H.F. 344 Section 1. Section 91B.2, Code 2013, is amended by adding 1 the following new subsection: 2 NEW SUBSECTION . 2A. a. An employer shall not provide 3 work-related information, including but not limited to 4 information contained in the employee’s personnel file and 5 salary level, to any individual or entity except at the request 6 or authorization of the employee or former employee. 7 b. A person who violates this subsection shall be guilty of 8 a simple misdemeanor. In addition, the commissioner of labor 9 shall assess a civil penalty against the person in an amount 10 not greater than five thousand dollars. 11 c. This subsection shall not apply to the provision of 12 work-related information to a federal, state, or local law 13 enforcement official pursuant to or in the course of a criminal 14 investigation. 15 Sec. 2. NEW SECTION . 733.1 Definitions. 16 For the purposes of this chapter, unless the context 17 otherwise requires: 18 1. “Business entity” means a person, corporation, 19 association, partnership, limited liability company, limited 20 liability partnership, or any other legal entity engaged in or 21 offering for sale any goods or services in this state. 22 2. “Customer information” means an individual’s first 23 name or first initial and last name in combination with the 24 individual’s residential address, business address, internet 25 address, or telephone number. “Customer information” does not 26 include information that is lawfully obtained from publicly 27 available sources, or from federal, state, or local government 28 records lawfully made available to the general public. 29 Sec. 3. NEW SECTION . 733.2 Business entities —— 30 communication prohibition. 31 A business entity shall not communicate or cause to be 32 communicated in any form or manner an individual’s customer 33 information to another business entity unless the individual 34 is included on the customer information sharing database 35 -1- LSB 2403YH (3) 85 rn/nh 1/ 5

H.F. 344 established in section 733.3. 1 Sec. 4. NEW SECTION . 733.3 Customer information sharing 2 database. 3 1. The attorney general shall establish and provide for the 4 operation of a database containing a list of individuals who do 5 not object to the communication of the individual’s customer 6 information from one business entity to another business entity 7 for marketing, solicitation, or customer-sharing purposes. 8 There shall be no cost to the individual for electing to be 9 included in the database. 10 2. Information contained in the information sharing 11 database established in subsection 1 shall be used only for 12 the purpose of compliance with section 733.2 and this section. 13 Such information shall not be considered a public record for 14 the purposes of chapter 22. 15 Sec. 5. NEW SECTION . 733.4 Rules —— access fees. 16 The attorney general shall adopt rules pursuant to chapter 17 17A to govern the establishment of a customer information 18 sharing database and to administer this chapter. The rules 19 shall include all of the following: 20 1. The methods by which an individual may give notice to 21 the attorney general of the individual’s election to be listed 22 in the customer information sharing database and revocation of 23 such election. 24 2. The length of time for which an election shall be 25 effective. 26 3. The methods by which notices and revocations shall 27 be collected and information added to or deleted from the 28 database. 29 4. The methods by which a business entity may obtain 30 access to the database, including any fees for such access. 31 The attorney general may utilize any fees collected for the 32 purposes of establishing and operating the customer information 33 sharing database. 34 Sec. 6. NEW SECTION . 733.5 Violations —— penalties. 35 -2- LSB 2403YH (3) 85 rn/nh 2/ 5

H.F. 344 A violation of this chapter is an unlawful practice 1 under section 714.16, subsection 2, paragraph “a” . All the 2 powers conferred upon the attorney general to accomplish the 3 objectives and carry out the duties prescribed pursuant to 4 section 714.16 are also conferred upon the attorney general to 5 enforce this chapter, including seeking injunctive relief and 6 civil penalties. 7 EXPLANATION 8 This bill relates to the disclosure of personal or 9 employment-related information. 10 The bill states that an employer shall not provide 11 work-related information, including but not limited to 12 information contained in an employee’s personnel file and 13 salary level, to any individual or entity except at the request 14 or authorization of the employee or former employee. The bill 15 provides that a person who violates this prohibition is guilty 16 of a simple misdemeanor punishable by confinement for no more 17 than 30 days or a fine of at least $65 but not more than $625 18 or by both, and that in addition the commissioner of labor 19 shall assess a civil penalty against the person in an amount 20 not greater than $5,000. The bill adds that this prohibition 21 does not extend to disclosure to federal, state, or local law 22 enforcement personnel. 23 The bill provides that a business entity shall not 24 communicate or cause to be communicated in any form or manner 25 an individual’s customer information to another business entity 26 unless the individual is included on a customer information 27 sharing database established in the bill. The bill defines a 28 “business entity” to mean a person, corporation, association, 29 partnership, limited liability company, limited liability 30 partnership, or any other legal entity engaged in or offering 31 for sale any goods or services in this state. The bill 32 defines “customer information” to mean an individual’s first 33 name or first initial and last name in combination with the 34 individual’s residential address, business address, internet 35 -3- LSB 2403YH (3) 85 rn/nh 3/ 5

H.F. 344 address, or telephone number. The bill states that “customer 1 information” does not include information that is lawfully 2 obtained from publicly available sources, or from federal, 3 state, or local government records lawfully made available to 4 the general public. 5 The bill directs the attorney general to establish and 6 provide for the operation of a database containing a list of 7 individuals who do not object to the communication of the 8 individual’s customer information from one business entity 9 to another business entity for marketing, solicitation, or 10 customer-sharing purposes. The bill provides that there shall 11 be no cost to the individual electing to be included in the 12 database, and that information contained in the database shall 13 not be considered a public record for the purposes of Code 14 chapter 22. 15 The bill requires the attorney general to adopt rules 16 governing operation of the database, including the methods by 17 which an individual may give notice to the attorney general 18 of the individual’s election to be listed in the database and 19 revocation of such election, the length of time for which an 20 election shall be effective, the methods by which notices 21 and revocations shall be collected and information added or 22 deleted, and the methods by which a business entity may obtain 23 access to the database, including any fees for such access. 24 The bill authorizes the attorney general to utilize any fees 25 collected for the purposes of establishing and operating the 26 customer information sharing database. 27 The bill provides that a violation of the business entity 28 disclosure requirements constitutes an unlawful practice under 29 Code section 714.16, subsection 2, paragraph “a”. Violations 30 of unlawful practice provisions are subject to imposition 31 by the attorney general of a civil penalty not to exceed 32 $40,000 per violation, and additionally a civil penalty of 33 not more than $5,000 for each day of intentional violation 34 of a temporary restraining order, preliminary injunction, or 35 -4- LSB 2403YH (3) 85 rn/nh 4/ 5