House
File
2506
H-8157
Amend
House
File
2506
as
follows:
1
1.
By
striking
everything
after
the
enacting
clause
and
2
inserting:
3
<
Section
1.
NEW
SECTION
.
715D.1
Definitions.
4
As
used
in
this
chapter,
unless
the
context
otherwise
5
requires:
6
1.
“Affiliate”
means
a
legal
entity
that
controls,
is
7
controlled
by,
or
is
under
common
control
with
another
legal
8
entity
or
shares
common
branding
with
another
legal
entity.
9
For
the
purposes
of
this
definition,
“control”
or
“controlled”
10
means:
11
a.
Ownership
of,
or
the
power
to
vote,
more
than
fifty
12
percent
of
the
outstanding
shares
of
any
class
of
voting
13
security
of
a
company.
14
b.
Control
in
any
manner
over
the
election
of
a
majority
of
15
the
directors
or
of
individuals
exercising
similar
functions.
16
c.
The
power
to
exercise
controlling
influence
over
the
17
management
of
a
company.
18
2.
“Aggregate
data”
means
information
that
relates
to
a
19
group
or
category
of
consumers,
from
which
individual
consumer
20
identities
have
been
removed,
that
is
not
linked
or
reasonably
21
linkable
to
any
consumer.
22
3.
“Authenticate”
means
verifying
through
reasonable
means
23
that
a
consumer,
entitled
to
exercise
their
consumer
rights
in
24
section
715D.3,
is
the
same
consumer
exercising
such
consumer
25
rights
with
respect
to
the
personal
data
at
issue.
26
4.
“Biometric
data”
means
data
generated
by
automatic
27
measurements
of
an
individual’s
biological
characteristics,
28
such
as
a
fingerprint,
voiceprint,
eye
retinas,
irises,
or
29
other
unique
biological
patterns
or
characteristics
that
is
30
used
to
identify
a
specific
individual.
“Biometric
data”
31
does
not
include
a
physical
or
digital
photograph,
a
video
or
32
audio
recording
or
data
generated
therefrom,
or
information
33
collected,
used,
or
stored
for
health
care
treatment,
payment,
34
or
operations
under
HIPAA.
35
-1-
HF
2506.3553
(1)
89
es/rn
1/
20
#1.
5.
“Child”
means
any
natural
person
younger
than
thirteen
1
years
of
age.
2
6.
“Consent”
means
a
clear
affirmative
act
signifying
a
3
consumer’s
freely
given,
specific,
informed,
and
unambiguous
4
agreement
to
process
personal
data
relating
to
the
consumer.
5
“Consent”
may
include
a
written
statement,
including
a
6
statement
written
by
electronic
means,
or
any
other
unambiguous
7
affirmative
action.
8
7.
“Consumer”
means
a
natural
person
who
is
a
resident
of
9
the
state
acting
only
in
an
individual
or
household
context
and
10
excluding
a
natural
person
acting
in
a
commercial
or
employment
11
context.
12
8.
“Controller”
means
a
person
that,
alone
or
jointly
with
13
others,
determines
the
purpose
and
means
of
processing
personal
14
data.
15
9.
“Covered
entity”
means
the
same
as
“covered
entity”
16
defined
by
HIPAA.
17
10.
“De-identified
data”
means
data
that
cannot
reasonably
18
be
linked
to
an
identified
or
identifiable
natural
person.
19
11.
“Fund”
means
the
consumer
education
and
litigation
fund
20
established
pursuant
to
section
714.16C.
21
12.
“Health
care
provider”
means
any
of
the
following:
22
a.
A
general
hospital,
ambulatory
surgical
or
treatment
23
center,
skilled
nursing
center,
or
assisted
living
center
24
licensed
or
certified
by
the
state.
25
b.
A
psychiatric
hospital
licensed
by
the
state.
26
c.
A
hospital
operated
by
the
state.
27
d.
A
hospital
operated
by
the
state
board
of
regents.
28
e.
A
person
licensed
to
practice
medicine
or
osteopathy
in
29
the
state.
30
f.
A
person
licensed
to
furnish
health
care
policies
or
31
plans
in
the
state.
32
g.
A
person
licensed
to
practice
dentistry
in
the
state.
33
h.
“Health
care
provider”
does
not
include
a
continuing
care
34
retirement
community
or
any
nursing
facility
of
a
religious
35
-2-
HF
2506.3553
(1)
89
es/rn
2/
20
body
which
depends
upon
prayer
alone
for
healing.
1
13.
“Health
Insurance
Portability
and
Accountability
2
Act”
or
“HIPAA”
means
the
Health
Insurance
Portability
and
3
Accountability
Act
of
1996,
Pub.
L.
No.
104-191,
including
4
amendments
thereto
and
regulations
promulgated
thereunder.
5
14.
“Health
record”
means
any
written,
printed,
or
6
electronically
recorded
material
maintained
by
a
health
care
7
provider
in
the
course
of
providing
health
services
to
an
8
individual
concerning
the
individual
and
the
services
provided,
9
including
related
health
information
provided
in
confidence
to
10
a
health
care
provider.
11
15.
“Identified
or
identifiable
natural
person”
means
a
12
person
who
can
be
readily
identified,
directly
or
indirectly.
13
16.
“Institution
of
higher
education”
means
nonprofit
14
private
institutions
of
higher
education
and
proprietary
15
private
institutions
of
higher
education
in
the
state,
16
community
colleges,
and
each
associate-degree-granting
and
17
baccalaureate
public
institutions
of
higher
education
in
the
18
state.
19
17.
“Nonprofit
organization”
means
any
corporation
organized
20
under
chapter
504,
any
organization
exempt
from
taxation
21
under
sections
501(c)(3),
501(c)(6),
or
501(c)(12)
of
the
22
Internal
Revenue
Code,
any
organization
exempt
from
taxation
23
under
section
501(c)(4)
of
the
Internal
Revenue
Code
that
24
is
established
to
detect
or
prevent
insurance-related
crime
25
or
fraud,
and
any
subsidiaries
and
affiliates
of
entities
26
organized
pursuant
to
chapter
499.
27
18.
“Personal
data”
means
any
information
that
is
linked
or
28
reasonably
linkable
to
an
identified
or
identifiable
natural
29
person.
“Personal
data”
does
not
include
de-identified
or
30
aggregate
data
or
publicly
available
information.
31
19.
“Precise
geolocation
data”
means
information
derived
32
from
technology,
including
but
not
limited
to
global
33
positioning
system
level
latitude
and
longitude
coordinates
or
34
other
mechanisms,
that
identifies
the
specific
location
of
a
35
-3-
HF
2506.3553
(1)
89
es/rn
3/
20
natural
person
with
precision
and
accuracy
within
a
radius
of
1
one
thousand
seven
hundred
fifty
feet.
“Precise
geolocation
2
data”
does
not
include
the
content
of
communications,
or
any
3
data
generated
by
or
connected
to
advanced
utility
metering
4
infrastructure
systems
or
equipment
for
use
by
a
utility.
5
20.
“Process”
or
“processing”
means
any
operation
or
set
6
of
operations
performed,
whether
by
manual
or
automated
means,
7
on
personal
data
or
on
sets
of
personal
data,
such
as
the
8
collection,
use,
storage,
disclosure,
analysis,
deletion,
or
9
modification
of
personal
data.
10
21.
“Processor”
means
a
person
that
processes
personal
data
11
on
behalf
of
a
controller.
12
22.
“Protected
health
information”
means
the
same
as
13
protected
health
information
established
by
HIPAA.
14
23.
“Pseudonymous
data”
means
personal
data
that
cannot
15
be
attributed
to
a
specific
natural
person
without
the
use
16
of
additional
information,
provided
that
such
additional
17
information
is
kept
separately
and
is
subject
to
appropriate
18
technical
and
organizational
measures
to
ensure
that
19
the
personal
data
is
not
attributed
to
an
identified
or
20
identifiable
natural
person.
21
24.
“Publicly
available
information”
means
information
22
that
is
lawfully
made
available
through
federal,
state,
or
23
local
government
records,
or
information
that
a
business
has
24
reasonable
basis
to
believe
is
lawfully
made
available
to
25
the
general
public
through
widely
distributed
media,
by
the
26
consumer,
or
by
a
person
to
whom
the
consumer
has
disclosed
the
27
information,
unless
the
consumer
has
restricted
the
information
28
to
a
specific
audience.
29
25.
“Sale
of
personal
data”
means
the
exchange
of
personal
30
data
for
monetary
consideration
by
the
controller
to
a
third
31
party.
“Sale
of
personal
data”
does
not
include:
32
a.
The
disclosure
of
personal
data
to
a
processor
that
33
processes
the
personal
data
on
behalf
of
the
controller.
34
b.
The
disclosure
of
personal
data
to
a
third
party
for
35
-4-
HF
2506.3553
(1)
89
es/rn
4/
20
purposes
of
providing
a
product
or
service
requested
by
the
1
consumer
or
a
parent
of
a
child.
2
c.
The
disclosure
or
transfer
of
personal
data
to
an
3
affiliate
of
the
controller.
4
d.
The
disclosure
of
information
that
the
consumer
5
intentionally
made
available
to
the
general
public
via
a
6
channel
of
mass
media
and
did
not
restrict
to
a
specific
7
audience.
8
e.
The
disclosure
or
transfer
of
personal
data
when
a
9
consumer
uses
or
directs
a
controller
to
intentionally
disclose
10
personal
data
or
intentionally
interact
with
one
or
more
third
11
parties.
12
f.
The
disclosure
or
transfer
of
personal
data
to
a
third
13
party
as
an
asset
that
is
part
of
a
proposed
or
actual
merger,
14
acquisition,
bankruptcy,
or
other
transaction
in
which
the
15
third
party
assumes
control
of
all
or
part
of
the
controller’s
16
assets.
17
26.
“Sensitive
data”
means
a
category
of
personal
data
that
18
includes
the
following:
19
a.
Racial
or
ethnic
origin,
religious
beliefs,
mental
or
20
physical
health
diagnosis,
sexual
orientation,
or
citizenship
21
or
immigration
status,
except
to
the
extent
such
data
is
used
22
in
order
to
avoid
discrimination
on
the
basis
of
a
protected
23
class
that
would
violate
a
federal
or
state
anti-discrimination
24
law.
25
b.
Genetic
or
biometric
data
that
is
processed
for
the
26
purpose
of
uniquely
identifying
a
natural
person.
27
c.
The
personal
data
collected
from
a
known
child.
28
d.
Precise
geolocation
data.
29
27.
“State
agency”
means
the
same
as
defined
in
129
IAC
30
10.2(8B).
31
28.
“Targeted
advertising”
means
displaying
advertisements
32
to
a
consumer
where
the
advertisement
is
selected
based
on
33
personal
data
obtained
from
that
consumer’s
activities
over
34
time
and
across
nonaffiliated
websites
or
online
applications
35
-5-
HF
2506.3553
(1)
89
es/rn
5/
20
to
predict
such
consumer’s
preferences
or
interests.
“Targeted
1
advertising”
does
not
include
the
following:
2
a.
Advertisements
based
on
activities
within
a
controller’s
3
own
or
affiliated
websites
or
online
applications.
4
b.
Advertisements
based
on
the
context
of
a
consumer’s
5
current
search
query,
visit
to
a
website,
or
online
6
application.
7
c.
Advertisements
directed
to
a
consumer
in
response
to
the
8
consumer’s
request
for
information
or
feedback.
9
d.
Processing
personal
data
solely
for
measuring
or
10
reporting
advertising
performance,
reach,
or
frequency.
11
29.
“Third
party”
means
a
natural
or
legal
person,
public
12
authority,
agency,
or
body
other
than
the
consumer,
controller,
13
processor,
or
an
affiliate
of
the
processor
or
the
controller.
14
30.
“Trade
secret”
means
information,
including
but
not
15
limited
to
a
formula,
pattern,
compilation,
program,
device,
16
method,
technique,
or
process,
that
consists
of
the
following:
17
a.
Information
that
derives
independent
economic
value,
18
actual
or
potential,
from
not
being
generally
known
to,
and
not
19
being
readily
ascertainable
by
proper
means
by,
other
persons
20
who
can
obtain
economic
value
from
its
disclosure
or
use.
21
b.
Information
that
is
the
subject
of
efforts
that
are
22
reasonable
under
the
circumstances
to
maintain
its
secrecy.
23
Sec.
2.
NEW
SECTION
.
715D.2
Scope
and
exemptions.
24
1.
This
chapter
applies
to
a
person
conducting
business
in
25
the
state
or
producing
products
or
services
that
are
targeted
26
to
consumers
who
are
residents
of
the
state
and
that
during
a
27
calendar
year
does
either
of
the
following:
28
a.
Controls
or
processes
personal
data
of
at
least
one
29
hundred
thousand
consumers.
30
b.
Controls
or
processes
personal
data
of
at
least
31
twenty-five
thousand
consumers
and
derives
over
fifty
percent
32
of
gross
revenue
from
the
sale
of
personal
data.
33
2.
This
chapter
shall
not
apply
to
the
state
or
any
34
political
subdivision
of
the
state;
financial
institutions,
35
-6-
HF
2506.3553
(1)
89
es/rn
6/
20
affiliates
of
financial
institutions,
or
data
subject
to
Tit.
V
1
of
the
federal
Gramm-Leach-Bliley
Act
of
1999,
15
U.S.C.
§6801
2
et
seq.;
covered
entities
or
business
associates
governed
by
3
the
privacy,
security,
and
breach
notification
rules
issued
by
4
the
Iowa
department
of
human
services
and
the
Iowa
department
5
of
public
health;
45
C.F.R.
pts.
160
and
164
established
6
pursuant
to
HIPAA;
nonprofit
organizations;
or
institutions
of
7
higher
education.
8
3.
The
following
information
and
data
is
exempt
from
this
9
chapter:
10
a.
Protected
health
information
under
HIPAA.
11
b.
Health
records.
12
c.
Patient
identifying
information
for
purposes
of
42
U.S.C.
13
§290dd-2.
14
d.
Identifiable
private
information
for
purposes
of
the
15
federal
policy
for
the
protection
of
human
subjects
under
45
16
C.F.R.
pt.
46.
17
e.
Identifiable
private
information
that
is
otherwise
18
information
collected
as
part
of
human
subjects
research
19
pursuant
to
the
good
clinical
practice
guidelines
issued
by
20
the
international
council
for
harmonization
of
technical
21
requirements
for
pharmaceuticals
for
human
use.
22
f.
The
protection
of
human
subjects
under
21
C.F.R.
pts.
6,
23
50,
and
56.
24
g.
Personal
data
used
or
shared
in
research
conducted
in
25
accordance
with
the
requirements
set
forth
in
this
chapter,
or
26
other
research
conducted
in
accordance
with
applicable
law.
27
h.
Information
and
documents
created
for
purposes
of
the
28
federal
Health
Care
Quality
Improvement
Act
of
1986,
42
U.S.C.
29
§11101
et
seq.
30
i.
Patient
safety
work
product
for
purposes
of
the
federal
31
Patient
Safety
and
Quality
Improvement
Act,
42
U.S.C.
§299b-21
32
et
seq.
33
j.
Information
derived
from
any
of
the
health
care-related
34
information
listed
in
this
subsection
that
is
de-identified
in
35
-7-
HF
2506.3553
(1)
89
es/rn
7/
20
accordance
with
the
requirements
for
de-identification
pursuant
1
to
HIPAA.
2
k.
Information
originating
from,
and
intermingled
to
be
3
indistinguishable
with,
or
information
treated
in
the
same
4
manner
as
information
exempt
under
this
subsection
that
is
5
maintained
by
a
covered
entity
or
business
associate
as
defined
6
by
HIPAA
or
a
program
or
a
qualified
service
organization
as
7
defined
by
42
U.S.C.
§290dd-2.
8
l.
Information
used
only
for
public
health
activities
and
9
purposes
as
authorized
by
HIPAA.
10
m.
The
collection,
maintenance,
disclosure,
sale,
11
communication,
or
use
of
any
personal
information
bearing
on
a
12
consumer’s
credit
worthiness,
credit
standing,
credit
capacity,
13
character,
general
reputation,
personal
characteristics,
or
14
mode
of
living
by
a
consumer
reporting
agency
or
furnisher
that
15
provides
information
for
use
in
a
consumer
report,
and
by
a
16
user
of
a
consumer
report,
but
only
to
the
extent
that
such
17
activity
is
regulated
by
and
authorized
under
the
federal
Fair
18
Credit
Reporting
Act,
15
U.S.C.
§1681
et
seq.
19
n.
Personal
data
collected,
processed,
sold,
or
disclosed
in
20
compliance
with
the
federal
Driver’s
Privacy
Protection
Act
of
21
1994,
18
U.S.C.
§2721
et
seq.
22
o.
Personal
data
regulated
by
the
federal
Family
Educational
23
Rights
and
Privacy
Act,
20
U.S.C.
§1232
et
seq.
24
p.
Personal
data
collected,
processed,
sold,
or
disclosed
in
25
compliance
with
the
federal
Farm
Credit
Act,
12
U.S.C.,
§2001
26
et
seq.
27
q.
Data
processed
or
maintained
as
follows:
28
(1)
In
the
course
of
an
individual
applying
to,
employed
29
by,
or
acting
as
an
agent
or
independent
contractor
of
a
30
controller,
processor,
or
third
party,
to
the
extent
that
the
31
data
is
collected
and
used
within
the
context
of
that
role.
32
(2)
As
the
emergency
contact
information
of
an
individual
33
under
this
chapter
used
for
emergency
contact
purposes.
34
(3)
That
is
necessary
to
retain
to
administer
benefits
35
-8-
HF
2506.3553
(1)
89
es/rn
8/
20
for
another
individual
relating
to
the
individual
under
1
subparagraph
(1)
and
used
for
the
purposes
of
administering
2
those
benefits.
3
r.
Personal
data
used
in
accordance
with
the
federal
4
Children’s
Online
Privacy
Protection
Act,
15
U.S.C.
§6501
-
5
6506,
and
its
rules,
regulations,
and
exceptions
thereto.
6
Sec.
3.
NEW
SECTION
.
715D.3
Consumer
data
rights.
7
1.
A
consumer
may
invoke
the
consumer
rights
authorized
8
pursuant
to
this
section
at
any
time
by
submitting
a
request
to
9
the
controller,
through
the
means
specified
by
the
controller
10
pursuant
to
section
715D.4,
subsection
6,
specifying
the
11
consumer
rights
the
consumer
wishes
to
invoke.
A
known
child’s
12
parent
or
legal
guardian
may
invoke
such
consumer
rights
13
on
behalf
of
the
known
child
regarding
processing
personal
14
data
belonging
to
the
child.
A
controller
shall
comply
with
15
an
authenticated
consumer
request
to
exercise
all
of
the
16
following:
17
a.
To
confirm
whether
a
controller
is
processing
the
18
consumer’s
personal
data
and
to
access
such
personal
data.
19
b.
To
delete
personal
data
provided
by
the
consumer.
20
c.
To
obtain
a
copy
of
the
consumer’s
personal
data,
except
21
as
to
personal
data
that
is
defined
as
“personal
information”
22
pursuant
to
section
715C.1
that
is
subject
to
security
breach
23
protection,
that
the
consumer
previously
provided
to
the
24
controller
in
a
portable
and,
to
the
extent
technically
25
practicable,
readily
usable
format
that
allows
the
consumer
26
to
transmit
the
data
to
another
controller
without
hindrance,
27
where
the
processing
is
carried
out
by
automated
means.
28
d.
To
opt
out
of
targeted
advertising
or
the
sale
of
29
personal
data.
30
2.
Except
as
otherwise
provided
in
this
chapter,
a
31
controller
shall
comply
with
a
request
by
a
consumer
to
32
exercise
the
consumer
rights
authorized
pursuant
to
this
33
section
as
follows:
34
a.
A
controller
shall
respond
to
the
consumer
without
undue
35
-9-
HF
2506.3553
(1)
89
es/rn
9/
20
delay,
but
in
all
cases
within
forty-five
days
of
receipt
1
of
a
request
submitted
pursuant
to
the
methods
described
in
2
this
section.
The
response
period
may
be
extended
once
by
3
forty-five
additional
days
when
reasonably
necessary
upon
4
considering
the
complexity
and
number
of
the
consumer’s
5
requests
by
informing
the
consumer
of
any
such
extension
within
6
the
initial
forty-five-day
response
period,
together
with
the
7
reason
for
the
extension.
8
b.
If
a
controller
declines
to
take
action
regarding
the
9
consumer’s
request,
the
controller
shall
inform
the
consumer
10
without
undue
delay
of
the
justification
for
declining
to
take
11
action,
except
in
the
case
of
a
suspected
fraudulent
request,
12
in
which
case
the
controller
may
state
that
the
controller
was
13
unable
to
authenticate
the
request.
The
controller
shall
also
14
provide
instructions
for
appealing
the
decision
pursuant
to
15
subsection
3.
16
c.
Information
provided
in
response
to
a
consumer
request
17
shall
be
provided
by
a
controller
free
of
charge,
up
to
18
twice
annually
per
consumer.
If
a
request
from
a
consumer
19
is
manifestly
unfounded,
excessive,
repetitive,
technically
20
unfeasible,
or
the
controller
reasonably
believes
that
the
21
primary
purpose
of
the
request
is
not
to
exercise
a
consumer
22
right,
the
controller
may
charge
the
consumer
a
reasonable
fee
23
to
cover
the
administrative
costs
of
complying
with
the
request
24
or
decline
to
act
on
the
request.
The
controller
bears
the
25
burden
of
demonstrating
the
manifestly
unfounded,
excessive,
26
repetitive,
or
technically
unfeasible
nature
of
the
request.
27
d.
If
a
controller
is
unable
to
authenticate
a
request
28
using
commercially
reasonable
efforts,
the
controller
shall
29
not
be
required
to
comply
with
a
request
to
initiate
an
action
30
under
this
section
and
may
request
that
the
consumer
provide
31
additional
information
reasonably
necessary
to
authenticate
the
32
consumer
and
the
consumer’s
request.
33
3.
A
controller
shall
establish
a
process
for
a
consumer
34
to
appeal
the
controller’s
refusal
to
take
action
on
a
request
35
-10-
HF
2506.3553
(1)
89
es/rn
10/
20
within
a
reasonable
period
of
time
after
the
consumer’s
1
receipt
of
the
decision
pursuant
to
this
section.
The
appeal
2
process
shall
be
conspicuously
available
and
similar
to
the
3
process
for
submitting
requests
to
initiate
action
pursuant
4
to
this
section.
Within
sixty
days
of
receipt
of
an
appeal,
5
a
controller
shall
inform
the
consumer
in
writing
of
any
6
action
taken
or
not
taken
in
response
to
the
appeal,
including
7
a
written
explanation
of
the
reasons
for
the
decision.
If
8
the
appeal
is
denied,
the
controller
shall
also
provide
the
9
consumer
with
an
online
mechanism
through
which
the
consumer
10
may
contact
the
attorney
general
to
submit
a
complaint.
11
Sec.
4.
NEW
SECTION
.
715D.4
Data
controller
duties.
12
1.
A
controller
shall
adopt
and
implement
reasonable
13
administrative,
technical,
and
physical
data
security
practices
14
to
protect
the
confidentiality,
integrity,
and
accessibility
15
of
personal
data.
Such
data
security
practices
shall
be
16
appropriate
to
the
volume
and
nature
of
the
personal
data
17
at
issue.
A
controller
shall
not
process
sensitive
data
18
concerning
a
consumer
or
a
nonexempt
purpose
without
the
19
consumer
having
been
presented
with
clear
notice
and
an
20
opportunity
to
opt
out
of
such
processing,
or,
in
the
case
of
21
the
processing
of
sensitive
data
concerning
a
known
child,
22
without
processing
such
data
in
accordance
with
the
federal
23
Children’s
Online
Privacy
Protection
Act,
15
U.S.C.
§6501
et
24
seq.
25
2.
A
controller
shall
not
process
personal
data
in
26
violation
of
state
and
federal
laws
that
prohibit
unlawful
27
discrimination
against
a
consumer.
A
controller
shall
not
28
discriminate
against
a
consumer
for
exercising
any
of
the
29
consumer
rights
contained
in
this
chapter,
including
denying
30
goods
or
services,
charging
different
prices
or
rates
for
31
goods
or
services,
or
providing
a
different
level
of
quality
32
of
goods
and
services
to
the
consumer.
However,
nothing
in
33
this
chapter
shall
be
construed
to
require
a
controller
to
34
provide
a
product
or
service
that
requires
the
personal
data
35
-11-
HF
2506.3553
(1)
89
es/rn
11/
20
of
a
consumer
that
the
controller
does
not
collect
or
maintain
1
or
to
prohibit
a
controller
from
offering
a
different
price,
2
rate,
level,
quality,
or
selection
of
goods
or
services
to
a
3
consumer,
including
offering
goods
or
services
for
no
fee,
4
if
the
consumer
has
exercised
the
consumer’s
right
to
opt
5
out
pursuant
to
section
715D.3
or
the
offer
is
related
to
a
6
consumer’s
voluntary
participation
in
a
bona
fide
loyalty,
7
rewards,
premium
features,
discounts,
or
club
card
program.
8
3.
Any
provision
of
a
contract
or
agreement
that
purports
to
9
waive
or
limit
in
any
way
consumer
rights
pursuant
to
section
10
715D.3
shall
be
deemed
contrary
to
public
policy
and
shall
be
11
void
and
unenforceable.
12
4.
A
controller
shall
provide
consumers
with
a
reasonably
13
accessible,
clear,
and
meaningful
privacy
notice
that
includes
14
the
following:
15
a.
The
categories
of
personal
data
processed
by
the
16
controller.
17
b.
The
purpose
for
processing
personal
data.
18
c.
How
consumers
may
exercise
their
consumer
rights
pursuant
19
to
section
715D.3,
including
how
a
consumer
may
appeal
a
20
controller’s
decision
with
regard
to
the
consumer’s
request.
21
d.
The
categories
of
personal
data
that
the
controller
22
shares
with
third
parties,
if
any.
23
e.
The
categories
of
third
parties,
if
any,
with
whom
the
24
controller
shares
personal
data.
25
5.
If
a
controller
sells
a
consumer’s
personal
data
to
third
26
parties
or
engages
in
targeted
advertising,
the
controller
27
shall
clearly
and
conspicuously
disclose
such
activity,
as
well
28
as
the
manner
in
which
a
consumer
may
exercise
the
right
to
opt
29
out
of
such
activity.
30
6.
A
controller
shall
establish,
and
shall
describe
in
31
a
privacy
notice,
secure
and
reliable
means
for
consumers
to
32
submit
a
request
to
exercise
their
consumer
rights
under
this
33
chapter.
Such
means
shall
consider
the
ways
in
which
consumers
34
normally
interact
with
the
controller,
the
need
for
secure
and
35
-12-
HF
2506.3553
(1)
89
es/rn
12/
20
reliable
communication
of
such
requests,
and
the
ability
of
1
the
controller
to
authenticate
the
identity
of
the
consumer
2
making
the
request.
A
controller
shall
not
require
a
consumer
3
to
create
a
new
account
in
order
to
exercise
consumer
rights
4
pursuant
to
section
715D.3,
but
may
require
a
consumer
to
use
5
an
existing
account.
6
Sec.
5.
NEW
SECTION
.
715D.5
Processor
duties.
7
1.
A
processor
shall
assist
a
controller
in
duties
8
required
under
this
chapter,
taking
into
account
the
nature
of
9
processing
and
the
information
available
to
the
processor
by
10
appropriate
technical
and
organizational
measures,
insofar
as
11
is
reasonably
practicable,
as
follows:
12
a.
To
fulfill
the
controller’s
obligation
to
respond
to
13
consumer
rights
requests
pursuant
to
section
715D.3.
14
b.
To
meet
the
controller’s
obligations
in
relation
to
the
15
security
of
processing
the
personal
data
and
in
relation
to
the
16
notification
of
a
security
breach
of
the
processor
pursuant
to
17
section
715C.2.
18
2.
A
contract
between
a
controller
and
a
processor
shall
19
govern
the
processor’s
data
processing
procedures
with
respect
20
to
processing
performed
on
behalf
of
the
controller.
The
21
contract
shall
clearly
set
forth
instructions
for
processing
22
personal
data,
the
nature
and
purpose
of
processing,
the
type
23
of
data
subject
to
processing,
the
duration
of
processing,
and
24
the
rights
and
duties
of
both
parties.
The
contract
shall
also
25
include
requirements
that
the
processor
shall
do
all
of
the
26
following:
27
a.
Ensure
that
each
person
processing
personal
data
is
28
subject
to
a
duty
of
confidentiality
with
respect
to
the
data.
29
b.
At
the
controller’s
direction,
delete
or
return
all
30
personal
data
to
the
controller
as
requested
at
the
end
of
the
31
provision
of
services,
unless
retention
of
the
personal
data
32
is
required
by
law.
33
c.
Upon
the
reasonable
request
of
the
controller,
make
34
available
to
the
controller
all
information
in
the
processor’s
35
-13-
HF
2506.3553
(1)
89
es/rn
13/
20
possession
necessary
to
demonstrate
the
processor’s
compliance
1
with
the
obligations
in
this
chapter.
2
d.
Engage
any
subcontractor
or
agent
pursuant
to
a
written
3
contract
in
accordance
with
this
section
that
requires
the
4
subcontractor
to
meet
the
duties
of
the
processor
with
respect
5
to
the
personal
data.
6
3.
Nothing
in
this
section
shall
be
construed
to
relieve
a
7
controller
or
a
processor
from
imposed
liabilities
by
virtue
8
of
the
controller
or
processor’s
role
in
the
processing
9
relationship
as
defined
by
this
chapter.
10
4.
Determining
whether
a
person
is
acting
as
a
controller
or
11
processor
with
respect
to
a
specific
processing
of
data
is
a
12
fact-based
determination
that
depends
upon
the
context
in
which
13
personal
data
is
to
be
processed.
A
processor
that
continues
14
to
adhere
to
a
controller’s
instructions
with
respect
to
a
15
specific
processing
of
personal
data
remains
a
processor.
16
Sec.
6.
NEW
SECTION
.
715D.6
Processing
data
——
exemptions.
17
1.
Nothing
in
this
chapter
shall
be
construed
to
require
the
18
following:
19
a.
A
controller
or
processor
to
re-identify
de-identified
20
data
or
pseudonymous
data.
21
b.
Maintaining
data
in
identifiable
form.
22
c.
Collecting,
obtaining,
retaining,
or
accessing
any
23
data
or
technology,
in
order
to
be
capable
of
associating
an
24
authenticated
consumer
request
with
personal
data.
25
2.
Nothing
in
this
chapter
shall
be
construed
to
require
26
a
controller
or
processor
to
comply
with
an
authenticated
27
consumer
rights
request,
pursuant
to
section
715D.3,
if
all
of
28
the
following
apply:
29
a.
The
controller
is
not
reasonably
capable
of
associating
30
the
request
with
the
personal
data
or
it
would
be
unreasonably
31
burdensome
for
the
controller
to
associate
the
request
with
the
32
personal
data.
33
b.
The
controller
does
not
use
the
personal
data
to
34
recognize
or
respond
to
the
specific
consumer
who
is
the
35
-14-
HF
2506.3553
(1)
89
es/rn
14/
20
subject
of
the
personal
data,
or
associate
the
personal
data
1
with
other
personal
data
about
the
same
specific
consumer.
2
c.
The
controller
does
not
sell
the
personal
data
to
any
3
third
party
or
otherwise
voluntarily
disclose
the
personal
data
4
to
any
third
party
other
than
a
processor,
except
as
otherwise
5
permitted
in
this
chapter.
6
3.
Consumer
rights
contained
in
sections
715D.3
and
715D.4
7
shall
not
apply
to
pseudonymous
data
in
cases
where
the
8
controller
is
able
to
demonstrate
any
information
necessary
9
to
identify
the
consumer
is
kept
separately
and
is
subject
to
10
appropriate
technical
and
organizational
measures
to
ensure
11
that
the
personal
data
is
not
attributed
to
an
identified
or
12
identifiable
natural
person.
13
4.
Controllers
that
disclose
pseudonymous
data
or
de-
14
identified
data
shall
exercise
reasonable
oversight
to
monitor
15
compliance
with
any
contractual
commitments
to
which
the
16
pseudonymous
data
or
de-identified
data
is
subject
and
shall
17
take
appropriate
steps
to
address
any
breaches
of
those
18
contractual
commitments.
19
Sec.
7.
NEW
SECTION
.
715D.7
Limitations.
20
1.
Nothing
in
this
chapter
shall
be
construed
to
restrict
a
21
controller’s
or
processor’s
ability
to
do
the
following:
22
a.
Comply
with
federal,
state,
or
local
laws,
rules,
or
23
regulations.
24
b.
Comply
with
a
civil,
criminal,
or
regulatory
inquiry,
25
investigation,
subpoena,
or
summons
by
federal,
state,
local,
26
or
other
governmental
authorities.
27
c.
Cooperate
with
law
enforcement
agencies
concerning
28
conduct
or
activity
that
the
controller
or
processor
reasonably
29
and
in
good
faith
believes
may
violate
federal,
state,
or
local
30
laws,
rules,
or
regulations.
31
d.
Investigate,
establish,
exercise,
prepare
for,
or
defend
32
legal
claims.
33
e.
Provide
a
product
or
service
specifically
requested
by
a
34
consumer
or
parent
or
guardian
of
a
child,
perform
a
contract
35
-15-
HF
2506.3553
(1)
89
es/rn
15/
20
to
which
the
consumer
or
parent
or
guardian
of
a
child
is
a
1
party,
including
fulfilling
the
terms
of
a
written
warranty,
or
2
take
steps
at
the
request
of
the
consumer
or
parent
or
guardian
3
of
a
child
prior
to
entering
into
a
contract.
4
f.
Take
immediate
steps
to
protect
an
interest
that
is
5
essential
for
the
life
or
physical
safety
of
the
consumer
or
6
of
another
natural
person,
and
where
the
processing
cannot
be
7
manifestly
based
on
another
legal
basis.
8
g.
Prevent,
detect,
protect
against,
or
respond
to
security
9
incidents,
identity
theft,
fraud,
harassment,
malicious
or
10
deceptive
activities,
or
any
illegal
activity.
11
h.
Preserve
the
integrity
or
security
of
systems.
12
i.
Investigate,
report,
or
prosecute
those
responsible
for
13
any
such
action.
14
j.
Engage
in
public
or
peer-reviewed
scientific
or
15
statistical
research
in
the
public
interest
that
adheres
to
16
all
other
applicable
ethics
and
privacy
laws
and
is
approved,
17
monitored,
and
governed
by
an
institutional
review
board,
or
18
similar
independent
oversight
entities
that
determine
the
19
following:
20
(1)
If
the
deletion
of
the
information
is
likely
to
provide
21
substantial
benefits
that
do
not
exclusively
accrue
to
the
22
controller.
23
(2)
The
expected
benefits
of
the
research
outweigh
the
24
privacy
risks.
25
(3)
If
the
controller
has
implemented
reasonable
safeguards
26
to
mitigate
privacy
risks
associated
with
research,
including
27
any
risks
associated
with
re-identification.
28
k.
Assist
another
controller,
processor,
or
third
party
with
29
any
of
the
obligations
under
this
subsection.
30
2.
The
obligations
imposed
on
a
controller
or
processor
31
under
this
chapter
shall
not
restrict
a
controller’s
or
32
processor’s
ability
to
collect,
use,
or
retain
data
as
follows:
33
a.
To
conduct
internal
research
to
develop,
improve,
or
34
repair
products,
services,
or
technology.
35
-16-
HF
2506.3553
(1)
89
es/rn
16/
20
b.
To
effectuate
a
product
recall.
1
c.
To
identify
and
repair
technical
errors
that
impair
2
existing
or
intended
functionality.
3
d.
To
perform
internal
operations
that
are
reasonably
4
aligned
with
the
expectations
of
the
consumer
or
reasonably
5
anticipated
based
on
the
consumer’s
existing
relationship
with
6
the
controller
or
are
otherwise
compatible
with
processing
7
data
in
furtherance
of
the
provision
of
a
product
or
service
8
specifically
requested
by
a
consumer
or
parent
or
guardian
of
a
9
child
or
the
performance
of
a
contract
to
which
the
consumer
or
10
parent
or
guardian
of
a
child
is
a
party.
11
3.
The
obligations
imposed
on
controllers
or
processors
12
under
this
chapter
shall
not
apply
where
compliance
by
the
13
controller
or
processor
with
this
chapter
would
violate
an
14
evidentiary
privilege
under
the
laws
of
the
state.
Nothing
15
in
this
chapter
shall
be
construed
to
prevent
a
controller
or
16
processor
from
providing
personal
data
concerning
a
consumer
to
17
a
person
covered
by
an
evidentiary
privilege
under
the
laws
of
18
the
state
as
part
of
a
privileged
communication.
19
4.
A
controller
or
processor
that
discloses
personal
data
20
to
a
third-party
controller
or
processor,
in
compliance
with
21
the
requirements
of
this
chapter,
is
not
in
violation
of
22
this
chapter
if
the
third-party
controller
or
processor
that
23
receives
and
processes
such
personal
data
is
in
violation
of
24
this
chapter,
provided
that,
at
the
time
of
disclosing
the
25
personal
data,
the
disclosing
controller
or
processor
did
not
26
have
actual
knowledge
that
the
recipient
intended
to
commit
a
27
violation.
A
third-party
controller
or
processor
receiving
28
personal
data
from
a
controller
or
processor
in
compliance
with
29
the
requirements
of
this
chapter
is
likewise
not
in
violation
30
of
this
chapter
for
the
offenses
of
the
controller
or
processor
31
from
which
it
receives
such
personal
data.
32
5.
Nothing
in
this
chapter
shall
be
construed
as
an
33
obligation
imposed
on
a
controller
or
a
processor
that
34
adversely
affects
the
privacy
or
other
rights
or
freedoms
35
-17-
HF
2506.3553
(1)
89
es/rn
17/
20
of
any
persons,
such
as
exercising
the
right
of
free
speech
1
pursuant
to
the
First
Amendment
to
the
United
States
2
Constitution,
or
applies
to
personal
data
by
a
person
in
the
3
course
of
a
purely
personal
or
household
activity.
4
6.
Personal
data
processed
by
a
controller
pursuant
to
5
this
section
shall
not
be
processed
for
any
purpose
other
than
6
those
expressly
listed
in
this
section
unless
otherwise
allowed
7
by
this
chapter.
Personal
data
processed
by
a
controller
8
pursuant
to
this
section
may
be
processed
to
the
extent
that
9
such
processing
is
as
follows:
10
a.
Reasonably
necessary
and
proportionate
to
the
purposes
11
listed
in
this
section.
12
b.
Adequate,
relevant,
and
limited
to
what
is
necessary
13
in
relation
to
the
specific
purposes
listed
in
this
section.
14
Personal
data
collected,
used,
or
retained
pursuant
to
15
this
section
shall,
where
applicable,
take
into
account
16
the
nature
and
purpose
or
purposes
of
such
collection,
use,
17
or
retention.
Such
data
shall
be
subject
to
reasonable
18
administrative,
technical,
and
physical
measures
to
protect
the
19
confidentiality,
integrity,
and
accessibility
of
the
personal
20
data.
21
7.
If
a
controller
processes
personal
data
pursuant
to
an
22
exemption
in
this
section,
the
controller
bears
the
burden
of
23
demonstrating
that
such
processing
qualifies
for
the
exemption
24
and
complies
with
the
requirements
in
subsection
6.
25
8.
Processing
personal
data
for
the
purposes
expressly
26
identified
in
subsection
1
shall
not
in
and
of
itself
make
an
27
entity
a
controller
with
respect
to
such
processing.
28
9.
This
chapter
shall
not
require
a
controller,
processor,
29
third
party,
or
consumer
to
disclose
trade
secrets.
30
Sec.
8.
NEW
SECTION
.
715D.8
Enforcement
——
penalties.
31
1.
The
attorney
general
shall
have
exclusive
authority
to
32
enforce
the
provisions
of
this
chapter.
Whenever
the
attorney
33
general
has
reasonable
cause
to
believe
that
any
person
has
34
engaged
in,
is
engaging
in,
or
is
about
to
engage
in
any
35
-18-
HF
2506.3553
(1)
89
es/rn
18/
20
violation
of
this
chapter,
the
attorney
general
is
empowered
to
1
issue
a
civil
investigative
demand.
The
provisions
of
section
2
685.6
shall
apply
to
civil
investigative
demands
issued
under
3
this
chapter.
4
2.
Prior
to
initiating
any
action
under
this
chapter,
5
the
attorney
general
shall
provide
a
controller
or
processor
6
thirty
days’
written
notice
identifying
the
specific
provisions
7
of
this
chapter
the
attorney
general
alleges
have
been
or
8
are
being
violated.
If
within
the
thirty-day
period,
the
9
controller
or
processor
cures
the
noticed
violation
and
10
provides
the
attorney
general
an
express
written
statement
that
11
the
alleged
violations
have
been
cured
and
that
no
further
such
12
violations
shall
occur,
no
action
shall
be
initiated
against
13
the
controller
or
processor.
14
3.
If
a
controller
or
processor
continues
to
violate
this
15
chapter
following
the
cure
period
in
subsection
2
or
breaches
16
an
express
written
statement
provided
to
the
attorney
general
17
under
that
subsection,
the
attorney
general
may
initiate
an
18
action
in
the
name
of
the
state
and
may
seek
an
injunction
to
19
restrain
any
violations
of
this
chapter
and
civil
penalties
of
20
up
to
seven
thousand
five
hundred
dollars
for
each
violation
21
under
this
chapter.
Any
moneys
collected
under
this
section
22
including
civil
penalties,
costs,
attorney
fees,
or
amounts
23
which
are
specifically
directed
shall
be
paid
into
the
consumer
24
education
and
litigation
fund
established
under
section
25
714.16C.
26
4.
The
attorney
general
may
recover
reasonable
expenses
27
incurred
in
investigating
and
preparing
the
case,
including
28
attorney
fees,
in
any
action
initiated
under
this
chapter.
29
5.
Nothing
in
this
chapter
shall
be
construed
as
providing
30
the
basis
for,
or
be
subject
to,
a
private
right
of
action
for
31
violations
of
this
chapter
or
under
any
other
law.
32
Sec.
9.
NEW
SECTION
.
715D.9
Preemption.
33
1.
This
chapter
supersedes
and
preempts
all
rules,
34
regulations,
codes,
ordinances,
and
other
laws
adopted
by
a
35
-19-
HF
2506.3553
(1)
89
es/rn
19/
20
city,
county,
municipality,
or
local
agency
regarding
the
1
processing
of
personal
data
by
controllers
or
processors.
2
2.
Any
reference
to
federal,
state,
or
local
law
or
statute
3
in
this
chapter
shall
be
deemed
to
include
any
accompanying
4
rules
or
regulations
or
exemptions
thereto,
or
in
the
case
of
a
5
federal
agency,
guidance
issued
by
such
agency
thereto.
6
Sec.
10.
EFFECTIVE
DATE.
This
Act
takes
effect
January
1,
7
2024.
>
8
______________________________
SORENSEN
of
Adair
-20-
HF
2506.3553
(1)
89
es/rn
20/
20