted or intended to be conducted by a person submitting records containing the information to the department
of agriculture and land stewardship for the purpose of obtaining assistance in business planning.
26. Applications, investigation reports, and case records of persons applying for county general assistance pursuant to section 252.25.
27. Marketing and advertising budget and strategy of a nonprofit corporation which is subject to this chapter. However, this exemption does not apply to salaries or benefits of employees who are employed by the nonprofit corporation
to handle the marketing and advertising responsibilities.
28. The information contained in records of the centralized employee registry created in chapter 252G, except to the extent that disclosure is authorized pursuant to chapter 252G.
29. Records and information obtained or held by independent special counsel during the course of an investigation conducted pursuant
to section 68B.31A. Information that is disclosed to a legislative ethics committee subsequent to a determination of probable cause by independent
special counsel and made pursuant to section 68B.31 is not a confidential record unless otherwise provided by law.
30. Information contained in a declaration of paternity completed and filed with the state registrar of vital statistics pursuant
to section 144.12A, except to the extent that the information may be provided to persons in accordance with section 144.12A.
31. Memoranda, work products, and case files of a mediator and all other confidential communications in the possession of a mediator,
as provided in chapter 10A, subchapter III, and chapter 216. Information in these confidential communications is subject to disclosure only as provided in sections 10A.332 and 216.15B, notwithstanding any other contrary provision of this chapter.
32. Social security numbers of the owners of unclaimed property reported to the treasurer of state pursuant to section 556.11, subsection 2, included on claim forms filed with the treasurer of state pursuant to section 556.19, included in outdated warrant reports received by the treasurer of state pursuant to section 556.2C, or stored in record systems maintained by the treasurer of state for purposes of administering chapter 556, or social security numbers of payees included on state warrants included in records systems maintained by the department
of administrative services for the purpose of documenting and tracking outdated warrants pursuant to section 556.2C.
33. Data processing software, as defined in section 22.3A, which is developed by a government body or developed by a nongovernment body and used by a government body pursuant to a
contractual relationship with the nongovernment body.
35. Records of the department of health and human services pertaining to participants in the gambling treatment program except
as otherwise provided in this chapter.
36. Records of a law enforcement agency or the state department of transportation regarding the issuance of a driver’s license
under section 321.189A.
37. Mediation communications as defined in section 679C.102, except written mediation agreements that resulted from a mediation which are signed on behalf of a governing body. However,
confidentiality of mediation communications resulting from mediation conducted pursuant to chapter 216 shall be governed by chapter 216.
38. a. Records containing information that would disclose, or might lead to the disclosure of, private keys used in an electronic
signature or other similar technologies as provided in chapter 554D. b. Records which if disclosed might jeopardize the security of an electronic transaction pursuant to chapter 554D.
39. Information revealing the identity of a packer or a person who sells livestock to a packer as reported to the department of
agriculture and land stewardship pursuant to section 202A.2.
39A. Information related to the registration and identification of any premises where animals are kept as authorized pursuant to
the foreign animal disease preparedness and response strategy as provided in section 163.3C.
40. The portion of a record request that contains an internet protocol number which identifies the computer from which a person
requests a record, whether the person using such computer makes the request through the IowAccess network or directly to a
lawful custodian. However, such record may be released with the express written consent of the person requesting the record.
41. a. Medical examiner records and reports, including preliminary reports, investigative reports, and autopsy reports. b. Notwithstanding paragraph “a”, the following shall be released as follows: (1) Medical examiner-authored records and reports, including preliminary reports, investigative reports, and autopsy reports,
shall be released to a law enforcement agency that is investigating the death, upon the request of the law enforcement agency.
(2) Preliminary reports of investigations by the medical examiner and autopsy reports for a decedent by whom an anatomical gift
was made in accordance with chapter 142C shall be released to a procurement organization as defined in section 142C.2, upon the request of such procurement organization, unless such disclosure would jeopardize an investigation or pose a clear
and present danger to the public safety or the safety of an individual.
(3) Autopsy reports shall be released to the decedent’s immediate next of kin, upon the request of the decedent’s immediate next
of kin, unless disclosure to the decedent’s immediate next of kin would jeopardize an investigation or pose a clear and present
danger to the public safety or the safety of an individual.
c. Information regarding the cause and manner of death shall not be kept confidential under this subsection, unless disclosure would jeopardize an investigation or pose a clear and present danger to the public safety or the safety
of an individual.
42. Information obtained by the commissioner of insurance in the course of an investigation as provided in section 523C.23.
43. Information obtained by the commissioner of insurance pursuant to section 502.607.
45. The critical asset protection plan or any part of the plan prepared pursuant to section 29C.8 and any information held by the department of homeland security and emergency management that was supplied to the department
by a public or private agency or organization and used in the development of the critical asset protection plan to include,
but not be limited to, surveys, lists, maps, or photographs. Communications and asset information not required by law, rule,
or procedure that are provided to the director by persons outside of government and for which the director has signed a nondisclosure
agreement are exempt from public disclosures. The department of homeland security and emergency management may provide all
or part of the critical asset plan to federal, state, or local governmental agencies which have emergency planning or response
functions if the director is satisfied that the need to know and intended use are reasonable. An agency receiving critical
asset protection plan information from the department shall not redisseminate the information without prior approval of the
director.
46. Military personnel records recorded by the county recorder pursuant to section 331.608.
47. A report regarding interest held in agricultural land required to be filed pursuant to chapter 10B.
50. Information and records concerning physical infrastructure, cyber security, critical infrastructure, security procedures,
or emergency preparedness developed, maintained, or held by a government body for the protection of life or property, if disclosure
could reasonably be expected to jeopardize such life or property. a. Such information and records include but are not limited to information directly related to vulnerability assessments; information
contained in records relating to security measures such as security and response plans, security codes and combinations, passwords,
restricted area passes, keys, and security or response procedures; emergency response protocols; and information contained
in records that if disclosed would significantly increase the vulnerability of critical physical systems or infrastructures
to attack.
b. For purposes of this subsection, “cyber security information and records” include but are not limited to information and records relating to cyber security defenses, threats, attacks, or general
attempts to attack cyber system operations.
51. The information contained in the information program established in section 124.551, except to the extent that disclosure is authorized pursuant to section 124.553.
52. a. The following records relating to a charitable donation made to a foundation acting solely for the support of an institution
governed by the state board of regents, to the board of the Iowa state fair foundation when the record relates to a gift for
deposit in or expenditure from the Iowa state fairgrounds trust fund as provided in section 173.22A, to a foundation acting solely for the support of an institution governed by chapter 260C, to a private foundation as defined in section 509 of the Internal Revenue Code organized for the support of a government body, or to an endow Iowa qualified community foundation, as defined in section 15E.303, organized for the support of a government body: (1) Portions of records that disclose a donor’s or prospective donor’s personal, financial, estate planning, or gift planning
matters.
(2) Records received from a donor or prospective donor regarding such donor’s prospective gift or pledge.
(3) Records containing information about a donor or a prospective donor in regard to the appropriateness of the solicitation and
dollar amount of the gift or pledge.
(4) Portions of records that identify a prospective donor and that provide information on the appropriateness of the solicitation,
the form of the gift or dollar amount requested by the solicitor, and the name of the solicitor.
(5) Portions of records disclosing the identity of a donor or prospective donor, including the specific form of gift or pledge
that could identify a donor or prospective donor, directly or indirectly, when such donor has requested anonymity in connection
with the gift or pledge. This subparagraph does not apply to a gift or pledge from a publicly held business corporation.
b. The confidential records described in paragraph “a”, subparagraphs (1) through (5), shall not be construed to make confidential those portions of records disclosing any of the
following: (1) The amount and date of the donation.
(2) Any donor-designated use or purpose of the donation.
(3) Any other donor-imposed restrictions on the use of the donation.
(4) When a pledge or donation is made expressly conditioned on receipt by the donor, or any person related to the donor by blood
or marriage within the third degree of consanguinity, of any privilege, benefit, employment, program admission, or other special
consideration from the government body, a description of any and all such consideration offered or given in exchange for the
pledge or donation.
c. Except as provided in paragraphs “a” and “b”, portions of records relating to the receipt, holding, and disbursement of gifts made for the benefit of regents institutions
and made through foundations established for support of regents institutions, including but not limited to written fundraising
policies and documents evidencing fundraising practices, shall be subject to this chapter.
53. Information obtained and prepared by the commissioner of insurance pursuant to section 507.14.
54. Information obtained and prepared by the commissioner of insurance pursuant to section 507E.5.
56. Individually identifiable client information contained in the records of the state database created as a homeless management
information system pursuant to standards developed by the United States department of housing and urban development and utilized
by the economic development authority.
57. The following information contained in the records of any governmental body relating to any form of housing assistance: a. An applicant’s social security number.
b. An applicant’s personal financial history.
c. An applicant’s personal medical history or records.
d. An applicant’s current residential address when the applicant has been granted or has made application for a civil or criminal
restraining order for the personal protection of the applicant or a member of the applicant’s household.
59. The information provided in any report, record, claim, or other document submitted to the treasurer of state pursuant to chapter 556 concerning unclaimed or abandoned property, except the name and last known address of each person appearing to be entitled
to unclaimed or abandoned property paid or delivered to the treasurer of state pursuant to that chapter.
60. Information in a record that would permit a governmental body subject to chapter 21 to hold a closed session pursuant to section 21.5 in order to avoid public disclosure of that information, until such time as final action is taken on the subject matter of
that information. Any portion of such a record not subject to this subsection, or not otherwise confidential, shall be made available to the public. After the governmental body has taken final action
on the subject matter pertaining to the information in that record, this subsection shall no longer apply. This subsection shall not apply more than ninety days after a record is known to exist by the governmental body, unless it is not possible
for the governmental body to take final action within ninety days. The burden shall be on the governmental body to prove that
final action was not possible within the ninety-day period.
61. Records of the department of health and human services pertaining to clients served by the state office or a local office
of public guardian as defined in section 231E.3.
62. Records maintained by the department of health and human services or office of long-term care ombudsman that disclose the
identity of a complainant, resident, tenant, or individual receiving services provided by the department of health and human
services, an area agency on aging, or the office of long-term care ombudsman, unless disclosure is otherwise allowed under
section 231.42, subsection 12, paragraph “a”.
63. Information obtained by the superintendent of credit unions in connection with a complaint response process as provided in
section 533.501, subsection 3.
65. Tentative, preliminary, draft, speculative, or research material, prior to its completion for the purpose for which it is
intended and in a form prior to the form in which it is submitted for use or used in the actual formulation, recommendation,
adoption, or execution of any official policy or action by a public official authorized to make such decisions for the governmental
body or the government body. This subsection shall not apply to public records that are actually submitted for use or are used in the formulation, recommendation, adoption,
or execution of any official policy or action of a governmental body or a government body by a public official authorized
to adopt or execute official policy for the governmental body or the government body.
66. Personal information contained on electronic driver’s license or nonoperator’s identification card records that is provided
by the licensee or card holder to the department of transportation for use by law enforcement, first responders, emergency
medical service providers, and other medical personnel responding to or assisting with an emergency.
67. Electronic mail addresses of individuals or phone numbers of individuals, and personally identifiable information about those
individuals, collected by state departments and agencies for the sole purpose of disseminating emergency or routine information
and notices through electronic communications that are not prepared for a specific recipient.
68. Information required to be provided by a disclosing entity pursuant to 42 C.F.R. §455.104, pertaining to an individual with an ownership or control interest who is an officer or director of a nonprofit corporation.
69. The evidence of public employee support for the certification, retention and recertification, or decertification of an employee
organization as defined in section 20.3 that is submitted to the employment appeal board as provided in section 20.14 or 20.15.
70. Information indicating whether a public employee voted in a certification, retention and recertification, or decertification
election held pursuant to section 20.15 or how the employee voted on any question on a ballot in such an election.
71. Information and records related to cyber security information or critical infrastructure, the disclosure of which may expose
or create vulnerability to critical infrastructure systems, held by the utilities commission or the department of homeland
security and emergency management for purposes relating to the safeguarding of telecommunications, electric, water, sanitary
sewage, storm water drainage, energy, hazardous liquid, natural gas, or other critical infrastructure systems. For purposes
of this subsection, “cyber security information” includes but is not limited to information relating to cyber security defenses, threats, attacks, or general attempts to
attack cyber system operations.
72. The voter verification number, as defined in section 53.2, subsection 4, paragraph “c”, that is assigned to a voter and maintained and updated in the statewide voter registration system.
75. Identifying information submitted to the department of revenue from a distributor pursuant to section 455C.2, subsection 2, paragraph “b”. However, this subsection shall not be construed to prohibit the dissemination of aggregated information that does not identify a specific distributor.
76. Information obtained from security camera systems operated by the legislative branch monitoring property owned or leased by
the state.
77. Information obtained from state employee identification card access systems for buildings and rooms owned or leased by the
state.
[C71, 73, 75, 77, 79,
81, §68A.7;
81 Acts, ch 36, §1,
ch 37, §1,
ch 38, §1,
ch 62, §4]
C85, §22.7
85 Acts, ch 134, §16; 85 Acts, ch 175, §1; 85 Acts, ch 208, §1; 86 Acts, ch 1184, §1; 86 Acts, ch 1228, §1; 87 Acts, ch 223, §20; 88 Acts, ch 1010, §1; 88 Acts, ch 1256, §1; 89 Acts, ch 194, §1; 89 Acts, ch 304, §102; 89 Acts, ch 311, §22; 90 Acts, ch 1017, §1; 90 Acts, ch 1271, §703; 92 Acts, ch 1212, §3; 93 Acts, ch 79, §2; 93 Acts, ch 163, §27; 94 Acts, ch 1023, §76; 94 Acts, ch 1064, §1; 94 Acts, ch 1092, §1; 94 Acts, ch 1174, §1; 95 Acts, ch 100, §1; 95 Acts, ch 129, §1; 95 Acts, ch 191, §1; 96 Acts, ch 1037, §1; 96 Acts, ch 1099, §16; 96 Acts, ch 1133, §38; 96 Acts, ch 1150, §1; 96 Acts, ch 1212, §10; 97 Acts, ch 92, §1; 97 Acts, ch 159, §1; 98 Acts, ch 1062, §8, 9; 98 Acts, ch 1073, §9; 98 Acts, ch 1090, §59, 84; 99 Acts, ch 88, §1, 11, 13; 99 Acts, ch 146, §43; 2000 Acts, ch 1014, §1; 2000 Acts, ch 1140, §1; 2000 Acts, ch 1147, §27; 2000 Acts, ch 1161, §1; 2000 Acts, ch 1189, §25; 2001 Acts, ch 24, §17; 2001 Acts, ch 108, §1; 2002 Acts, ch 1038, §1; 2002 Acts, ch 1067, §13; 2002 Acts, ch 1076, §2; 2002 Acts, ch 1098, §1; 2002 Acts, ch 1117, §53, 56; 2003 Acts, ch 114, §1; 2003 Acts, ch 145, §286; 2003 Acts, ch 179, §157; 2004 Acts, ch 1091, §3; 2004 Acts, ch 1104, §4; 2004 Acts, ch 1147, §6; 2004 Acts, ch 1161, §65, 68; 2004 Acts, ch 1175, §462, 468; 2005 Acts, ch 19, §16; 2005 Acts, ch 68, §2; 2005 Acts, ch 168, §8, 23; 2006 Acts, ch 1054, §1, 2; 2006 Acts, ch 1117, §2; 2006 Acts, ch 1122, §1; 2006 Acts, ch 1127, §1; 2006 Acts, ch 1147, §1, 11; 2006 Acts, ch 1148, §1; 2006 Acts, ch 1185, §57, 58, 92; 2007 Acts, ch 37, §1; 2007 Acts, ch 62, §1; 2007 Acts, ch 126, §11; 2007 Acts, ch 175, §1; 2008 Acts, ch 1032, §201; 2008 Acts, ch 1144, §2, 12, 13; 2008 Acts, ch 1191, §34, 99; 2009 Acts, ch 23, §6; 2009 Acts, ch 48, §1; 2009 Acts, ch 119, §33; 2010 Acts, ch 1121, §1; 2011 Acts, ch 20, §3; 2011 Acts, ch 30, §1; 2011 Acts, ch 79, §2; 2011 Acts, ch 106, §8 – 10, 17; 2011 Acts, ch 118, §39, 85, 89; 2012 Acts, ch 1086, §1; 2012 Acts, ch 1115, §2, 17; 2013 Acts, ch 18, §4; 2013 Acts, ch 29, §7; 2013 Acts, ch 103, §1; 2013 Acts, ch 116, §2; 2013 Acts, ch 129, §47; 2014 Acts, ch 1136, §23; 2015 Acts, ch 42, §3; 2015 Acts, ch 60, §1; 2015 Acts, ch 128, §1, 50, 51; 2015 Acts, ch 138, §12, 161, 162; 2016 Acts, ch 1018, §1; 2016 Acts, ch 1085, §1, 3; 2017 Acts, ch 2, §19, 20, 26, 27, 50, 53, 54; 2017 Acts, ch 21, §1, 2; 2017 Acts, ch 54, §13; 2017 Acts, ch 110, §1; 2017 Acts, ch 122, §1, 2; 2017 Acts, ch 156, §1; 2018 Acts, ch 1041, §119; 2018 Acts, ch 1048, §1; 2021 Acts, ch 120, §1; 2021 Acts, ch 149, §2; 2022 Acts, ch 1071, §1; 2022 Acts, ch 1139, §1, 20; 2023 Acts, ch 19, §32, 2660; 2023 Acts, ch 64, §7; 2023 Acts, ch 119, §11; 2024 Acts, ch 1043, §29; 2024 Acts, ch 1170, §174, 369; 2025 Acts, ch 139, §3
Referred to in
§2C.9, 10B.5, 10B.5A, 15.274, 21.5, 22.10, 22.15, 29C.17A, 29E.1, 34A.7A, 39A.7, 47.1, 68B.31, 68B.32B, 76.11, 80B.13A, 80G.1, 87.11, 99D.19, 99E.8, 99F.12, 99G.34, 100.5, 124.553, 135.43, 135O.4, 136A.7, 147A.26, 159A.14, 163.3C, 166D.10, 173.22A, 202A.2, 203D.4, 206.19, 214A.36, 232.149, 252G.5, 262.9, 263B.10, 266.46, 266.47, 279.51A, 280.19A, 280.36, 299A.11, 321.189A, 388.2A, 452A.33, 455B.117, 455C.2, 462A.7, 465C.14, 466B.43, 466B.44, 466B.47, 466B.49, 468.17A, 476.74, 477A.7, 510C.2, 515.103, 515J.13, 521A.7, 523A.204, 523A.205, 523A.206, 523A.207, 523A.401, 523A.502A, 523A.803, 523C.23, 556.24A, 692.8A, 692.18, 692C.1, 708.2B, 716.6B, 901.5B, 901C.2, 901C.3, 907.4, 907.9, 915.90 22.11 Fair information practices.
This section may be cited as the
“Iowa Fair Information Practices Act”. It is the intent of
this section to require that the information policies of state agencies are clearly defined and subject to public review and comment.
1. Each state agency as defined in chapter 17A shall adopt rules which provide the following: a. The nature and extent of the personally identifiable information collected by the agency, the legal authority for the collection
of that information, and a description of the means of storage.
b. A description of which of its records are public records, which are confidential records, and which are partially public and
partially confidential records and the legal authority for the confidentiality of the records. The description shall indicate
whether the records contain personally identifiable information.
c. The procedure for providing the public with access to public records.
d. The procedures for allowing a person to review a government record about that person and have additions, dissents, or objections
entered in that record unless the review is prohibited by statute.
e. The procedures by which the subject of a confidential record may have a copy of that record released to a named third party.
f. The procedures by which the agency shall notify persons supplying information requested by the agency of the use that will
be made of the information, which persons outside of the agency might routinely be provided this information, which parts
of the information requested are required and which are optional and the consequences of failing to provide the information
requested.
g. Whether a data processing system matches, collates, or permits the comparison of personally identifiable information in one
record system with personally identifiable information in another record system.
2. A state agency shall not use any personally identifiable information after July 1, 1988, unless it is in a record system described
by the rules required by this section.