HF 344 (LSB 2403YH (3) 85)

HOUSE FILE 344

BY  PETTENGILL

A BILL FOR

An Act prohibiting the disclosure of personal or employment-related information except under specified circumstances, and providing penalties.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 91B.2, Code 2013, is amended by adding the following new subsection:
   NEW SUBSECTION.  2A.
  a.  An employer shall not provide work-related information, including but not limited to information contained in the employee’s personnel file and salary level, to any individual or entity except at the request or authorization of the employee or former employee.
   b.  A person who violates this subsection shall be guilty of a simple misdemeanor. In addition, the commissioner of labor shall assess a civil penalty against the person in an amount not greater than five thousand dollars. 
   c.  This subsection shall not apply to the provision of work-related information to a federal, state, or local law enforcement official pursuant to or in the course of a criminal investigation.
    Sec. 2.  NEW SECTION.  733.1  Definitions.
   For the purposes of this chapter, unless the context otherwise requires:
   1.  “Business entity” means a person, corporation, association, partnership, limited liability company, limited liability partnership, or any other legal entity engaged in or offering for sale any goods or services in this state.
   2.  “Customer information” means an individual’s first name or first initial and last name in combination with the individual’s residential address, business address, internet address, or telephone number. “Customer information” does not include information that is lawfully obtained from publicly available sources, or from federal, state, or local government records lawfully made available to the general public.
    Sec. 3.  NEW SECTION.  733.2  Business entities —— communication prohibition.
   A business entity shall not communicate or cause to be communicated in any form or manner an individual’s customer information to another business entity unless the individual is included on the customer information sharing database established in section 733.3.
    Sec. 4.  NEW SECTION.  733.3  Customer information sharing database.
   1.  The attorney general shall establish and provide for the operation of a database containing a list of individuals who do not object to the communication of the individual’s customer information from one business entity to another business entity for marketing, solicitation, or customer-sharing purposes. There shall be no cost to the individual for electing to be included in the database.
   2.  Information contained in the information sharing database established in subsection 1 shall be used only for the purpose of compliance with section 733.2 and this section. Such information shall not be considered a public record for the purposes of chapter 22.
    Sec. 5.  NEW SECTION.  733.4  Rules —— access fees.
   The attorney general shall adopt rules pursuant to chapter 17A to govern the establishment of a customer information sharing database and to administer this chapter. The rules shall include all of the following: 
   1.  The methods by which an individual may give notice to the attorney general of the individual’s election to be listed in the customer information sharing database and revocation of such election.
   2.  The length of time for which an election shall be effective.
   3.  The methods by which notices and revocations shall be collected and information added to or deleted from the database.
   4.  The methods by which a business entity may obtain access to the database, including any fees for such access. The attorney general may utilize any fees collected for the purposes of establishing and operating the customer information sharing database.
    Sec. 6.  NEW SECTION.  733.5  Violations —— penalties.
   A violation of this chapter is an unlawful practice under section 714.16, subsection 2, paragraph “a”. All the powers conferred upon the attorney general to accomplish the objectives and carry out the duties prescribed pursuant to section 714.16 are also conferred upon the attorney general to enforce this chapter, including seeking injunctive relief and civil penalties.
EXPLANATION
   This bill relates to the disclosure of personal or employment-related information.
   The bill states that an employer shall not provide work-related information, including but not limited to information contained in an employee’s personnel file and salary level, to any individual or entity except at the request or authorization of the employee or former employee. The bill provides that a person who violates this prohibition is guilty of a simple misdemeanor punishable by confinement for no more than 30 days or a fine of at least $65 but not more than $625 or by both, and that in addition the commissioner of labor shall assess a civil penalty against the person in an amount not greater than $5,000. The bill adds that this prohibition does not extend to disclosure to federal, state, or local law enforcement personnel.
   The bill provides that a business entity shall not communicate or cause to be communicated in any form or manner an individual’s customer information to another business entity unless the individual is included on a customer information sharing database established in the bill. The bill defines a “business entity” to mean a person, corporation, association, partnership, limited liability company, limited liability partnership, or any other legal entity engaged in or offering for sale any goods or services in this state. The bill defines “customer information” to mean an individual’s first name or first initial and last name in combination with the individual’s residential address, business address, internet address, or telephone number. The bill states that “customer information” does not include information that is lawfully obtained from publicly available sources, or from federal, state, or local government records lawfully made available to the general public.
   The bill directs the attorney general to establish and provide for the operation of a database containing a list of individuals who do not object to the communication of the individual’s customer information from one business entity to another business entity for marketing, solicitation, or customer-sharing purposes. The bill provides that there shall be no cost to the individual electing to be included in the database, and that information contained in the database shall not be considered a public record for the purposes of Code chapter 22.
   The bill requires the attorney general to adopt rules governing operation of the database, including the methods by which an individual may give notice to the attorney general of the individual’s election to be listed in the database and revocation of such election, the length of time for which an election shall be effective, the methods by which notices and revocations shall be collected and information added or deleted, and the methods by which a business entity may obtain access to the database, including any fees for such access. The bill authorizes the attorney general to utilize any fees collected for the purposes of establishing and operating the customer information sharing database. 
   The bill provides that a violation of the business entity disclosure requirements constitutes an unlawful practice under Code section 714.16, subsection 2, paragraph “a”. Violations of unlawful practice provisions are subject to imposition by the attorney general of a civil penalty not to exceed $40,000 per violation, and additionally a civil penalty of not more than $5,000 for each day of intentional violation of a temporary restraining order, preliminary injunction, or permanent injunction.