22APROTECTION OF PERSONAL INFORMATION TAX-EXEMPT ENTITIES22A.1Definitions.As used in this chapter:1“Personal information” means any list, record, register, registry, roll, roster, or other compilation of data that directly or indirectly identifies a person as a member, supporter, or volunteer of, or donor of financial or nonfinancial support to, any entity which is exempt from taxation under section 501(c) of the federal Internal Revenue Code. “Personal information” does not include information reportable to the secretary of state pursuant to chapter 504 or information provided to the attorney general or state auditor pursuant to chapter 504 or 537, or section 714.16.2“Public agency” means all of the following:aA state or municipal governmental unit, including but not limited to the state of Iowa, and a department, agency, office, commission, board, or division of the state.bA political subdivision of the state, including but not limited to a county, city, township, village, school district, or community college merged area.cAn agency, authority, council, board, or commission of a political subdivision of the state.dA state or local court, tribunal, or other judicial or quasi-judicial body.2021 Acts, ch 120, §2; 2022 Acts, ch 1021, §1022A.2Personal information protected.1A public agency shall not do any of the following:aRequire an entity which is exempt from taxation under section 501(c) of the federal Internal Revenue Code to provide the public agency with personal information.bRelease, publicize, or otherwise disclose personal information in the possession of the public agency without the express, written permission of every member, supporter, volunteer, and donor of the tax-exempt entity identified in the information and the tax-exempt entity.cRequest or require a current or prospective contractor with the public agency to provide the public agency with a list of entities exempt from taxation under section 501(c) of the federal Internal Revenue Code to which the contractor has provided financial or nonfinancial support.2This section does not prohibit any of the following:aDisclosure of personal information pursuant to a lawful warrant issued by a court of competent jurisdiction.bDisclosure of personal information pursuant to a lawful request for discovery if all of the following requirements are met:1The requestor demonstrates a compelling need for the personal information by clear and convincing evidence.2The requestor obtains a protective order barring disclosure of personal information to any person not directly involved in the litigation.cDisclosure of personal information pursuant to an agreement between a public agency and an entity which is exempt from taxation under section 501(c) of the federal Internal Revenue Code.dDisclosure of personal information included in judicial proceedings that are public pursuant to section 602.1601. However, upon petition of an entity which is exempt from taxation under section 501(c) of the federal Internal Revenue Code, the court shall seal a case file that is otherwise public pursuant to section 602.1601 to protect the personal information contained in that file.2021 Acts, ch 120, §322A.3Civil penalties.1A person alleging a violation of this chapter, section 504.1604, subsection 5, or section 504.1605, subsection 5, may bring a civil action for injunctive relief, damages, or both. Damages may include either of the following:aNot less than two thousand five hundred dollars in compensatory damages for injury and loss for each violation.bFor an intentional violation, not more than three times the amount described in paragraph “a” for each violation.2A court may, in its discretion, award all or a portion of the costs of litigation, including reasonable attorney fees and witness fees, to the complainant.2021 Acts, ch 120, §422A.4Criminal penalties.A person who knowingly violates a provision of this chapter, section 504.1604, subsection 5, or section 504.1605, subsection 5, is guilty of a serious misdemeanor punishable by imprisonment for not more than ninety days or a fine of not more than one thousand dollars, or both.2021 Acts, ch 120, §522A.5Campaign disclosure Act not affected.This chapter shall not affect any provision of chapter 68A.2021 Acts, ch 120, §622A.6Applicability — department of revenue.1The following shall not be construed as a violation of this chapter with respect to the department of revenue:aThe identification of a person as a representative, responsible party, employee, withholding agent, or other signatory or contact of an entity exempt from taxation under section 501(c) of the Internal Revenue Code on any return, form, application, or other document required to be filed with the department, including but not limited to a tax return or tax permit.bPowers exercised under section 422.70.cInformation sought pursuant to discovery in a contested case proceeding.dInformation that is expressly required to be provided by the department by law including but not limited to section 422.11S.2The restrictions imposed under this chapter shall not be construed to entitle any taxpayer or tax-exempt entity to any deduction, exemption, credit, or other tax position which the taxpayer or exempt entity is unable to substantiate with sufficient evidence.2021 Acts, ch 151, §16