Iowa Consumer Data Protection Act (Iowa CDPA): A Brief Overview

Brief Background

The Iowa CDPA is a data privacy law signed by the Governor of Iowa, set to take effect on January 1, 2025. This law aims to protect the personal data of Iowa consumers and impose civil penalties on entities that fail to comply with its requirements. The Iowa CDPA follows in the footsteps of other state data privacy laws but introduces unique elements tailored to the needs and context of Iowa residents.

For more detailed information, you can view and/or download the PDF here.

Key Terms & Definitions

Understanding the terminology used in the Iowa CDPA is crucial for compliance. Here are some of the key terms as defined in the law:

• • A. Consent: A clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.
  • B. Consumer: A natural person who is a resident of Iowa, acting in an individual or household context.
  • C. Controller: A person or entity that determines the purposes and means of processing personal data, either alone or jointly with others.
  • D. Personal Data: Information linked or reasonably linkable to an identified or identifiable natural person, excluding de-identified, aggregate, or publicly available information.
  • E. Processing: Any operation performed on personal data, whether by manual or automated means, such as collection, use, storage, disclosure, analysis, deletion, or modification.
  • F. Processor: A person or entity that processes personal data on behalf of a controller.
  • G. Sale of Data: The exchange of personal data for monetary consideration by the controller to a third party.
  • H. Sensitive Data: Includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, data from known children, and precise geolocation.

Scope & Applicability

The Iowa CDPA applies to entities that conduct business in Iowa or produce products or services targeting Iowa consumers. Specifically, a business falls within the scope of the Iowa CDPA if it:

• • a. Controls or processes the personal data of at least 100,000 Iowa consumers during a calendar year.
  • b. Controls or processes the personal data of at least 25,000 Iowa consumers and derives over 50% of gross revenue from the sale of personal data.

Notably, there is no revenue threshold for general applicability, unlike some other state laws such as California’s. The law applies to businesses of any size that meet the data processing thresholds.

Exemptions:

Certain entities and data types are exempt from the Iowa CDPA, including:

• • a. Government Entities: State or local governmental units.
  • b. Financial Institutions: Entities subject to the Gramm-Leach-Bliley Act.
  • c. Healthcare Entities: Entities covered by HIPAA and HITECH.
  • d. Nonprofit Organizations.
  • e. Higher Education Institutions.
  • f. Federally Regulated Data: Data covered by laws such as COPPA, FERPA, and the Driver’s Privacy Protection Act.

Consumer Rights

The Iowa CDPA grants consumers several rights regarding their personal data:

• Right to Access: Consumers can confirm whether a controller is processing their personal data and access that data.
• Right to Delete: Consumers can request the deletion of personal data they provided to a controller.
• Right to Data Portability: Consumers can obtain a portable copy of the personal data they provided to a controller.
• Right to Opt-Out: Consumers can opt out of the sale of their personal data, targeted advertising, and the processing of sensitive personal information.

Controllers must respond to consumer requests within 90 days, with the possibility of a 45-day extension if necessary.

Business Obligations

Businesses subject to the Iowa CDPA must adhere to several key obligations:

1. Data Security: Implement reasonable administrative, technical, and physical data security practices.
2. Purpose Limitation: Ensure that personal data collection is adequate, relevant, and limited to what is necessary for the specified purposes.
3. Consent Requirements: Obtain clear and affirmative consent for processing personal data, especially sensitive data.
4. Non-Discrimination: Do not discriminate against consumers for exercising their rights.
5. Transparency: Provide a clear and accessible privacy notice detailing the categories of personal data processed, purposes of processing, consumer rights, and data sharing practices.

Data Processing Contracts

Controllers must establish contracts with processors that specify processing instructions, the nature and purpose of processing, the type of data involved, the duration of processing, and the rights and duties of both parties. These contracts must also outline processes for retention, deletion, access, and subcontractor accountability.

Impact on Businesses

Businesses must take several steps to comply with the Iowa CDPA:

• • a. Update Privacy Policies: Ensure privacy policies meet all Iowa CDPA requirements, including detailed disclosures about data processing and consumer rights.
  • b. Implement Consent Management: Use a Consent Management Platform (CMP) to manage user consent for data processing activities.
  • c. Data Subject Access Request (DSAR) Form: Provide an easy way for consumers to submit requests to exercise their rights.
  • d. Draft Data Processing Agreements (DPA): Ensure all third-party processors comply with the Iowa CDPA through comprehensive DPAs.

Enforcement & Penalties

The Iowa Attorney General (AG) has exclusive authority to enforce the Iowa CDPA. Upon identifying a violation, the AG will provide a 90-day written notice to the offending entity, which must cure the violation within this period. Failure to do so may result in fines of up to $7,500 per violation. Collected fines will contribute to the consumer education and litigation fund.

Compliance Preparation

To ensure compliance with the Iowa CDPA, businesses should:

• • Audit Data Practices: Conduct thorough audits of data collection, processing, and storage practices.
  • Train Employees: Educate employees on data privacy principles and Iowa CDPA requirements.
  • Enhance Security Measures: Implement robust security protocols to protect personal data.
  • Review Contracts: Update contracts with third-party processors to ensure compliance.
  • Develop a Response Plan: Create a plan for responding to consumer data requests and potential data breaches.

Frequently Asked Questions (FAQs)

1. When does the Iowa CDPA go into effect?
   The Iowa CDPA will go into effect on January 1, 2025.
2. What businesses are subject to the Iowa CDPA?
   The Iowa CDPA applies to businesses that either control or process the personal data of at least 100,000 Iowa consumers or control/process the personal data of at least 25,000 Iowa consumers and derive over 50% of their gross revenue from the sale of personal data.
3. What rights do consumers have under the Iowa CDPA?
   Consumers have the right to access their data, request deletion of their data, obtain a copy of their data in a portable format, and opt-out of the sale of their data, targeted advertising, and processing of sensitive data.
4. How should businesses prepare for the Iowa CDPA?
   Businesses should audit their data practices, update privacy policies, implement consent management systems, draft comprehensive data processing agreements, and train employees on data privacy principles.
5. What are the penalties for non-compliance with the Iowa CDPA?
   Businesses that fail to comply may face fines of up to $7,500 per violation, imposed by the Iowa Attorney General.
6. Are there any exemptions to the Iowa CDPA?
   Yes, government entities, financial institutions, healthcare entities, nonprofit organizations, higher education institutions, and certain federally regulated data are exempt.

Wrapping Up

The Iowa Consumer Data Protection Act is a significant piece of legislation that underscores the importance of data privacy in the digital age. As more states adopt their own data privacy laws, businesses must stay vigilant and proactive in their compliance efforts. Understanding the requirements of the Iowa CDPA and taking the necessary steps to align your data practices with the law will not only help avoid penalties but also build trust with your consumers. By prioritizing data privacy, businesses can foster a secure and transparent environment that benefits both themselves and their customers. As the January 1, 2025, implementation date approaches, it’s crucial for businesses to start preparing now to ensure a seamless transition to compliance.