Cybersecurity Policy Report, Data Privacy Bill Advances in Iowa, (Feb 22, 2023)
The Iowa state House Economic Growth and Technology Committee has passed a bill that would give consumers more control of their personal data by allowing consumers to opt out of personal data processing.
HF 346 allows consumers or the parent of a child to request a copy of their personal data that is being held by a controller, confirmation that a controller is processing their personal data, and to make corrections to the data that has been collected. The bill specifies that controllers must disclose to the consumer the types of data being collected and obtain consent from the consumers regarding the collection of personal data and sensitive personal data processing. In addition, controllers selling personal data to third parties or using targeted advertising must clearly disclose such activity and the right for the consumer to opt out of such sales or use.
The provisions of the bill would apply to entities conducting business in the state or offering products or services targeted to Iowans that annually control or process personal data of more than 99,999 consumers or control or process personal data of 25,000 consumers with 50% of gross revenue derived from the sale of personal data.
The bill authorizes the state attorney general to investigate probable violations by controllers and processors. The attorney general must provide 30 days’ notice to a controller or processor and alert the company it may be subject to a violation. The entity would then be allowed to cure the defect prior to the filing of a civil action. A controller or processor found to be in violation of provisions of the bill would be subject to a civil penalty of up to $7,500 per violation. Any funds collected would be paid into a new consumer education and litigation fund.
The bill carries an effective date of Jan. 1, 2025.
News: StateLegislation DataPrivacy