On March 15th, the Iowa legislature passed S.F. 262 (the “ICDPA”), making it the sixth U.S. state to pass a comprehensive state privacy statute.  The Iowa statute most closely resembles the Utah Consumer Privacy Act (“UCPA”), though it also shares some similarities with the approaches adopted in Virginia, Colorado, and Connecticut.  The statute will next go to the governor’s desk for signature.  If signed into law, the ICDPA would take effect on January 1, 2025.

This blog post summarizes a few key takeaways in the statute:

• Scope:  The ICDPA would apply to controllers and processors that conduct business in Iowa or produce products or services targeted to Iowa consumers and during the last calendar either: (1) control or process the personal data of at least 100,000 consumers, or (2) control or process personal data of at least 25,000 Iowa consumers and derive over 50% of its gross annual revenue from the sale of personal data.

• Consumer Rights:  The ICDPA provides consumers with rights to: (1) confirm whether a controller is processing their personal data; (2) access their personal data; (3) delete personal data provided by the consumer; and (4) obtain a portable copy of the consumer’s personal data (subject to certain exceptions).  If controllers engage in sales to third parties or targeted advertising, the statute requires that they provide clear and conspicuous notice of the activity and the manner in which the consumer can exercise the right to opt-out of such activity.

• Sensitive Data:  Like the UCPA, the ICDPA requires controllers to provide consumers notice of processing of sensitive personal data and an opportunity to opt-out of such processing.  Sensitive data is defined as racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, except to the extent such data is used to avoid discrimination; genetic or biometric data; personal data collected from a known child; and precise geolocation data (i.e., identifies a consumer within a radius of 1,750 ft.).

• Controller & Processor Contracts:  The ICDPA uses the terms “controller” and processor,” similar to statutes like the UCPA.  Processors must assist controllers in meeting their obligations, including related to consumer rights requests.  The ICDPA states that certain terms must be in contractual terms between controllers and processors, including requiring the processor to delete all personal data at the conclusion of services.

• Enforcement & Cure:  The Iowa Attorney General would have exclusive enforcement authority.  Additionally, the statute provides a 90-day cure period to resolve any deficiency, which will not sunset.