HF 2048 (LSB 5397YH (3) 91)

HOUSE FILE 2048

BY  GEARHART

A BILL FOR

An Act relating to personal data processing practices for companies, and making civil penalties applicable.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  NEW SECTION.  715F.1  Definitions.
   1.  “Automated decision making” means a process that uses personal data to make decisions, including but not limited to profiling, risk scoring, and determining eligibility, without human involvement.
   2.  “Company” means a person conducting business in this state that processes the personal data of five thousand or more individuals who reside in this state in a single calendar year.
   3.  “Personal data” means any information that is linked or reasonably linkable to an identified or identifiable individual. “Personal data” does not include de-identified or aggregate data or publicly available information.
   4.  “Process” means the act of performing an operation on personal data, including collecting, storing, using, analyzing, disclosing, or deleting personal data.
    Sec. 2.  NEW SECTION.  715F.2  Company requirements.
   1.  A company shall do all of the following:
   a.  Disclose all of the following to an individual in a clear and conspicuous manner prior to processing the individual’s personal data:
   (1)  The purposes for which the company intends to use the individual’s personal data, including but not limited to whether the personal data will be used for automated decision making or artificial intelligence training. The purposes shall include a plain language description of how the personal data will be used.
   (2)  The types of personal data the company intends to process.
   (3)  The types of persons with whom the company intends to share or sell personal data.
   (4)  Whether the individual will be compensated for providing personal data, and in what form such compensation will come.
   b.  (1)  Obtain consent from an individual to allow the company to process the individual’s personal data prior to processing the individual’s personal data.
   (2)  A company shall obtain consent from an individual by offering the individual a clear means to affirmatively provide the consent. The company shall not use deceptive or manipulative means to obtain an individual’s consent.
   c.  Collect only the personal data reasonably necessary to achieve the purposes disclosed under paragraph “a”.
   d.  Allow an individual to revoke consent to allow the company to process the individual’s data in a manner that is no more burdensome than the manner used to obtain the individual’s consent.
   e.  Cease all processing of the individual’s personal data within thirty calendar days of receiving notice that the individual has revoked consent to allow the company to process the individual’s personal data.
   f.  Implement and maintain administrative, technical, and physical practices that ensure the security of personal data the company processes. The practices shall be appropriate for the company given the volume, nature, and sensitivity of the personal data the company processes.
   2.  A company shall not do any of the following:
   a.  Process personal data in a manner the individual to whom the personal data pertains has not consented.
   b.  Deny or downgrade an individual’s service solely because the individual exercised a right granted under section 715F.3.
    Sec. 3.  NEW SECTION.  715F.3  Personal data processing —— individual rights.
   A resident of this state shall have all of the following rights:
   1.  To obtain confirmation from a company of whether the company is processing the individual’s personal data.
   2.  To obtain a detailed summary of the personal data processed by a company.
   3.  To request that a company correct inaccurate personal data pertaining to the individual and processed by the company.
   4.  Subject to other data retention requirements, to request that a company delete personal data pertaining to the individual and processed by the company.
   5.  To revoke, at any time, consent the individual gave to a company to process the individual’s personal data.
    Sec. 4.  NEW SECTION.  715F.4  Enforcement —— penalties.
   1.  The attorney general shall have the authority to investigate violations and enforce this chapter.
   2.  A violation of this chapter shall constitute an unlawful practice under section 714.16.
   3.  A resident of this state may bring a private action against a company for injunctive relief, civil penalties, and actual damages caused by any of the following:
   a.  An unauthorized entity obtaining the resident’s personal data due to the company’s failure to implement or maintain sufficient administrative, technical, and physical practices to ensure the security of personal data the company processes.
   b.  A violation of this chapter the company committed that resulted in actual damages to the resident.
   4.  A violation of this chapter shall be punishable by a civil penalty of up to seven thousand five hundred dollars per violation per affected resident of this state.
   5.  Civil penalties awarded to the state under this chapter shall be deposited into the general fund of the state.
    Sec. 5.  NEW SECTION.  715F.5  Exemptions.
   This chapter shall not apply to any of the following:
   1.  Personal data processed in the course of obtaining, issuing, or executing a valid warrant or subpoena.
   2.  Personal data processed solely for national security or law enforcement purposes.
   3.  Personal data that has been de-identified or made anonymous so that the data can no longer be reasonably linked to an individual.
    Sec. 6.  Section 714.16, subsection 2, Code 2026, is amended by adding the following new paragraph:
   NEW PARAGRAPH.  t.  It is an unlawful practice for a company to violate chapter 715F.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to personal data (data) processing practices for companies.
   The bill defines “automated decision making” as a process that uses data to make decisions, including but not limited to profiling, risk scoring, and determining eligibility, without human involvement.
   The bill defines “company” as a person conducting business in this state that processes the data of 5,000 or more individuals who reside in this state in a single calendar year.
   The bill defines “personal data” as any information that is linked or reasonably linkable to an identified or identifiable individual. “Personal data” does not include de-identified or aggregate data or publicly available information.
   The bill defines “process” as the act of performing an operation on data, including collecting, storing, using, analyzing, disclosing, or deleting data.
   The bill details several disclosures a company must make and acts the company must perform. The bill also prohibits a company from processing data in a manner that the individual to whom the personal data pertains has not consented, and prohibits a company from denying or downgrading an individual’s service solely because the individual exercised a right granted under the bill.
   The bill details several rights that each resident of this state shall have relating to data.
   The bill authorizes the attorney general to investigate violations and enforce the bill. A violation of the bill shall constitute an unlawful practice under Code section 714.16 (consumer frauds). A resident of this state is allowed to bring a private action against a company for injunctive relief, civil penalties, and actual damages caused by an unauthorized entity obtaining the resident’s personal data due to the company’s failure to implement or maintain sufficient administrative, technical, and physical practices to ensure the security of personal data the company processes, or for a violation of the bill the company committed that resulted in actual damages to the resident. A violation of the bill is punishable by a civil penalty of up to $7,500 per violation per affected resident of this state. Penalties awarded to the state shall be deposited into the general fund of the state.
   The bill exempts personal data processed in the course of obtaining, issuing, or executing a valid warrant or subpoena; personal data processed solely for national security or law enforcement purposes; and personal data that has been de-identified or made anonymous so that the data can no longer be reasonably linked to an individual from the bill’s provisions.
   The bill makes a conforming change to Code section 714.16.