On March 15th, the Iowa legislature passed S.F. 262 (the “ICDPA”), making it the sixth U.S. state to pass a comprehensive state privacy statute.  The Iowa statute most closely resembles the Utah Consumer Privacy Act (“UCPA”), though it also shares some similarities with the approaches adopted in Virginia, Colorado, and Connecticut.  The statute will next go to the governor’s desk for signature.  If signed into law, the ICDPA would take effect on January 1, 2025.

This blog post summarizes a few key takeaways in the statute:

  • Scope:  The ICDPA would apply to controllers and processors that conduct business in Iowa or produce products or services targeted to Iowa consumers and during the last calendar either: (1) control or process the personal data of at least 100,000 consumers, or (2) control or process personal data of at least 25,000 Iowa consumers and derive over 50% of its gross annual revenue from the sale of personal data.
  • Consumer Rights:  The ICDPA provides consumers with rights to: (1) confirm whether a controller is processing their personal data; (2) access their personal data; (3) delete personal data provided by the consumer; and (4) obtain a portable copy of the consumer’s personal data (subject to certain exceptions).  If controllers engage in sales to third parties or targeted advertising, the statute requires that they provide clear and conspicuous notice of the activity and the manner in which the consumer can exercise the right to opt-out of such activity.
  • Sensitive Data:  Like the UCPA, the ICDPA requires controllers to provide consumers notice of processing of sensitive personal data and an opportunity to opt-out of such processing.  Sensitive data is defined as racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, except to the extent such data is used to avoid discrimination; genetic or biometric data; personal data collected from a known child; and precise geolocation data (i.e., identifies a consumer within a radius of 1,750 ft.).
  • Controller & Processor Contracts:  The ICDPA uses the terms “controller” and processor,” similar to statutes like the UCPA.  Processors must assist controllers in meeting their obligations, including related to consumer rights requests.  The ICDPA states that certain terms must be in contractual terms between controllers and processors, including requiring the processor to delete all personal data at the conclusion of services.
  • Enforcement & Cure:  The Iowa Attorney General would have exclusive enforcement authority.  Additionally, the statute provides a 90-day cure period to resolve any deficiency, which will not sunset.
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.

Photo of Jorge Ortiz Jorge Ortiz

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related…

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related to privacy policies and compliance obligations under U.S. state privacy regulations like the California Consumer Privacy Act.