Law / United States / 
Iowa
Iowa Consumer Data Protection Act (ICDPA), publicly available information exemption
Iowa Code ch. 715D (Senate File 262, 2023)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Personal data that is lawfully made available through a government record, or that a consumer or widely distributed media has lawfully made available to the public without the consumer restricting it to a specific audience, falls outside the ICDPA's definition of personal data.
- Information a consumer has restricted to a specific audience is not publicly available information, so collecting it is not covered by the exclusion.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When a consumer limits a post to followers or a closed group, has the consumer "restricted the information to a specific audience" under Iowa Code section 715D.1(24), and does a large audience still count as specific?
- Does a business have a "reasonable basis to believe" that information is "lawfully made available to the general public" under Iowa Code section 715D.1(24) when the site it was collected from forbids automated collection?
What it makes you log
Who may demand the log
Counterparty
Logging duty
The chapter requires no data protection assessment and names no log. Both clauses require a party to be able to demonstrate compliance, which cannot be shown without records. The processor's information runs to the controller under the contract, and no section of the chapter has a regulator, an auditor or a schedule check the record.
- Kind
- Implicit
- As of
- Provision
- Iowa Code § 715D.6(2)(c): the controller-processor contract must require the processor, on the controller's reasonable request, to make available all information in its possession necessary to demonstrate its compliance with the chapter; § 715D.8(7): a controller that processes under an exemption bears the burden of demonstrating that the processing qualifies and complies
- Trigger
- personal_data_processing
What this law does
Section 715D.1(18) defines personal data to exclude de-identified or aggregate data and publicly available information, and section 715D.1(24) defines publicly available information as information that is lawfully made available through federal, state, or local government records, or information that a business has reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.
The exclusion is built into the definition of personal data itself, so personal data lawfully made available through government records or widely distributed media falls outside the Act's scope by definition. The Act applies to persons conducting business in Iowa or targeting Iowa residents who, during a calendar year, control or process the personal data of at least 100,000 consumers, with a second, lower-threshold prong for entities deriving a substantial share of revenue from data sales.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .