Duty LXD-1119
Processes de-identified data, in Iowa
Insurance privacy rules, definitions of personally identifiable financial information and nonpublic personal health informationsince 2 lines
Iowa Admin. Code r. 191-90.2 · Read the law's page
- As an insurance licensee, treat information as outside personally identifiable financial information only if it does not identify a consumer, such as aggregate information or blind data that contains no personal identifiers like account numbers, names and addresses (Iowa Admin. Code 191-90.2).
- As an insurance licensee, treat health information that identifies an individual, or that you have a reasonable basis to believe could be used to identify an individual, as nonpublic personal health information (Iowa Admin. Code 191-90.2).
Iowa Consumer Data Protection Act, de-identified, aggregate and pseudonymous datasince 3 lines
Iowa Code ยงยง 715D.1(2), (10), (18), (23), 715D.6 · Read the law's page
- Do not treat data as de-identified or aggregate, and so outside personal data, unless it cannot reasonably be linked to an identified or identifiable natural person, or relates to a group or category of consumers with individual identities removed and is not linked or reasonably linkable to any consumer (Iowa Code 715D.1(2), (10), (18)).
- To rely on the pseudonymous data exemption from the consumer rights in sections 715D.3 and 715D.4, be able to demonstrate that the information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures (Iowa Code 715D.6(3)).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (Iowa Code 715D.6(4)).