Iowa Data Privacy Law Makes Progress

On January 23, House Study Bill 12 (“HSB 12”) passed a three-member subcommittee of the Iowa House of Representatives’ Economic Growth and Technology Committee.  Last year, a version of HSB 12 passed through the Iowa House but failed in the Iowa Senate.  HSB 12 is similar to the business-friendly Utah Consumer Privacy Act, and would apply to entities conducting business in the state or offering products or services that are targeted to residents of the state, that do either of the following within a calendar year:

• control or process personal data of at least 100,000 consumers; or
• control or process personal data of at least 25,000 consumers and derive 50% of gross revenue from the sale of personal data.

In terms of consumer data rights, the bill would grant Iowa residents the right to access, obtain a copy of, and request the deletion of personal data, as well as to opt-out of the processing of personal data for purposes of targeted advertising.  Additionally, the bill would provide for certain duties of data controllers, including:

• limiting the collection of personal data to what is adequate and reasonably necessary;
• implementing technical and organizational measures to protect personal data; and
• not processing a consumer’s sensitive personal information without the consumer’s consent.

Furthermore, the bill would also mandate data processor duties, including assisting the data controller in their duties, fulfilling the controller’s obligations to respond to requests to exercise consumer rights, and meeting the controller’s obligations with respect to the security of processing personal data and the notification of a security breach.

On January 23, 2023, lawmakers introduced a companion senate bill – Senate Study Bill 1071. On January 31, 2023, a subcommittee recommended amendment and passage of the senate bill.

We will continue to monitor these bills to see if a unified bill is able to pass both chambers.