Processes personal data, in Iowa

Iowa Admin. Code r. 191-90.2 · Read the law's page

• As an insurance licensee, treat information as outside personally identifiable financial information only if it does not identify a consumer, such as aggregate information or blind data that contains no personal identifiers like account numbers, names and addresses (Iowa Admin. Code 191-90.2).
• As an insurance licensee, treat health information that identifies an individual, or that you have a reasonable basis to believe could be used to identify an individual, as nonpublic personal health information (Iowa Admin. Code 191-90.2).

Iowa Code ch. 554G (554G.1 to 554G.4, added by 2023 Acts, ch. 63 (H.F. 553)) · Read the law's page

• This affirmative defense is available to a covered entity, a business, defined to include a financial institution and an entity organized under chapter 28E, that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa; a municipality is excluded from the definition of business, and the chapter creates no independent duty to adopt a cybersecurity program.
• To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.
• Fund the program at a scale and scope that is appropriate if the cost to operate it is no less than the covered entity's most recently calculated maximum probable loss value.
• Satisfy the framework requirement by reasonably conforming the program to a named industry-recognized cybersecurity framework (the NIST framework for improving critical infrastructure cybersecurity, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family), or, where already regulated under one, by conforming the program to the entirety of HIPAA's Security Rule, Gramm-Leach-Bliley Title V, the federal Information Security Modernization Act of 2014, HITECH, Iowa's own Insurance Data Security Act (chapter 507F), or applicable federal critical-infrastructure-protection rules, or by combining PCI Data Security Standard compliance with one of the named frameworks; conform the program to a revised framework or amended regulation within one year of its publication or effective date.
• This section creates no private right of action, including a class action, for a person's failure to comply with it: it is a defense available in litigation another statute or the common law already permits, never an independent basis to sue.

Iowa Code ch. 715D, §§ 715D.2, 715D.4, 715D.5 · Read the law's page

• Confirm you conduct business in Iowa, or produce a product or service used by Iowa residents, and process or sell personal data before relying on ICDPA's scope in compliance planning.

Iowa Code § 715D.1(4), (26) · Read the law's page

• Offer an Iowa consumer an opt-out mechanism before processing their sensitive data. Unlike most peer states in this batch, ICDPA does not require opt-in consent for this category.
• Do not treat an identifier derived solely from a photograph, video, or audio recording as ICDPA biometric data. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.

Iowa Code § 715D.3 · Read the law's page

• Give an Iowa consumer a means to confirm whether you process their personal data, access it, delete it, and receive a portable copy. ICDPA does not require you to offer a correction mechanism.
• Offer an Iowa consumer an opt-out of the sale of personal data. If you sell personal data to third parties or engage in targeted advertising, disclose that clearly and conspicuously together with the manner in which a consumer may opt out of it. ICDPA gives no right to opt out of profiling.
• Respond to a consumer rights request without undue delay and within 90 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Iowa Code § 715D.8 · Read the law's page

• Expect ICDPA violations to be enforced exclusively by the Iowa Attorney General, never by a private plaintiff.
• Cure a noticed violation and provide a written statement of cure within 90 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, this cure right carries no sunset date in the statutory text.

Iowa Code §§ 715D.1(2), (10), (18), (23), 715D.6 · Read the law's page

• Do not treat data as de-identified or aggregate, and so outside personal data, unless it cannot reasonably be linked to an identified or identifiable natural person, or relates to a group or category of consumers with individual identities removed and is not linked or reasonably linkable to any consumer (Iowa Code 715D.1(2), (10), (18)).
• To rely on the pseudonymous data exemption from the consumer rights in sections 715D.3 and 715D.4, be able to demonstrate that the information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures (Iowa Code 715D.6(3)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (Iowa Code 715D.6(4)).

Iowa Code § 715C.2 · Read the law's page

• Notify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay.
• Notify the Iowa Attorney General's consumer protection division within five business days of notifying consumers, if the breach requires notifying more than 500 Iowa residents.

Iowa Code § 729.6(3) · Read the law's page

• Do not obtain genetic information, or samples for genetic testing, from an individual without first obtaining informed and written consent from the individual or the individual's authorized representative (Iowa Code 729.6(3)(a)).
• Do not perform genetic testing of an individual, or collect, retain, transmit or use genetic information, without the informed and written consent of the individual or the individual's authorized representative (729.6(3)(b)).
• You need no consent where federal or other state law lets you collect, retain, transmit or use the information without it, to identify an individual in a criminal investigation by a law enforcement agency, to identify deceased individuals, to establish parental identity, to screen newborns, or for medical or scientific research and education and medical repositories and registries whose information contains no personally identifiable information (729.6(3)(c)).

Iowa Code § 729.6(4) · Read the law's page

• If you are a third-party administrator or health insurer, do not release genetic information pertaining to an individual without the individual's prior written authorization, required for each disclosure and naming the person to whom the disclosure is made (Iowa Code 729.6(4)(a)(1)).
• If you are a health insurer, do not discriminate against an individual or a member of the individual's family on the basis of genetic information or genetic testing (729.6(4)(b)(1)).
• If you are a health insurer, do not consider a genetic propensity, susceptibility or carrier status a preexisting condition for limiting or excluding benefits, establishing rates or providing coverage (729.6(4)(b)(2)).
• If you are a health insurer, do not use genetic information or genetic testing for underwriting health insurance in the individual and group markets (729.6(4)(b)(3)).