House Study Bill 672
HOUSE FILE
BY (PROPOSED COMMITTEE ON
COMMERCE, REGULATION AND
LABOR BILL BY CHAIRPERSON
JENKINS)
Passed House, Date Passed Senate, Date
Vote: Ayes Nays Vote: Ayes Nays
Approved
A BILL FOR
1 An Act to require notice of a breach of the security of a
2 computerized data system containing personal information and
3 providing for civil remedies.
4 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:
5 TLSB 6387HC 81
6 kk/je/5
PAG LIN
1 1 Section 1. NEW SECTION. 715C.1 DEFINITIONS.
1 2 For purposes of this chapter, unless the context otherwise
1 3 requires:
1 4 1. "Breach of the security of the system" means the
1 5 unauthorized acquisition of unencrypted computerized data that
1 6 compromises the security, confidentiality, or integrity of
1 7 personal information maintained by a person. Good faith
1 8 acquisition of personal information by an employee or agent of
1 9 a person for the purposes of the person is not a breach of the
1 10 security of the system, provided that the personal information
1 11 is not used or subject to further unauthorized disclosure.
1 12 2. "Notice" means any of the following:
1 13 a. Written notice.
1 14 b. Telephonic notice.
1 15 c. Electronic notice, if the notice provided is consistent
1 16 with the provisions regarding electronic records and
1 17 signatures set forth in chapter 554D and 15 U.S.C. } 7001.
1 18 d. Substitute notice, if the person required to provide
1 19 notice demonstrates that the cost of providing notice will
1 20 exceed seventy=five thousand dollars, or that the affected
1 21 class of residents to be notified exceeds one hundred thousand
1 22 residents, or that the person does not have sufficient contact
1 23 information to provide notice. Substitute notice shall
1 24 consist of all of the following:
1 25 (1) Notice by electronic mail if the person has electronic
1 26 mail addresses for the members of the affected class of
1 27 residents.
1 28 (2) Conspicuous posting of the notice on the internet
1 29 website of the person if the person maintains an internet
1 30 website.
1 31 (3) Notice to major statewide media.
1 32 3. "Person" means the same as defined in section 4.1.
1 33 4. "Personal information" means a first name or first
1 34 initial and last name in combination with any one or more of
1 35 the following data elements that relate to a resident of this
2 1 state, when either the name or the data elements are not
2 2 encrypted:
2 3 a. Social security number.
2 4 b. Driver's license number or nonoperator's identification
2 5 card number.
2 6 c. Account number, or credit or debit card number, in
2 7 combination with any required security code, access code, or
2 8 password that would permit access to a resident's financial
2 9 account.
2 10 "Personal information" does not include publicly available
2 11 information that is lawfully made available to the general
2 12 public from federal, state, or local government records.
2 13 Sec. 2. NEW SECTION. 715C.2 DISCLOSURE OF BREACH OF
2 14 SECURITY OF COMPUTERIZED PERSONAL INFORMATION.
2 15 1. A person who conducts business in this state and owns
2 16 or licenses computerized data that includes personal
2 17 information about a resident of this state shall, when the
2 18 person becomes aware of a breach of the security of the
2 19 system, conduct in good faith a reasonable and prompt
2 20 investigation to determine the likelihood that personal
2 21 information has been or will be misused. If the investigation
2 22 determines that the misuse of information about a resident of
2 23 this state has occurred or is reasonably likely to occur, the
2 24 person shall give notice as soon as possible to the affected
2 25 resident. Notice shall be made in the most expedient manner
2 26 possible and without unreasonable delay, consistent with the
2 27 legitimate needs of law enforcement and consistent with any
2 28 measures necessary to determine the scope of the breach and to
2 29 restore the reasonable integrity of the computerized data
2 30 system.
2 31 2. A person who maintains computerized data that includes
2 32 personal information that the person does not own or license
2 33 shall give notice to and cooperate with the owner or licensee
2 34 of the information of any breach of the security of the system
2 35 immediately following discovery of a breach, if misuse of
3 1 personal information about a resident of this state occurred
3 2 or is reasonably likely to occur. Cooperation shall include
3 3 sharing with the owner or licensee information relevant to the
3 4 breach.
3 5 3. If a person is required to provide notice to more than
3 6 one thousand residents under this chapter, the person shall
3 7 also provide notice, without unreasonable delay, to all known
3 8 consumer reporting agencies that compile and maintain files on
3 9 consumers on a nationwide basis as defined by 15 U.S.C. }
3 10 1681a. Nothing in this subsection shall be construed to
3 11 require the person to provide to a consumer reporting agency
3 12 the names or other personal information of the residents who
3 13 may have been affected by the breach. This subsection shall
3 14 not apply to a person who is subject to Title V of the federal
3 15 Gramm=Leach=Bliley Act, 15 U.S.C. } 6801 et seq.
3 16 4. Notice required by this chapter may be delayed if a law
3 17 enforcement agency determines that the notice will impede a
3 18 criminal investigation. Notice required by this chapter shall
3 19 be made in good faith, without unreasonable delay, and as soon
3 20 as possible after the law enforcement agency determines that
3 21 notification will no longer impede the investigation.
3 22 Sec. 3. NEW SECTION. 715C.3 PROCEDURES DEEMED IN
3 23 COMPLIANCE WITH SECURITY BREACH REQUIREMENTS.
3 24 1. Notwithstanding section 715C.2, a person who maintains
3 25 their own notice procedures as part of an information security
3 26 policy for the treatment of personal information, and whose
3 27 procedures are otherwise consistent with the timing
3 28 requirements of this chapter is deemed to be in compliance
3 29 with the notice requirements of this chapter if the person
3 30 notifies affected residents in accordance with their policies
3 31 in the event of a breach of security of the system.
3 32 2. Notwithstanding section 715C.2, a person who is
3 33 regulated by state or federal law and who maintains procedures
3 34 for a breach of the security of the system pursuant to the
3 35 laws, rules, regulations, or guidelines established by the
4 1 person's primary or functional state or federal regulator is
4 2 deemed to be in compliance with this chapter if the person
4 3 notifies affected residents in accordance with the maintained
4 4 procedures when a breach occurs.
4 5 Sec. 4. NEW SECTION. 715C.4 VIOLATIONS.
4 6 The attorney general may bring a civil action in law or
4 7 equity to address violations of this chapter and for other
4 8 relief that may be appropriate to ensure proper compliance
4 9 with this chapter or to recover direct economic damages
4 10 resulting from a violation, or both. The provisions of this
4 11 chapter are not exclusive and do not relieve a person subject
4 12 to this chapter from compliance with all other applicable
4 13 provisions of law.
4 14 EXPLANATION
4 15 This bill requires a person who owns or licenses
4 16 computerized data that includes personal information to
4 17 conduct an investigation of any breach of the security of the
4 18 person's computerized data system and determine the likelihood
4 19 that the personal information has been or will be misused. If
4 20 the investigation determines that misuse has occurred or is
4 21 reasonably likely to occur, the person shall give notice to
4 22 those residents of this state whose personal information was
4 23 or may be misused. As defined by Code section 4.1, a "person"
4 24 includes a corporation or similar entity, and a government or
4 25 a governmental subdivision or agency.
4 26 The bill requires a person who maintains computerized data
4 27 that includes personal information that the person does not
4 28 own to notify the owner of the data of any breach in the
4 29 security of the data and share with the owner relevant
4 30 information related to the breach.
4 31 The notice shall be provided immediately unless a law
4 32 enforcement agency determines that the notification will
4 33 impede a criminal investigation. The notice may be made in
4 34 writing, through electronic means, or by substitute notice as
4 35 defined by the bill. If a notice is required for more than
5 1 1,000 residents, the person required to provide notice shall
5 2 also provide notice to all known consumer reporting agencies
5 3 that compile and maintain files on consumers on a nationwide
5 4 basis as defined by federal law. The bill provides that if a
5 5 person maintains their own notice procedures as part of an
5 6 information security policy or if the person is regulated by a
5 7 state or federal law and maintains procedures for a breach of
5 8 the security of the system pursuant to those laws, then
5 9 compliance with those procedures is deemed to be compliance
5 10 with the notice requirements of new Code chapter 715C.
5 11 The bill provides the attorney general authority to enforce
5 12 the provisions of new Code chapter 715C by bringing a civil
5 13 action in law or equity to recover direct economic damages.
5 14 LSB 6387HC 81
5 15 kk:nh/je/5