SSB 1047 (LSB 1395XC (1) 85)

SENATE FILE _____

BY  (PROPOSED COMMITTEE ON COMMERCE BILL BY CHAIRPERSON McCOY)

A BILL FOR

An Act establishing data security compliance requirements in relation to payment card transactions, and providing penalties.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 715C.2, subsection 8, Code 2013, is amended by striking the subsection.
    Sec. 2.  NEW SECTION.  715C.3  Personal information —— business duty to safeguard —— remedies.
   1.  Any person who accepts a payment card in connection with transactions occurring in the ordinary course of business has a duty to comply with or adhere to payment card industry data security standards. A financial institution may bring an action against a person who is subject to a breach of security if the person is found at the time of the breach to have engaged in or violated such data security standards.
   2.  In an action commenced by a financial institution to recover damages pursuant to subsection 1, the financial institution shall submit in writing a request that the person alleged to have violated this section certify compliance with the standards pursuant to a payment card industry-approved independent auditor or another person authorized to issue such a certification. A presumption of compliance shall exist if a person contracts for or utilizes the services of a third party to collect, maintain, or store personal information used in connection with a payment card, and contractually requires that the third party ensure compliance with the standards on an ongoing basis.
   3.
  a.  A financial institution prevailing in an action for failure to safeguard personal information against a breach of security may recover actual damages arising from the failure. Actual damages shall include any costs incurred by the financial institution in relation to the following:
   (1)  Cancellation or reissuance of a payment card affected by the security breach.
   (2)  Closing of a deposit, transaction, share draft, or other account affected by the security breach and any action to stop payment or block a transaction with respect to the account.
   (3)  Opening or reopening of a deposit, transaction, share draft, or other account affected by the security breach.

   (4)  Refunding or crediting made to an account holder to cover the cost of any unauthorized transaction relating to the breach of security.
   (5)  Notification to account holders affected by the breach of security pursuant to section 715C.2.
   b.  Reasonable attorney fees and costs shall be awarded to the prevailing party, with the exception that an award shall not be made to a person who failed to submit certification as required in subsection 2.
   c.  An action pursuant to this section shall not be commenced against any person other than a person who has been found to have violated this section.
    Sec. 3.  NEW SECTION.  715C.4  Penalties.
   1.  A violation of this chapter is an unlawful practice pursuant to section 714.16 and, in addition to the remedies provided to the attorney general pursuant to section 714.16, subsection 7, the attorney general may seek and obtain an order that a party held to violate this chapter pay damages to the attorney general on behalf of a person injured by the violation.
   2.  The rights and remedies available under this chapter are cumulative to each other and to any other rights and remedies available under the law.
EXPLANATION
   This bill establishes data security compliance requirements in relation to payment card transactions.
   Current provisions in Code chapter 715C prescribe consumer notification requirements applicable to security breaches involving consumer personal information used in the course of a person’s business, vocation, occupation, or volunteer activities. This bill establishes requirements and remedies available to a financial institution in the event a security breach occurs and a person who accepts a payment card in connection with transactions occurring in the ordinary course of business has failed to comply with or adhere to payment card industry data security standards.
   The bill provides that a financial institution may bring an action against a person who is subject to a breach of security if the person is found at the time of the breach to have engaged in or violated data security standards. The financial institution shall be required to submit in writing a request that the person alleged to have violated the standards certify compliance with the standards pursuant to a payment card industry-approved independent auditor or another person authorized to issue such a certification. The bill states that a presumption of compliance shall exist if a person contracts for or utilizes the services of a third party to collect, maintain, or store personal information used in connection with a payment card, and contractually requires that the third party ensure compliance with the standards on an ongoing basis.
   The bill provides that a financial institution prevailing in an action for failure to safeguard personal information against a breach of security may recover actual damages, as specified in the bill, arising from the failure.
   The bill makes existing unlawful practice penalty provisions for violations of Code section 715C.2 also applicable to data security compliance violations.