House
Study
Bill
674
-
Introduced
HOUSE
FILE
_____
BY
(PROPOSED
COMMITTEE
ON
INFORMATION
TECHNOLOGY
BILL
BY
CHAIRPERSON
LOHSE)
A
BILL
FOR
An
Act
relating
to
consumer
data
protection,
providing
civil
1
penalties,
and
including
effective
date
provisions.
2
BE
IT
ENACTED
BY
THE
GENERAL
ASSEMBLY
OF
THE
STATE
OF
IOWA:
3
TLSB
5349YC
(11)
89
es/rn
H.F.
_____
Section
1.
NEW
SECTION
.
715D.1
Definitions.
1
As
used
in
this
chapter,
unless
the
context
otherwise
2
requires:
3
1.
“Affiliate”
means
a
legal
entity
that
controls,
is
4
controlled
by,
or
is
under
common
control
with
another
legal
5
entity
or
shares
common
branding
with
another
legal
entity.
6
For
the
purposes
of
this
definition,
“control”
or
“controlled”
7
means:
8
a.
Ownership
of,
or
the
power
to
vote,
more
than
fifty
9
percent
of
the
outstanding
shares
of
any
class
of
voting
10
security
of
a
company.
11
b.
Control
in
any
manner
over
the
election
of
a
majority
of
12
the
directors
or
of
individuals
exercising
similar
functions.
13
c.
The
power
to
exercise
controlling
influence
over
the
14
management
of
a
company.
15
2.
“Aggregate
data”
means
information
that
relates
to
a
16
group
or
category
of
consumers,
from
which
individual
consumer
17
identities
have
been
removed,
that
is
not
linked
or
reasonably
18
linkable
to
any
consumer.
19
3.
“Authenticate”
means
verifying
through
reasonable
means
20
that
a
consumer,
entitled
to
exercise
their
consumer
rights
in
21
section
715D.3,
is
the
same
consumer
exercising
such
consumer
22
rights
with
respect
to
the
personal
data
at
issue.
23
4.
“Biometric
data”
means
data
generated
by
automatic
24
measurements
of
an
individual’s
biological
characteristics,
25
such
as
a
fingerprint,
voiceprint,
eye
retinas,
irises,
or
26
other
unique
biological
patterns
or
characteristics
that
is
27
used
to
identify
a
specific
individual.
“Biometric
data”
28
does
not
include
a
physical
or
digital
photograph,
a
video
or
29
audio
recording
or
data
generated
therefrom,
or
information
30
collected,
used,
or
stored
for
health
care
treatment,
payment,
31
or
operations
under
HIPAA.
32
5.
“Child”
means
any
natural
person
younger
than
thirteen
33
years
of
age.
34
6.
“Consent”
means
a
clear
affirmative
act
signifying
a
35
-1-
LSB
5349YC
(11)
89
es/rn
1/
25
H.F.
_____
consumer’s
freely
given,
specific,
informed,
and
unambiguous
1
agreement
to
process
personal
data
relating
to
the
consumer.
2
“Consent”
may
include
a
written
statement,
including
a
3
statement
written
by
electronic
means,
or
any
other
unambiguous
4
affirmative
action.
5
7.
“Consumer”
means
a
natural
person
who
is
a
resident
of
6
the
state
acting
only
in
an
individual
or
household
context
and
7
excluding
a
natural
person
acting
in
a
commercial
or
employment
8
context.
9
8.
“Controller”
means
a
person
that,
alone
or
jointly
with
10
others,
determines
the
purpose
and
means
of
processing
personal
11
data.
12
9.
“Covered
entity”
means
the
same
as
“covered
entity”
13
defined
by
HIPAA.
14
10.
“Decisions
that
produce
legal
or
similarly
significant
15
effects
concerning
a
consumer”
means
a
decision
made
by
a
16
controller
that
results
in
the
provision
or
denial
by
the
17
controller
of
financial
and
lending
services,
housing,
18
insurance,
education
enrollment,
criminal
justice,
employment
19
opportunities,
health
care
services,
or
access
to
basic
20
necessities,
such
as
food
and
water.
21
11.
“De-identified
data”
means
data
that
cannot
reasonably
22
be
linked
to
an
identified
or
identifiable
natural
person.
23
12.
“Health
care
provider”
means
any
of
the
following:
24
a.
A
general
hospital,
ordinary
hospital,
outpatient
25
surgical
hospital,
nursing
home,
or
certified
nursing
facility
26
licensed
or
certified
by
the
state.
27
b.
A
mental
or
psychiatric
hospital
licensed
by
the
state.
28
c.
A
hospital
operated
by
the
state.
29
d.
A
hospital
operated
by
universities
within
the
state.
30
e.
A
person
licensed
to
practice
medicine
or
osteopathy
in
31
the
state.
32
f.
A
person
licensed
to
furnish
health
care
policies
or
33
plans
in
the
state.
34
g.
A
person
licensed
to
practice
dentistry
in
the
state.
35
-2-
LSB
5349YC
(11)
89
es/rn
2/
25
H.F.
_____
h.
“Health
care
provider”
does
not
include
a
continuing
1
care
retirement
community
or
any
nursing
care
facility
of
a
2
religious
body
which
depends
upon
prayer
alone
for
healing.
3
13.
“Health
Insurance
Portability
and
Accountability
4
Act”
or
“HIPAA”
means
the
Health
Insurance
Portability
and
5
Accountability
Act
of
1996,
Pub.
L.
No.
104-191,
including
6
amendments
thereto
and
regulations
promulgated
thereunder.
7
14.
“Health
record”
means
any
written,
printed,
or
8
electronically
recorded
material
maintained
by
a
health
care
9
provider
in
the
course
of
providing
health
services
to
an
10
individual
concerning
the
individual
and
the
services
provided,
11
including
related
health
information
provided
in
confidence
to
12
a
health
care
provider.
13
15.
“Identified
or
identifiable
natural
person”
means
a
14
person
who
can
be
readily
identified,
directly
or
indirectly.
15
16.
“Institution
of
higher
education”
means
nonprofit
16
private
institutions
of
higher
education
and
proprietary
17
private
institutions
of
higher
education
in
the
state,
18
community
colleges,
and
each
associate-degree-granting
and
19
baccalaureate
public
institutions
of
higher
education
in
the
20
state.
21
17.
“Nonprofit
organization”
means
any
corporation
organized
22
under
chapter
504,
any
organization
exempt
from
taxation
under
23
sections
501(c)(3),
501(c)(6),
or
501(c)(12)
of
the
Internal
24
Revenue
Code,
and
any
subsidiaries
and
affiliates
of
entities
25
organized
pursuant
to
chapter
499.
26
18.
“Personal
data”
means
any
information
that
is
linked
or
27
reasonably
linkable
to
an
identified
or
identifiable
natural
28
person.
“Personal
data”
does
not
include
de-identified
data
or
29
publicly
available
information.
30
19.
“Precise
geolocation
data”
means
information
derived
31
from
technology,
including
but
not
limited
to
global
32
positioning
system
level
latitude
and
longitude
coordinates
or
33
other
mechanisms,
that
identifies
the
specific
location
of
a
34
natural
person
with
precision
and
accuracy
within
a
radius
of
35
-3-
LSB
5349YC
(11)
89
es/rn
3/
25
H.F.
_____
one
thousand
seven
hundred
fifty
feet.
“Precise
geolocation
1
data”
does
not
include
the
content
of
communications
or
any
2
data
generated
by
or
connected
to
advanced
utility
metering
3
infrastructure
systems
or
equipment
for
use
by
a
utility.
4
20.
“Process”
or
“processing”
means
any
operation
or
set
5
of
operations
performed,
whether
by
manual
or
automated
means,
6
on
personal
data
or
on
sets
of
personal
data,
such
as
the
7
collection,
use,
storage,
disclosure,
analysis,
deletion,
or
8
modification
of
personal
data.
9
21.
“Processor”
means
a
person
that
processes
personal
data
10
on
behalf
of
a
controller.
11
22.
“Profiling”
means
any
form
of
solely
automated
12
processing
performed
on
personal
data
to
evaluate,
analyze,
13
or
predict
personal
aspects
related
to
an
identified
or
14
identifiable
natural
person’s
economic
situation,
health,
15
personal
preferences,
interests,
reliability,
behavior,
16
location,
or
movements.
17
23.
“Protected
health
information”
means
the
same
as
18
protected
health
information
established
by
HIPAA.
19
24.
“Pseudonymous
data”
means
personal
data
that
cannot
20
be
attributed
to
a
specific
natural
person
without
the
use
21
of
additional
information,
provided
that
such
additional
22
information
is
kept
separately
and
is
subject
to
appropriate
23
technical
and
organizational
measures
to
ensure
that
24
the
personal
data
is
not
attributed
to
an
identified
or
25
identifiable
natural
person.
26
25.
“Sale
of
personal
data”
means
the
exchange
of
personal
27
data
for
monetary
consideration
by
the
controller
to
a
third
28
party.
“
Sale
of
personal
data”
does
not
include:
29
a.
The
disclosure
of
personal
data
to
a
processor
that
30
processes
the
personal
data
on
behalf
of
the
controller.
31
b.
The
disclosure
of
personal
data
to
a
third
party
for
32
purposes
of
providing
a
product
or
service
requested
by
the
33
consumer
or
a
parent
of
a
child.
34
c.
The
disclosure
or
transfer
of
personal
data
to
an
35
-4-
LSB
5349YC
(11)
89
es/rn
4/
25
H.F.
_____
affiliate
of
the
controller.
1
d.
The
disclosure
of
information
that
the
consumer
2
intentionally
made
available
to
the
general
public
via
a
3
channel
of
mass
media
and
did
not
restrict
to
a
specific
4
audience.
5
e.
The
disclosure
or
transfer
of
personal
data
to
a
third
6
party
as
an
asset
that
is
part
of
a
proposed
or
actual
merger,
7
acquisition,
bankruptcy,
or
other
transaction
in
which
the
8
third
party
assumes
control
of
all
or
part
of
the
controller’s
9
assets.
10
26.
“Sensitive
data”
means
a
category
of
personal
data
that
11
includes
the
following:
12
a.
Personal
data
revealing
racial
or
ethnic
origin,
13
religious
beliefs,
mental
or
physical
health
diagnosis,
sexual
14
orientation,
or
citizenship
or
immigration
status.
15
b.
Genetic
or
biometric
data
that
is
processed
for
the
16
purpose
of
uniquely
identifying
a
natural
person.
17
c.
The
personal
data
collected
from
a
known
child.
18
d.
Precise
geolocation
data.
19
27.
“Targeted
advertising”
means
displaying
advertisements
20
to
a
consumer
where
the
advertisement
is
selected
based
on
21
personal
data
obtained
from
that
consumer’s
activities
over
22
time
and
across
nonaffiliated
websites
or
online
applications
23
to
predict
such
consumer’s
preferences
or
interests.
“Targeted
24
advertising”
does
not
include
the
following:
25
a.
Advertisements
based
on
activities
within
a
controller’s
26
own
or
affiliated
websites
or
online
applications.
27
b.
Advertisements
based
on
the
context
of
a
consumer’s
28
current
search
query,
visit
to
a
website,
or
online
29
application.
30
c.
Advertisements
directed
to
a
consumer
in
response
to
the
31
consumer’s
request
for
information
or
feedback.
32
d.
Processing
personal
data
solely
for
measuring
or
33
reporting
advertising
performance,
reach,
or
frequency.
34
28.
“Third
party”
means
a
natural
or
legal
person,
public
35
-5-
LSB
5349YC
(11)
89
es/rn
5/
25
H.F.
_____
authority,
agency,
or
body
other
than
the
consumer,
controller,
1
processor,
or
an
affiliate
of
the
processor
or
the
controller.
2
29.
“Trade
secret”
means
information,
including
but
not
3
limited
to
a
formula,
pattern,
compilation,
program,
device,
4
method,
technique,
or
process,
that
consists
of
the
following:
5
a.
Information
that
derives
independent
economic
value,
6
actual
or
potential,
from
not
being
generally
known
to,
and
not
7
being
readily
ascertainable
by
proper
means
by,
other
persons
8
who
can
obtain
economic
value
from
its
disclosure
or
use.
9
b.
Information
that
is
the
subject
of
efforts
that
are
10
reasonable
under
the
circumstances
to
maintain
its
secrecy.
11
Sec.
2.
NEW
SECTION
.
715D.2
Scope
and
exemptions.
12
1.
This
chapter
applies
to
a
person
conducting
business
in
13
the
state
or
producing
products
or
services
that
are
targeted
14
to
residents
of
the
state
and
that
during
a
calendar
year
does
15
either
of
the
following:
16
a.
Controls
or
processes
personal
data
of
at
least
one
17
hundred
thousand
consumers.
18
b.
Controls
or
processes
personal
data
of
at
least
19
twenty-five
thousand
consumers
and
derive
over
fifty
percent
of
20
gross
revenue
from
the
sale
of
personal
data.
21
2.
This
chapter
shall
not
apply
to
the
state
or
any
22
political
subdivision
of
the
state,
financial
institutions
23
or
data
subject
to
Tit.
V
of
the
federal
Gramm-Leach-Bliley
24
Act
of
1999,
15
U.S.C.
§6801
et
seq.,
covered
entities
or
25
business
associates
governed
by
the
privacy,
security,
and
26
breach
notification
rules
issued
by
the
Iowa
department
of
27
human
services,
the
Iowa
department
of
public
health,
45
C.F.R.
28
pts.
160
and
164
established
pursuant
to
HIPAA,
nonprofit
29
organizations,
or
institutions
of
higher
education.
30
3.
The
following
information
and
data
is
exempt
from
this
31
chapter:
32
a.
Protected
health
information
under
HIPAA.
33
b.
Health
records.
34
c.
Patient
identifying
information
for
purposes
of
42
U.S.C.
35
-6-
LSB
5349YC
(11)
89
es/rn
6/
25
H.F.
_____
§290dd-2.
1
d.
Identifiable
private
information
for
purposes
of
the
2
federal
policy
for
the
protection
of
human
subjects
under
45
3
C.F.R.
pt.
46.
4
e.
Identifiable
private
information
that
is
otherwise
5
information
collected
as
part
of
human
subjects
research
6
pursuant
to
the
good
clinical
practice
guidelines
issued
by
7
the
international
council
for
harmonisation
of
technical
8
requirements
for
pharmaceuticals
for
human
use.
9
f.
The
protection
of
human
subjects
under
21
C.F.R.
pts.
6,
10
50,
and
56.
11
g.
Personal
data
used
or
shared
in
research
conducted
in
12
accordance
with
the
requirements
set
forth
in
this
chapter,
or
13
other
research
conducted
in
accordance
with
applicable
law.
14
h.
Information
and
documents
created
for
purposes
of
the
15
federal
Health
Care
Quality
Improvement
Act
of
1986,
42
U.S.C.
16
§11101
et
seq.
17
i.
Patient
safety
work
product
for
purposes
of
the
federal
18
Patient
Safety
And
Quality
Improvement
Act,
42
U.S.C.
§299b-21
19
et
seq.
20
j.
Information
derived
from
any
of
the
health
care-related
21
information
listed
in
this
subsection
that
is
de-identified
in
22
accordance
with
the
requirements
for
de-identification
pursuant
23
to
HIPAA.
24
k.
Information
originating
from,
and
intermingled
to
be
25
indistinguishable
with,
or
information
treated
in
the
same
26
manner
as
information
exempt
under
this
subsection
that
is
27
maintained
by
a
covered
entity
or
business
associate
as
defined
28
by
HIPAA
or
a
program
or
a
qualified
service
organization
as
29
defined
by
42
U.S.C.
§290dd-2.
30
l.
Information
used
only
for
public
health
activities
and
31
purposes
as
authorized
by
HIPAA.
32
m.
The
collection,
maintenance,
disclosure,
sale,
33
communication,
or
use
of
any
personal
information
bearing
on
a
34
consumer’s
credit
worthiness,
credit
standing,
credit
capacity,
35
-7-
LSB
5349YC
(11)
89
es/rn
7/
25
H.F.
_____
character,
general
reputation,
personal
characteristics,
or
1
mode
of
living
by
a
consumer
reporting
agency
or
furnisher
that
2
provides
information
for
use
in
a
consumer
report,
and
by
a
3
user
of
a
consumer
report,
but
only
to
the
extent
that
such
4
activity
is
regulated
by
and
authorized
under
the
federal
Fair
5
Credit
Reporting
Act,
15
U.S.C.
§1681.
6
n.
Personal
data
collected,
processed,
sold,
or
disclosed
in
7
compliance
with
the
federal
Driver’s
Privacy
Protection
Act
of
8
1994,
18
U.S.C.
§2721
et
seq.
9
o.
Personal
data
regulated
by
the
federal
Family
Educational
10
Rights
and
Privacy
Act,
20
U.S.C.
§1232
et
seq.
11
p.
Personal
data
collected,
processed,
sold,
or
disclosed
in
12
compliance
with
the
federal
Farm
Credit
Act,
12
U.S.C.
§2001
13
et
seq.
14
q.
Data
processed
or
maintained
as
follows:
15
(1)
In
the
course
of
an
individual
applying
to,
employed
16
by,
or
acting
as
an
agent
or
independent
contractor
of
a
17
controller,
processor,
or
third
party,
to
the
extent
that
the
18
data
is
collected
and
used
within
the
context
of
that
role.
19
(2)
As
the
emergency
contact
information
of
an
individual
20
under
this
chapter
used
for
emergency
contact
purposes.
21
(3)
That
is
necessary
to
retain
to
administer
benefits
22
for
another
individual
relating
to
the
individual
under
23
subparagraph
(1)
and
used
for
the
purposes
of
administering
24
those
benefits.
25
r.
Personal
data
used
in
accordance
with
the
federal
26
Children’s
Online
Privacy
Protection
Act,
15
U.S.C.
§6501
–
27
6506,
and
its
rules,
regulations,
and
exceptions
thereto.
28
Sec.
3.
NEW
SECTION
.
715D.3
Consumer
data
rights.
29
1.
A
consumer
may
invoke
the
consumer
rights
authorized
30
pursuant
to
this
section
at
any
time
by
submitting
a
request
to
31
a
controller
specifying
the
consumer
rights
the
consumer
wishes
32
to
invoke.
A
known
child’s
parent
or
legal
guardian
may
invoke
33
such
consumer
rights
on
behalf
of
the
known
child
regarding
34
processing
personal
data
belonging
to
the
child.
A
controller
35
-8-
LSB
5349YC
(11)
89
es/rn
8/
25
H.F.
_____
shall
comply
with
an
authenticated
consumer
request
to
exercise
1
all
of
the
following:
2
a.
To
confirm
whether
a
controller
is
processing
the
3
consumer’s
personal
data
and
to
access
such
personal
data.
4
b.
To
correct
inaccuracies
in
the
consumer’s
personal
data,
5
taking
into
account
the
nature
of
the
personal
data
and
the
6
purposes
of
the
processing
of
the
consumer’s
personal
data.
7
c.
To
delete
personal
data
provided
by
or
obtained
about
8
the
consumer.
9
d.
To
obtain
a
copy
of
the
consumer’s
personal
data
that
the
10
consumer
previously
provided
to
the
controller
in
a
portable
11
and,
to
the
extent
technically
practicable,
readily
usable
12
format
that
allows
the
consumer
to
transmit
the
data
to
another
13
controller
without
hindrance,
where
the
processing
is
carried
14
out
by
automated
means.
15
e.
To
opt
out
of
the
processing
of
the
personal
data
for
16
purposes
of
targeted
advertising,
the
sale
of
personal
data,
17
or
profiling
in
furtherance
of
decisions
that
produce
legal
or
18
similarly
significant
effects
concerning
the
consumer.
19
2.
Except
as
otherwise
provided
in
this
chapter,
a
20
controller
shall
comply
with
a
request
by
a
consumer
to
21
exercise
the
consumer
rights
authorized
pursuant
to
this
22
section
as
follows:
23
a.
A
controller
shall
respond
to
the
consumer
without
undue
24
delay,
but
in
all
cases
within
forty-five
days
of
receipt
25
of
a
request
submitted
pursuant
to
the
methods
described
in
26
this
section.
The
response
period
may
be
extended
once
by
27
forty-five
additional
days
when
reasonably
necessary
upon
28
considering
the
complexity
and
number
of
the
consumer’s
29
requests
by
informing
the
consumer
of
any
such
extension
within
30
the
initial
forty-five-day
response
period,
together
with
the
31
reason
for
the
extension.
32
b.
If
a
controller
declines
to
take
action
regarding
the
33
consumer’s
request,
the
controller
shall
inform
the
consumer
34
without
undue
delay
of
the
justification
for
declining
to
take
35
-9-
LSB
5349YC
(11)
89
es/rn
9/
25
H.F.
_____
action
and
instructions
for
how
to
appeal
the
decision
pursuant
1
to
this
section.
2
c.
Information
provided
in
response
to
a
consumer
request
3
shall
be
provided
by
a
controller
free
of
charge,
up
to
4
twice
annually
per
consumer.
If
a
request
from
a
consumer
5
is
manifestly
unfounded,
excessive,
or
repetitive,
the
6
controller
may
charge
the
consumer
a
reasonable
fee
to
cover
7
the
administrative
costs
of
complying
with
the
request
or
8
decline
to
act
on
the
request.
The
controller
bears
the
burden
9
of
demonstrating
the
manifestly
unfounded,
excessive,
or
10
repetitive
nature
of
the
request.
11
d.
If
a
controller
is
unable
to
authenticate
a
request
12
using
commercially
reasonable
efforts,
the
controller
shall
13
not
be
required
to
comply
with
a
request
to
initiate
an
action
14
under
this
section
and
may
request
that
the
consumer
provide
15
additional
information
reasonably
necessary
to
authenticate
the
16
consumer
and
the
consumer’s
request.
17
3.
A
controller
shall
establish
a
process
for
a
consumer
18
to
appeal
the
controller’s
refusal
to
take
action
on
a
request
19
within
a
reasonable
period
of
time
after
the
consumer’s
20
receipt
of
the
decision
pursuant
to
this
section.
The
appeal
21
process
shall
be
conspicuously
available
and
similar
to
the
22
process
for
submitting
requests
to
initiate
action
pursuant
23
to
this
section.
Within
sixty
days
of
receipt
of
an
appeal,
24
a
controller
shall
inform
the
consumer
in
writing
of
any
25
action
taken
or
not
taken
in
response
to
the
appeal,
including
26
a
written
explanation
of
the
reasons
for
the
decision.
If
27
the
appeal
is
denied,
the
controller
shall
also
provide
the
28
consumer
with
an
online
mechanism
through
which
the
consumer
29
may
contact
the
attorney
general
to
submit
a
complaint.
30
Sec.
4.
NEW
SECTION
.
715D.4
Data
controller
duties.
31
1.
A
controller
shall
limit
the
collection
of
personal
32
data
to
what
is
adequate,
relevant,
and
reasonably
necessary
33
in
relation
to
the
purposes
for
which
such
data
is
processed,
34
as
disclosed
to
the
consumer.
Except
as
otherwise
provided
35
-10-
LSB
5349YC
(11)
89
es/rn
10/
25
H.F.
_____
in
this
chapter,
a
controller
shall
not
process
personal
1
data
for
purposes
that
are
neither
reasonably
necessary
to
2
nor
compatible
with
the
disclosed
purposes
for
which
such
3
personal
data
is
processed,
as
disclosed
to
the
consumer,
4
unless
the
controller
obtains
the
consumer’s
consent.
A
5
controller
shall
adopt
and
implement
reasonable
administrative,
6
technical,
and
physical
data
security
practices
to
protect
the
7
confidentiality,
integrity,
and
accessibility
of
personal
data.
8
Such
data
security
practices
shall
be
appropriate
to
the
volume
9
and
nature
of
the
personal
data
at
issue.
A
controller
shall
10
not
process
sensitive
data
without
the
consumer’s
consent,
or,
11
in
the
case
of
the
processing
of
sensitive
data
concerning
a
12
known
child,
without
processing
such
data
in
accordance
with
13
the
federal
Children’s
Online
Privacy
Protection
Act,
15
U.S.C.
14
§6501
et
seq.
15
2.
A
controller
shall
not
process
personal
data
in
16
violation
of
state
and
federal
laws
that
prohibit
unlawful
17
discrimination
against
a
consumer.
A
controller
shall
not
18
discriminate
against
a
consumer
for
exercising
any
of
the
19
consumer
rights
contained
in
this
chapter,
including
denying
20
goods
or
services,
charging
different
prices
or
rates
for
21
goods
or
services,
or
providing
a
different
level
of
quality
22
of
goods
and
services
to
the
consumer.
However,
nothing
in
23
this
chapter
shall
be
construed
to
require
a
controller
to
24
provide
a
product
or
service
that
requires
the
personal
data
25
of
a
consumer
that
the
controller
does
not
collect
or
maintain
26
or
to
prohibit
a
controller
from
offering
a
different
price,
27
rate,
level,
quality,
or
selection
of
goods
or
services
to
a
28
consumer,
including
offering
goods
or
services
for
no
fee,
29
if
the
consumer
has
exercised
his
right
to
opt
out
pursuant
30
to
section
715D.3
or
the
offer
is
related
to
a
consumer’s
31
voluntary
participation
in
a
bona
fide
loyalty,
rewards,
32
premium
features,
discounts,
or
club
card
program.
33
3.
Any
provision
of
a
contract
or
agreement
that
purports
to
34
waive
or
limit
in
any
way
consumer
rights
pursuant
to
section
35
-11-
LSB
5349YC
(11)
89
es/rn
11/
25
H.F.
_____
715D.3
shall
be
deemed
contrary
to
public
policy
and
shall
be
1
void
and
unenforceable.
2
4.
A
controller
shall
provide
consumers
with
a
reasonably
3
accessible,
clear,
and
meaningful
privacy
notice
that
includes
4
the
following:
5
a.
The
categories
of
personal
data
processed
by
the
6
controller.
7
b.
The
purpose
for
processing
personal
data.
8
c.
How
consumers
may
exercise
their
consumer
rights
pursuant
9
to
section
715D.3,
including
how
a
consumer
may
appeal
a
10
controller’s
decision
with
regard
to
the
consumer’s
request.
11
d.
The
categories
of
personal
data
that
the
controller
12
shares
with
third
parties,
if
any.
13
e.
The
categories
of
third
parties,
if
any,
with
whom
the
14
controller
shares
personal
data.
15
5.
If
a
controller
sells
a
consumer’s
personal
data
to
third
16
parties
or
uses
such
personal
data
for
targeted
advertising,
17
the
controller
shall
clearly
and
conspicuously
disclose
such
18
activity,
as
well
as
the
manner
in
which
a
consumer
may
19
exercise
the
right
to
opt
out
of
such
processing.
20
6.
A
controller
shall
establish,
and
shall
describe
in
21
a
privacy
notice,
secure
and
reliable
means
for
consumers
to
22
submit
a
request
to
exercise
their
consumer
rights
under
this
23
chapter.
Such
means
shall
consider
the
ways
in
which
consumers
24
normally
interact
with
the
controller,
the
need
for
secure
and
25
reliable
communication
of
such
requests
and
the
ability
of
26
the
controller
to
authenticate
the
identity
of
the
consumer
27
making
the
request.
A
controller
shall
not
require
a
consumer
28
to
create
a
new
account
in
order
to
exercise
consumer
rights
29
pursuant
to
section
715D.3,
but
may
require
a
consumer
to
use
30
an
existing
account.
31
Sec.
5.
NEW
SECTION
.
715D.5
Processor
duties.
32
1.
A
processor
shall
assist
a
controller
in
duties
33
required
under
this
chapter,
taking
into
account
the
nature
of
34
processing
and
the
information
available
to
the
processor
by
35
-12-
LSB
5349YC
(11)
89
es/rn
12/
25
H.F.
_____
appropriate
technical
and
organizational
measures,
insofar
as
1
is
reasonably
practicable,
as
follows:
2
a.
To
fulfill
the
controller’s
obligation
to
respond
to
3
consumer
rights
requests
pursuant
to
section
715D.3.
4
b.
To
meet
the
controller’s
obligations
in
relation
to
the
5
security
of
processing
the
personal
data
and
in
relation
to
the
6
notification
of
a
security
breach
of
the
processor
pursuant
to
7
section
715C.2.
8
c.
To
provide
necessary
information
to
enable
the
controller
9
to
conduct
and
document
data
protection
assessments
pursuant
10
to
section
715D.6.
11
2.
A
contract
between
a
controller
and
a
processor
shall
12
govern
the
processor’s
data
processing
procedures
with
respect
13
to
processing
performed
on
behalf
of
the
controller.
The
14
contract
shall
clearly
set
forth
instructions
for
processing
15
personal
data,
the
nature
and
purpose
of
processing,
the
type
16
of
data
subject
to
processing,
the
duration
of
processing,
and
17
the
rights
and
duties
of
both
parties.
The
contract
shall
also
18
include
requirements
that
the
processor
shall
do
all
of
the
19
following:
20
a.
Ensure
that
each
person
processing
personal
data
is
21
subject
to
a
duty
of
confidentiality
with
respect
to
the
data.
22
b.
At
the
controller’s
direction,
delete
or
return
all
23
personal
data
to
the
controller
as
requested
at
the
end
of
the
24
provision
of
services,
unless
retention
of
the
personal
data
25
is
required
by
law.
26
c.
Upon
the
reasonable
request
of
the
controller,
make
27
available
to
the
controller
all
information
in
the
processor’s
28
possession
necessary
to
demonstrate
the
processor’s
compliance
29
with
the
obligations
in
this
chapter.
30
d.
Allow,
and
cooperate
with,
reasonable
assessments
31
by
the
controller
or
the
controller’s
designated
assessor.
32
The
processor
may
arrange
for
a
qualified
and
independent
33
assessor
to
conduct
an
assessment
of
the
processor’s
policies
34
and
technical
and
organizational
measures
in
support
of
35
-13-
LSB
5349YC
(11)
89
es/rn
13/
25
H.F.
_____
the
obligations
under
this
chapter
using
an
appropriate
and
1
accepted
control
standard
or
framework
and
assessment
procedure
2
for
such
assessments.
The
processor
shall
provide
a
report
of
3
such
assessment
to
the
controller
upon
request.
4
e.
Engage
any
subcontractor
or
agent
pursuant
to
a
written
5
contract
in
accordance
with
this
section
that
requires
the
6
subcontractor
to
meet
the
duties
of
the
processor
with
respect
7
to
the
personal
data.
8
3.
Nothing
in
this
section
shall
be
construed
to
relieve
a
9
controller
or
a
processor
from
imposed
liabilities
by
virtue
10
of
the
controller
or
processor’s
role
in
the
processing
11
relationship
as
defined
by
this
chapter.
12
4.
Determining
whether
a
person
is
acting
as
a
controller
or
13
processor
with
respect
to
a
specific
processing
of
data
is
a
14
fact-based
determination
that
depends
upon
the
context
in
which
15
personal
data
is
to
be
processed.
A
processor
that
continues
16
to
adhere
to
a
controller’s
instructions
with
respect
to
a
17
specific
processing
of
personal
data
remains
a
processor.
18
Sec.
6.
NEW
SECTION
.
715D.6
Data
protection
assessments.
19
1.
A
controller
shall
conduct
and
document
a
data
protection
20
assessment
of
each
of
the
following
processing
activities
21
involving
personal
data:
22
a.
The
sale
of
personal
data.
23
b.
The
processing
of
personal
data
for
targeted
advertising.
24
c.
The
processing
of
personal
data
for
purposes
of
25
profiling,
where
such
profiling
presents
a
reasonably
26
foreseeable
risk
of
any
of
the
following:
27
(1)
Unfair
or
deceptive
treatment
of,
or
unlawful
disparate
28
impact
on,
consumers.
29
(2)
Financial,
physical,
or
reputational
injury
to
30
consumers.
31
(3)
A
physical
or
other
intrusion
upon
the
solitude
or
32
seclusion,
or
the
private
affairs
or
concerns,
of
consumers,
33
where
such
intrusion
would
be
offensive
to
a
reasonable
person.
34
(4)
Other
substantial
injury
to
consumers.
35
-14-
LSB
5349YC
(11)
89
es/rn
14/
25
H.F.
_____
d.
The
processing
of
sensitive
data.
1
e.
Any
processing
activities
involving
personal
data
that
2
present
a
heightened
risk
of
harm
to
consumers.
3
2.
Data
protection
assessments
conducted
pursuant
to
4
subsection
1
shall
identify
and
weigh
the
benefits
that
may
5
flow,
directly
and
indirectly,
from
the
processing
to
the
6
controller,
the
consumer,
other
stakeholders,
and
the
public
7
against
the
potential
risks
to
the
rights
of
the
consumer
8
associated
with
such
processing,
as
mitigated
by
safeguards
9
that
can
be
employed
by
the
controller
to
reduce
such
risks.
10
The
use
of
de-identified
data
and
the
reasonable
expectations
11
of
consumers,
as
well
as
the
context
of
the
processing
and
the
12
relationship
between
the
controller
and
the
consumer
whose
13
personal
data
will
be
processed,
shall
be
factored
into
this
14
assessment
by
the
controller.
15
3.
The
attorney
general
may
request,
pursuant
to
a
civil
16
investigative
demand,
that
a
controller
disclose
any
data
17
protection
assessment
that
is
relevant
to
an
investigation
18
conducted
by
the
attorney
general,
and
the
controller
shall
19
make
the
data
protection
assessment
available
to
the
attorney
20
general.
The
attorney
general
may
evaluate
the
data
protection
21
assessment
for
compliance
with
the
responsibilities
set
22
forth
in
section
715D.4.
The
controller
shall
make
the
data
23
protection
assessment
available
to
the
attorney
general.
24
Data
protection
assessments
shall
be
confidential
and
exempt
25
from
public
inspection
and
copying
under
section
22.1.
The
26
disclosure
of
a
data
protection
assessment
pursuant
to
a
27
request
from
the
attorney
general
shall
not
constitute
a
waiver
28
of
attorney-client
privilege
or
work
product
protection
with
29
respect
to
the
data
protection
assessment
and
any
information
30
contained
in
the
data
protection
assessment.
The
attorney
31
general
may
evaluate
the
data
protection
assessment
for
32
compliance
with
the
responsibilities
set
forth
in
section
33
715D.4.
34
4.
Data
protection
assessments
conducted
by
a
controller
35
-15-
LSB
5349YC
(11)
89
es/rn
15/
25
H.F.
_____
for
the
purpose
of
compliance
with
other
laws
or
regulations
1
may
comply
under
this
section
if
the
assessments
have
a
2
reasonably
comparable
scope
and
effect.
A
single
data
3
protection
assessment
may
address
a
comparable
set
of
4
processing
operations
that
include
similar
activities.
Data
5
protection
assessment
requirements
shall
apply
to
processing
6
activities
created
or
generated
after
January
1,
2024,
and
are
7
not
retroactive.
8
Sec.
7.
NEW
SECTION
.
715D.7
Processing
data
——
exemptions.
9
1.
A
controller
in
possession
of
de-identified
data
shall
10
comply
with
the
following:
11
a.
Take
reasonable
measures
to
ensure
that
the
data
cannot
12
be
associated
with
a
natural
person.
13
b.
Publicly
commit
to
maintaining
and
using
de-identified
14
data
without
attempting
to
re-identify
the
data.
15
c.
Contractually
obligate
any
recipients
of
the
16
de-identified
data
to
comply
with
all
provisions
of
this
17
chapter.
18
2.
Nothing
in
this
chapter
shall
be
construed
to
require
the
19
following:
20
a.
A
controller
or
processor
to
re-identify
de-identified
21
data
or
pseudonymous
data.
22
b.
Maintaining
data
in
identifiable
form.
23
c.
Collecting,
obtaining,
retaining,
or
accessing
any
24
data
or
technology,
in
order
to
be
capable
of
associating
an
25
authenticated
consumer
request
with
personal
data.
26
3.
Nothing
in
this
chapter
shall
be
construed
to
require
27
a
controller
or
processor
to
comply
with
an
authenticated
28
consumer
rights
request,
pursuant
to
section
715D.3,
if
all
of
29
the
following
are
true:
30
a.
The
controller
is
not
reasonably
capable
of
associating
31
the
request
with
the
personal
data
or
it
would
be
unreasonably
32
burdensome
for
the
controller
to
associate
the
request
with
the
33
personal
data.
34
b.
The
controller
does
not
use
the
personal
data
to
35
-16-
LSB
5349YC
(11)
89
es/rn
16/
25
H.F.
_____
recognize
or
respond
to
the
specific
consumer
who
is
the
1
subject
of
the
personal
data,
or
associate
the
personal
data
2
with
other
personal
data
about
the
same
specific
consumer.
3
c.
The
controller
does
not
sell
the
personal
data
to
any
4
third
party
or
otherwise
voluntarily
disclose
the
personal
data
5
to
any
third
party
other
than
a
processor,
except
as
otherwise
6
permitted
in
this
chapter.
7
4.
Consumer
rights
contained
in
sections
715D.3
and
715D.4
8
shall
not
apply
to
pseudonymous
data
in
cases
where
the
9
controller
is
able
to
demonstrate
any
information
necessary
10
to
identify
the
consumer
is
kept
separately
and
is
subject
to
11
effective
technical
and
organizational
controls
that
prevent
12
the
controller
from
accessing
such
information.
13
5.
Controllers
that
disclose
pseudonymous
data
or
14
de-identified
data
shall
exercise
reasonable
oversight
to
15
monitor
compliance
with
any
contractual
commitments
to
which
16
the
pseudonymous
data
or
de-identified
data
is
subject
and
17
shall
take
appropriate
steps
to
address
any
breaches
of
those
18
contractual
commitments.
19
Sec.
8.
NEW
SECTION
.
715D.8
Limitations.
20
1.
Nothing
in
this
chapter
shall
be
construed
to
restrict
a
21
controller’s
or
processor’s
ability
to
do
the
following:
22
a.
Comply
with
federal,
state,
or
local
laws,
rules,
or
23
regulations.
24
b.
Comply
with
a
civil,
criminal,
or
regulatory
inquiry,
25
investigation,
subpoena,
or
summons
by
federal,
state,
local,
26
or
other
governmental
authorities.
27
c.
Cooperate
with
law
enforcement
agencies
concerning
28
conduct
or
activity
that
the
controller
or
processor
reasonably
29
and
in
good
faith
believes
may
violate
federal,
state,
or
local
30
laws,
rules,
or
regulations.
31
d.
Investigate,
establish,
exercise,
prepare
for,
or
defend
32
legal
claims.
33
e.
Provide
a
product
or
service
specifically
requested
by
a
34
consumer,
perform
a
contract
to
which
the
consumer
is
a
party,
35
-17-
LSB
5349YC
(11)
89
es/rn
17/
25
H.F.
_____
including
fulfilling
the
terms
of
a
written
warranty,
or
take
1
steps
at
the
request
of
the
consumer
prior
to
entering
into
a
2
contract.
3
f.
Take
immediate
steps
to
protect
an
interest
that
is
4
essential
for
the
life
or
physical
safety
of
the
consumer
or
5
of
another
natural
person,
and
where
the
processing
cannot
be
6
manifestly
based
on
another
legal
basis.
7
g.
Prevent,
detect,
protect
against,
or
respond
to
security
8
incidents,
identity
theft,
fraud,
harassment,
malicious
or
9
deceptive
activities,
or
any
illegal
activity.
10
h.
Preserve
the
integrity
or
security
of
systems.
11
i.
Investigate,
report,
or
prosecute
those
responsible
for
12
any
such
action.
13
j.
Engage
in
public
or
peer-reviewed
scientific
or
14
statistical
research
in
the
public
interest
that
adheres
to
15
all
other
applicable
ethics
and
privacy
laws
and
is
approved,
16
monitored,
and
governed
by
an
institutional
review
board,
or
17
similar
independent
oversight
entities
that
determine
the
18
following:
19
(1)
If
the
deletion
of
the
information
is
likely
to
provide
20
substantial
benefits
that
do
not
exclusively
accrue
to
the
21
controller.
22
(2)
The
expected
benefits
of
the
research
outweigh
the
23
privacy
risks.
24
(3)
If
the
controller
has
implemented
reasonable
safeguards
25
to
mitigate
privacy
risks
associated
with
research,
including
26
any
risks
associated
with
re-identification.
27
k.
Assist
another
controller,
processor,
or
third
party
with
28
any
of
the
obligations
under
this
subsection.
29
2.
The
obligations
imposed
on
a
controller
or
processor
30
under
this
chapter
shall
not
restrict
a
controller’s
or
31
processor’s
ability
to
collect,
use,
or
retain
data
as
follows:
32
a.
To
conduct
internal
research
to
develop,
improve,
or
33
repair
products,
services,
or
technology.
34
b.
To
effectuate
a
product
recall.
35
-18-
LSB
5349YC
(11)
89
es/rn
18/
25
H.F.
_____
c.
To
identify
and
repair
technical
errors
that
impair
1
existing
or
intended
functionality.
2
d.
To
perform
internal
operations
that
are
reasonably
3
aligned
with
the
expectations
of
the
consumer
or
reasonably
4
anticipated
based
on
the
consumer’s
existing
relationship
with
5
the
controller
or
are
otherwise
compatible
with
processing
6
data
in
furtherance
of
the
provision
of
a
product
or
service
7
specifically
requested
by
a
consumer
or
the
performance
of
a
8
contract
to
which
the
consumer
is
a
party.
9
3.
The
obligations
imposed
on
controllers
or
processors
10
under
this
chapter
shall
not
apply
where
compliance
by
the
11
controller
or
processor
with
this
chapter
would
violate
an
12
evidentiary
privilege
under
the
laws
of
the
state.
Nothing
13
in
this
chapter
shall
be
construed
to
prevent
a
controller
or
14
processor
from
providing
personal
data
concerning
a
consumer
to
15
a
person
covered
by
an
evidentiary
privilege
under
the
laws
of
16
the
state
as
part
of
a
privileged
communication.
17
4.
A
controller
or
processor
that
discloses
personal
data
18
to
a
third-party
controller
or
processor,
in
compliance
with
19
the
requirements
of
this
chapter,
is
not
in
violation
of
20
this
chapter
if
the
third-party
controller
or
processor
that
21
receives
and
processes
such
personal
data
is
in
violation
of
22
this
chapter,
provided
that,
at
the
time
of
disclosing
the
23
personal
data,
the
disclosing
controller
or
processor
did
not
24
have
actual
knowledge
that
the
recipient
intended
to
commit
a
25
violation.
A
third-party
controller
or
processor
receiving
26
personal
data
from
a
controller
or
processor
in
compliance
with
27
the
requirements
of
this
chapter
is
likewise
not
in
violation
28
of
this
chapter
for
the
offenses
of
the
controller
or
processor
29
from
which
it
receives
such
personal
data.
30
5.
Nothing
in
this
chapter
shall
be
construed
as
an
31
obligation
imposed
on
a
controller
or
a
processor
that
32
adversely
affects
the
rights
or
freedoms
of
any
persons,
such
33
as
exercising
the
right
of
free
speech
pursuant
to
the
First
34
Amendment
to
the
United
States
Constitution,
or
applies
to
the
35
-19-
LSB
5349YC
(11)
89
es/rn
19/
25
H.F.
_____
processing
of
personal
data
by
a
person
in
the
course
of
a
1
purely
personal
or
household
activity.
2
6.
Personal
data
processed
by
a
controller
pursuant
to
3
this
section
shall
not
be
processed
for
any
purpose
other
than
4
those
expressly
listed
in
this
section
unless
otherwise
allowed
5
by
this
chapter.
Personal
data
processed
by
a
controller
6
pursuant
to
this
section
may
be
processed
to
the
extent
that
7
such
processing
is
as
follows:
8
a.
Reasonably
necessary
and
proportionate
to
the
purposes
9
listed
in
this
section.
10
b.
Adequate,
relevant,
and
limited
to
what
is
necessary
11
in
relation
to
the
specific
purposes
listed
in
this
section.
12
Personal
data
collected,
used,
or
retained
pursuant
to
13
this
section
shall,
where
applicable,
take
into
account
14
the
nature
and
purpose
or
purposes
of
such
collection,
use,
15
or
retention.
Such
data
shall
be
subject
to
reasonable
16
administrative,
technical,
and
physical
measures
to
protect
the
17
confidentiality,
integrity,
and
accessibility
of
the
personal
18
data
and
to
reduce
reasonably
foreseeable
risks
of
harm
to
19
consumers
relating
to
such
collection,
use,
or
retention
of
20
personal
data.
21
7.
If
a
controller
processes
personal
data
pursuant
to
an
22
exemption
in
this
section,
the
controller
bears
the
burden
of
23
demonstrating
that
such
processing
qualifies
for
the
exemption
24
and
complies
with
the
requirements
in
subsection
6.
25
8.
Processing
personal
data
for
the
purposes
expressly
26
identified
in
subsection
1
shall
not
solely
make
an
entity
a
27
controller
with
respect
to
such
processing.
28
9.
This
chapter
shall
not
require
a
controller,
processor,
29
third
party,
or
consumer
to
disclose
trade
secrets.
30
Sec.
9.
NEW
SECTION
.
715D.9
Enforcement
——
penalties.
31
1.
The
attorney
general
shall
have
exclusive
authority
to
32
enforce
the
provisions
of
this
chapter.
Whenever
the
attorney
33
general
has
reasonable
cause
to
believe
that
any
person
has
34
engaged
in,
is
engaging
in,
or
is
about
to
engage
in
any
35
-20-
LSB
5349YC
(11)
89
es/rn
20/
25
H.F.
_____
violation
of
this
chapter,
the
attorney
general
is
empowered
to
1
issue
a
civil
investigative
demand.
2
2.
Prior
to
initiating
any
action
under
this
chapter,
3
the
attorney
general
shall
provide
a
controller
or
processor
4
thirty
days’
written
notice
identifying
the
specific
provisions
5
of
this
chapter
the
attorney
general
alleges
have
been
or
6
are
being
violated.
If
within
the
thirty-day
period,
the
7
controller
or
processor
cures
the
noticed
violation
and
8
provides
the
attorney
general
an
express
written
statement
that
9
the
alleged
violations
have
been
cured
and
that
no
further
such
10
violations
shall
occur,
no
action
shall
be
initiated
against
11
the
controller
or
processor.
12
3.
If
a
controller
or
processor
continues
to
violate
this
13
chapter
following
the
cure
period
in
subsection
2
or
breaches
14
an
express
written
statement
provided
to
the
attorney
general
15
under
that
subsection,
the
attorney
general
may
initiate
an
16
action
in
the
name
of
the
state
and
may
seek
an
injunction
to
17
restrain
any
violations
of
this
chapter
and
civil
penalties
of
18
up
to
seven
thousand
five
hundred
dollars
for
each
violation
19
under
this
chapter.
20
4.
The
attorney
general
may
recover
reasonable
expenses
21
incurred
in
investigating
and
preparing
the
case,
including
22
attorney
fees,
in
any
action
initiated
under
this
chapter.
23
5.
Nothing
in
this
chapter
shall
be
construed
as
providing
24
the
basis
for,
or
be
subject
to,
a
private
right
of
action
for
25
violations
of
this
chapter
or
under
any
other
law.
26
Sec.
10.
EFFECTIVE
DATE.
This
Act
takes
effect
January
1,
27
2024.
28
EXPLANATION
29
The
inclusion
of
this
explanation
does
not
constitute
agreement
with
30
the
explanation’s
substance
by
the
members
of
the
general
assembly.
31
This
bill
relates
to
consumer
data
protection.
32
The
bill
contains
several
definitions.
The
bill
defines
33
“controller”
to
mean
a
person
that,
alone
or
jointly
with
34
others,
determines
the
purpose
and
means
of
processing
personal
35
-21-
LSB
5349YC
(11)
89
es/rn
21/
25
H.F.
_____
data.
The
bill
defines
“identified
or
identifiable
natural
1
person”
to
mean
a
person
who
can
be
readily
identified,
2
directly
or
indirectly.
The
bill
defines
“personal
data”
to
3
mean
any
information
that
is
linked
or
reasonably
linkable
to
4
an
identified
or
identifiable
natural
person,
but
does
not
5
include
de-identified
data
or
publicly
available
information.
6
The
bill
defines
“process”
or
“processing”
to
mean
any
7
operation
or
set
of
operations
performed,
whether
by
manual
or
8
automated
means,
on
personal
data
or
on
sets
of
personal
data,
9
such
as
the
collection,
use,
storage,
disclosure,
analysis,
10
deletion,
or
modification
of
personal
data.
The
bill
defines
11
“processor”
to
mean
a
person
that
processes
personal
data
on
12
behalf
of
a
controller.
The
bill
defines
“pseudonymous
data”
13
to
mean
personal
data
that
cannot
be
attributed
to
a
specific
14
natural
person
without
the
use
of
additional
information.
15
The
bill
defines
“targeted
advertising”
to
mean
displaying
16
advertisements
to
a
consumer
where
the
advertisement
is
17
selected
based
on
personal
data
obtained
from
that
consumer’s
18
activities
over
time
and
across
nonaffiliated
websites
or
19
online
applications
to
predict
such
consumer’s
preferences
or
20
interests,
with
exceptions.
The
bill
defines
“third
party”
21
to
mean
a
natural
or
legal
person,
public
authority,
agency,
22
or
body
other
than
the
consumer,
controller,
processor,
or
23
an
affiliate
of
the
processor
or
the
controller.
The
bill
24
contains
other
defined
terms.
25
The
bill
provides
that
persons
conducting
business
in
26
the
state
or
producing
products
or
services
targeted
to
27
Iowans
that
annually
control
or
process
personal
data
of
28
over
99,999
consumers
or
control
or
process
personal
data
of
29
25,000
consumers
with
50
percent
of
gross
revenue
derived
30
from
the
sale
of
the
personal
data
shall
be
subject
to
the
31
provisions
of
the
bill.
The
state
and
political
subdivisions
32
of
the
state,
financial
institutions
or
data
subject
to
the
33
Gramm-Leach-Bliley
Act
of
1999,
certain
organizations
governed
34
by
rules
by
the
department
of
human
services,
the
department
35
-22-
LSB
5349YC
(11)
89
es/rn
22/
25
H.F.
_____
of
health,
certain
federal
governance
laws
and
the
federal
1
Health
Insurance
Portability
and
Accountability
Act,
nonprofit
2
organizations,
higher
learning
institutions,
and
certain
3
protected
information
and
personal
data
collected
under
state
4
or
federal
laws
are
exempt
from
provisions
in
the
bill.
5
The
bill
provides
consumers
have
personal
data
rights
6
that
may
be
invoked
at
any
time.
Consumers
or
the
parent
of
7
a
child
may
submit
a
request
to
a
controller
for
a
copy
of
8
the
controller’s
information
relating
to
personal
data.
The
9
controller
shall
comply
with
such
requests
to
confirm
or
deny
10
whether
the
controller
is
processing
the
personal
data,
to
11
delete
or
correct
inaccuracies
in
personal
data,
to
provide
the
12
consumer
with
a
copy
of
their
personal
data,
and
to
remove
the
13
consumer
or
child
from
personal
data
processing.
14
The
bill
requires
that
controllers
provide
responses
to
15
defined
personal
data
requests
within
45
days
of
a
consumer
16
initiating
a
request.
Responses
to
personal
data
requests
17
shall
be
provided
to
a
consumer
free
of
charge
up
to
twice
per
18
year
except
where
requests
are
overly
burdensome
or
manifestly
19
unfounded.
A
business
may
extend
the
deadline
for
good
cause,
20
including
complexity,
once
by
up
to
45
days
after
informing
the
21
consumer
of
the
reason
for
the
extension.
The
bill
provides
22
that
controllers
are
not
required
to
comply
with
requests
where
23
a
controller
is
unable
through
commercially
reasonable
efforts
24
to
verify
the
identity
of
the
consumer
submitting
the
request.
25
The
bill
requires
that
controllers
permit
consumers
to
access
26
an
appeals
process
and
provide
consumers
with
information
27
regarding
the
appeals
process
in
situations
where
a
consumer’s
28
request
is
denied.
29
The
bill
provides
that
controllers
shall
limit
the
30
collection
of
personal
data
to
the
extent
reasonably
necessary.
31
Controllers
must
disclose
to
the
consumer
the
types
of
data
32
being
collected
and
obtain
consent
from
the
consumers
regarding
33
the
collection
of
personal
data
and
sensitive
personal
data
34
processing.
Controllers
must
securely
store
personal
data
35
-23-
LSB
5349YC
(11)
89
es/rn
23/
25
H.F.
_____
of
consumers
through
administrative,
technical,
and
physical
1
security
practices.
Controllers
shall
not
discriminate
against
2
consumers
that
exercise
consumer
data
rights
as
provided
in
3
the
bill
by
denying
a
consumer
goods
or
services,
charging
4
different
prices,
or
providing
lower
quality
goods
with
5
exceptions.
Contract
provisions
that
require
consumers
to
6
waive
rights
defined
by
the
bill
will
be
considered
void
and
7
unenforceable.
8
The
bill
provides
that
controllers
give
consumers
reasonably
9
accessible
and
clear
privacy
notices
that
inform
consumers
of
10
the
information
regarding
personal
data
transfer
and
purposes
11
and
the
methods
for
consumers
to
exercise
rights.
The
bill
12
provides
that
controllers
selling
personal
data
to
third
13
parties
or
using
targeted
advertising
must
clearly
disclose
14
such
activity
and
the
right
for
the
consumer
to
opt
out
of
15
such
sales
or
use.
The
bill
requires
a
controller
to
create
a
16
method
for
private
and
secure
processing
of
consumer
requests.
17
The
bill
requires
processors
and
the
assigns
or
18
subcontractors
of
processors
to
assist
controllers
in
complying
19
with
duties
created
by
the
bill.
20
The
bill
requires
controllers
to
conduct
assessments
of
21
processing
activities
regarding
certain
personal
data.
Data
22
protection
assessments
shall
consider
benefits
and
risks
23
regarding
personal
data
processing
to
the
controller,
consumer,
24
public,
and
other
stakeholders
among
other
factors
identified
25
by
the
bill.
The
bill
provides
that
the
attorney
general
may
26
request
an
investigation
and
require
that
a
controller
disclose
27
relevant
data
protection
assessment
information
and
analyze
28
the
provided
information
for
compliance
with
duties
described
29
by
the
bill.
Other
data
protection
assessments
a
controller
30
has
conducted
may
suffice
for
purposes
of
the
bill
if
the
31
assessments
are
reasonably
similar.
32
The
bill
includes
personal
data
processing
exemptions,
33
including
pseudonymous
data
and
de-identified
data
as
defined
34
by
the
bill.
The
bill
requires
that
controllers
in
possession
35
-24-
LSB
5349YC
(11)
89
es/rn
24/
25
H.F.
_____
of
de-identified
data
take
measures
to
ensure
that
the
data
1
remains
de-identified,
publicly
commit
to
a
de-identified
2
maintenance
process,
and
require
agents
and
assigns
to
adhere
3
to
provisions
of
the
bill.
The
bill
identifies
exceptions
4
where
controllers
or
processors
are
not
required
to
comply
5
with
a
consumer
rights
request
pursuant
to
the
bill.
The
bill
6
requires
controllers
disclosing
pseudonymous
or
de-identified
7
data
to
exercise
reasonable
oversight
of
contractual
8
commitments
regarding
such
data.
9
The
bill
provides
that
the
bill
shall
not
restrict
10
controller
or
processor
abilities
to
improve
business
or
11
function.
Controllers
or
processors
sharing
personal
data
with
12
third
parties
are
not
liable
for
the
noncompliance
of
third
13
parties
if
the
controller
or
processor
did
not
have
personal
14
knowledge
of
the
violation
or
intent
to
commit
a
violation,
15
nor
is
a
third
party
liable
for
violations
of
a
controller
16
or
processor.
The
bill
provides
that
if
a
controller
seeks
17
certain
exemptions,
the
controller
bears
the
burden
of
18
demonstrating
that
the
controller
qualifies
for
the
exemption
19
and
the
exemption
complies
with
the
requirements
in
the
bill.
20
The
bill
shall
not
require
a
business,
consumer,
or
other
21
party
to
disclose
trade
secrets.
22
The
bill
provides
that
the
attorney
general
shall
23
investigate
controllers
and
processors
upon
reasonable
cause
24
for
violations
of
provisions
of
the
bill.
The
attorney
general
25
shall
provide
30
days’
notice
to
a
controller
or
processor
26
including
the
reason
for
which
the
entity
is
subject
to
an
27
investigation
and
permit
the
entity
to
cure
the
defect
prior
28
to
filing
a
civil
action.
A
controller
or
processor
found
to
29
be
in
violation
of
provisions
of
the
bill
is
subject
to
a
civil
30
penalty
of
up
to
$7,500
per
violation.
The
attorney
general
31
shall
recover
reasonable
expenses
for
expenses
related
to
the
32
investigation.
33
The
bill
takes
effect
January
1,
2024.
34
-25-
LSB
5349YC
(11)
89
es/rn
25/
25