Law / United States / 
Iowa
Iowa Consumer Data Protection Act, de-identified, aggregate and pseudonymous data
Iowa Code §§ 715D.1(2), (10), (18), (23), 715D.6
In force since .
A de-identification rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not treat data as de-identified or aggregate, and so outside personal data, unless it cannot reasonably be linked to an identified or identifiable natural person, or relates to a group or category of consumers with individual identities removed and is not linked or reasonably linkable to any consumer (Iowa Code 715D.1(2), (10), (18)).
- To rely on the pseudonymous data exemption from the consumer rights in sections 715D.3 and 715D.4, be able to demonstrate that the information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures (Iowa Code 715D.6(3)).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of those commitments (Iowa Code 715D.6(4)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 715D.6(4) requires a controller that discloses pseudonymous or de-identified data to exercise reasonable oversight of the contractual commitments attached to it. The section names no log or record, so the row takes no logging duty.
- Kind
- None
- As of
What this law does
ICDPA defines de-identified data as data that cannot reasonably be linked to an identified or identifiable natural person (section 715D.1(10)). It defines aggregate data as information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer (section 715D.1(2)). Personal data does not include de-identified or aggregate data or publicly available information (section 715D.1(18)).
Pseudonymous data is personal data that cannot be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures (section 715D.1(23)). Section 715D.6(1) provides that nothing in the chapter requires a controller or processor to re-identify de-identified data or pseudonymous data.
Under section 715D.6(3), the consumer rights in sections 715D.3 and 715D.4 do not apply to pseudonymous data where the controller is able to demonstrate that the information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures.
Under section 715D.6(4), a controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and must take appropriate steps to address any breaches of those commitments.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .