H.F. 127 Section 1. NEW SECTION . 735.1 Definitions. 1 As used in this chapter, unless the context otherwise 2 requires: 3 1. “Access information” means user name, password, login 4 information, or other security information that protects access 5 to a personal internet account. 6 2. “Educational institution” means a public or nonpublic 7 elementary, secondary, or postsecondary school in this state. 8 3. “Employer” means the state of Iowa or any political 9 subdivision, board, commission, department, or institution 10 thereof, and every other person employing employees within this 11 state. “Employer” includes an agent or representative of an 12 employer. 13 4. “Personal internet account” means an account created via 14 a bounded system established by an internet-based service that 15 requires a user to enter or store access information by means 16 of an electronic device to view, create, utilize, or edit the 17 user’s account information, profile, display, communications, 18 or stored data. 19 Sec. 2. NEW SECTION . 735.2 Employer prohibitions. 20 An employer shall not do any of the following: 21 1. Request an employee or an applicant for employment to 22 grant access to, allow observation of, or disclose information 23 that allows access to or observation of the employee’s or 24 applicant’s personal internet account. 25 2. Discharge, discipline, fail to hire, or otherwise 26 penalize an employee or applicant for employment for failure to 27 grant access to, allow observation of, or disclose information 28 that allows access to or observation of the employee’s or 29 applicant’s personal internet account. 30 Sec. 3. NEW SECTION . 735.3 Actions not prohibited —— 31 employers. 32 1. This chapter does not prohibit an employer from doing any 33 of the following: 34 a. Requesting or requiring an employee to disclose access 35 -1- LSB 1286YH (6) 85 je/sc 1/ 7

H.F. 127 information to the employer to gain access to or operate any 1 of the following: 2 (1) An electronic communications device paid for in whole or 3 in part by the employer. 4 (2) An account or service provided by the employer, obtained 5 by virtue of the employee’s employment relationship with the 6 employer, or used for the employer’s business purposes. 7 b. Disciplining or discharging an employee for transferring 8 the employer’s proprietary or confidential information or 9 financial data to an employee’s personal internet account 10 without the employer’s authorization. 11 c. Conducting an investigation or requiring an employee 12 to cooperate in an investigation in any of the following 13 circumstances: 14 (1) If there is specific information about activity on 15 the employee’s personal internet account relating to, and for 16 the purpose of ensuring compliance with, applicable laws, 17 regulatory requirements, or prohibitions against work-related 18 employee misconduct. 19 (2) If the employer has specific information about 20 an unauthorized transfer of the employer’s proprietary 21 information, confidential information, or financial data to an 22 employee’s personal internet account. 23 d. Restricting or prohibiting an employee’s access to 24 certain internet sites while using an electronic communications 25 device paid for in whole or in part by the employer or while 26 using an employer’s network or resources, in accordance with 27 state and federal law. 28 e. Monitoring, reviewing, or accessing electronic data 29 stored on an electronic communications device paid for in whole 30 or in part by the employer, or traveling through or stored on 31 an employer’s network, in accordance with state and federal 32 law. 33 2. This chapter does not prohibit or restrict an employer 34 from complying with a duty to screen employees or applicants 35 -2- LSB 1286YH (6) 85 je/sc 2/ 7

H.F. 127 for employment prior to hiring or to monitor or retain employee 1 communications pursuant to state or federal law. 2 3. This chapter does not prohibit or restrict an employer 3 from viewing, accessing, or utilizing information about an 4 employee or applicant for employment that can be obtained 5 without any required access information or that is available in 6 the public domain. 7 Sec. 4. NEW SECTION . 735.4 Educational institution 8 prohibitions. 9 An educational institution shall not do any of the 10 following: 11 1. Request a student or prospective student to grant access 12 to, allow observation of, or disclose information that allows 13 access to or observation of the student’s or prospective 14 student’s personal internet account. 15 2. Expel, discipline, fail to admit, or otherwise penalize 16 a student or prospective student for failure to grant access 17 to, allow observation of, or disclose information that allows 18 access to or observation of the student’s or prospective 19 student’s personal internet account. 20 Sec. 5. NEW SECTION . 735.5 Actions not prohibited —— 21 educational institutions. 22 1. This chapter does not prohibit an educational 23 institution from requesting or requiring a student to disclose 24 access information to the educational institution to gain 25 access to or operate any of the following: 26 a. An electronic communications device paid for in whole or 27 in part by the educational institution. 28 b. An account or service provided by the educational 29 institution that is either obtained by virtue of the student’s 30 admission to the educational institution or used by the student 31 for educational purposes. 32 2. This chapter does not prohibit or restrict an educational 33 institution from viewing, accessing, or utilizing information 34 about a student or applicant that can be obtained without any 35 -3- LSB 1286YH (6) 85 je/sc 3/ 7

H.F. 127 required access information or that is available in the public 1 domain. 2 Sec. 6. NEW SECTION . 735.6 Duty or liability not created. 3 1. This chapter does not create a duty on the part of an 4 employer or educational institution to search or monitor the 5 activity of a personal internet account. 6 2. An employer or educational institution is not liable 7 under this chapter for failure to request or require that an 8 employee, student, applicant for employment, or prospective 9 student grant access to, allow observation of, or disclose 10 information that allows access to or observation of the 11 employee’s, student’s, applicant’s, or prospective student’s 12 personal internet account. 13 Sec. 7. NEW SECTION . 735.7 Penalties. 14 1. A person who violates section 735.2 or 735.4 is subject 15 to a civil penalty of not more than one thousand dollars 16 for each violation. The attorney general or the attorney 17 general’s designee may maintain a civil action to enforce this 18 subsection. Any civil penalty recovered shall be deposited in 19 the general fund of the state. 20 2. An aggrieved individual may bring a civil action in 21 district court to enjoin a violation of section 735.2 or 735.4 22 and may recover not more than one thousand dollars in damages 23 in addition to reasonable attorney fees and court costs. 24 No later than sixty days before filing a civil action for 25 damages or sixty days before adding a claim for damages to an 26 action seeking injunctive relief, the individual shall make a 27 written demand of the alleged violator for not more than one 28 thousand dollars. The written demand shall include reasonable 29 documentation of the violation. The written demand and 30 documentation shall either be served in accordance with state 31 law applicable to the service of process in civil actions or 32 mailed by certified mail and addressed to the alleged violator 33 at their residence, principal office, or place of business. 34 A civil action under this subsection may be brought in the 35 -4- LSB 1286YH (6) 85 je/sc 4/ 7

H.F. 127 district court for the county where the alleged violation 1 occurred or for the county where the person against whom the 2 civil complaint is filed resides or has their principal place 3 of business. 4 3. It is an affirmative defense to a civil action under this 5 chapter that an employer or educational institution acted to 6 comply with the requirements of state or federal law. 7 EXPLANATION 8 This bill prohibits an employer from requesting an employee 9 or an applicant for employment to grant access to, allow 10 observation of, or disclose information that allows access 11 to or observation of the employee’s or applicant’s personal 12 internet account. The bill also prohibits an employer from 13 discharging, disciplining, failing to hire, or otherwise 14 penalizing an employee or applicant for employment for 15 failure to grant access to, allow observation of, or disclose 16 information that allows access to or observation of the 17 employee’s or applicant’s personal internet account. 18 The bill prohibits an educational institution from 19 requesting a student or prospective student to grant access 20 to, allow observation of, or disclose information that allows 21 access to or observation of the student’s or prospective 22 student’s personal internet account. The bill also prohibits 23 an educational institution from expelling, disciplining, 24 failing to admit, or otherwise penalizing a student or 25 prospective student for failure to grant access to, allow 26 observation of, or disclose information that allows access 27 to or observation of the student’s or prospective student’s 28 personal internet account. 29 The bill defines “employer” as the state of Iowa or 30 any political subdivision, board, commission, department, 31 or institution thereof, and every other person employing 32 employees within this state. “Employer” includes an agent or 33 representative of an employer. The bill defines “educational 34 institution” as a public or nonpublic elementary, secondary, or 35 -5- LSB 1286YH (6) 85 je/sc 5/ 7

H.F. 127 postsecondary school in this state. The bill defines “personal 1 internet account” as an account created via a bounded system 2 established by an internet-based service that requires a user 3 to enter or store access information by means of an electronic 4 device to view, create, utilize, or edit the user’s account 5 information, profile, display, communications, or stored data. 6 The bill defines “access information” as user name, password, 7 login information, or other security information that protects 8 access to a personal internet account. 9 The bill sets out various actions which are not prohibited 10 by the bill, such as actions relating to devices or accounts 11 obtained through an employer or educational institution, 12 seeking information available in the public domain, and 13 investigating improper use of an employer’s proprietary or 14 confidential information or financial data or other illegal 15 activity. 16 The bill does not create a duty on the part of an employer 17 or educational institution to search or monitor the activity 18 of a personal internet account. An employer or educational 19 institution is not liable under the bill for failure to request 20 or require that an employee, student, applicant for employment, 21 or prospective student grant access to, allow observation of, 22 or disclose information that allows access to or observation of 23 their personal internet account. 24 The bill provides that a person who violates the 25 prohibitions in the bill is subject to a civil penalty of not 26 more than $1,000 for each violation. The attorney general or 27 the attorney general’s designee may maintain a civil action to 28 enforce the penalty. 29 An aggrieved individual may bring a civil action in district 30 court to enjoin a violation of the prohibitions in the bill 31 and may recover not more than $1,000 in damages in addition to 32 reasonable attorney fees and court costs. The bill sets out a 33 process for an aggrieved individual to serve notice and bring 34 such a civil action in district court. 35 -6- LSB 1286YH (6) 85 je/sc 6/ 7