There is no question that online security and the theft of data is an increasingly complex problem for everyone whether it is law enforcement, companies, or individual consumers. The issues of lost data, identity theft, and straight-up invasion of privacy seem to grow exponentially daily. Due to this growth, it is not just the expected law enforcement agencies such as the FBI, your local police, and sheriff’s department evaluating these claims but agencies including the Federal Trade Commission (FTC).

FTC Litigation

For example, in February 2023, the FTC entered into a consent agreement with Good Rx which resulted in a $1.5 million civil penalty. In essence, Good Rx, despite assertions in its user agreement and privacy policies that data was confidential, was either aggregating data or allowing others to aggregate data for targeted advertising. This ran afoul of specialty regulations at the FTC regarding healthcare-adjacent entities utilizing medical information as part of their business process.

In March 2023, Better Help, a telehealth mental health service provider entered into a consent agreement with the FTC for $7.8 million which included partial refunds to many of its patients/customers. Better Help was alleged by the FTC to have engaged in the same types of practices as Good Rx but once issues came to light through investigative journalism, Better Help doubled down on its privacy practices claiming that they were not aggregating or selling advertising outside the scope of their existing policies. The FTC disagreed.

We also have examples from a couple of years ago where an online social media and social networking service was alleged to have sold information relating to 87 million people to data analytics companies, again, to target advertising more appropriately. That claim was ultimately settled for $725 million. 

New Iowa Privacy Law

Recognizing that the landscape is rapidly changing, the Iowa legislature passed changes to Iowa Code 715D to address these concerns. The changes are encompassed in Senate File 262, which was signed by the Governor on March 28, 2023, with an effective date of January 1, 2025. With this law, Iowa joins California, Colorado, Connecticut, Utah, and Virginia in working to broadly protect consumer data. 

Because of the 2025 applicability date, companies have time to review, streamline, and implement appropriate processes to address the issues that are raised by these changes as specifically set forth beginning at 715D.1. Note that these changes continue to incorporate various exemptions, specifically for those records which are protected by other more specific statutes such as HIPAA/HITECH or FERPA. 

Protected Data

In discussing the type of data to be protected, the statute provides a fairly comprehensive discussion of “sensitive data” which includes “racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status.” There are some limitations to this concerning data that is used “to avoid discrimination on the basis of a protected class that would violate a federal or state antidiscrimination law.” In other words, it won’t apply to an EEO-1.

The statute also specifically references biometric data as being sensitive as well as any data collected from a child. The statute under 715D.2 applies to a person or business conducting business within the state that is “targeted to consumers who are residents of the state” and either controls or processes personal data of 100,000 consumers or more or controls or processes personal data of 25,000 consumers or more and derives over fifty percent of its gross revenue from the sale of personal data.

New requirements, as previously noted, do not apply to certain entities which have alternative, federal privacy and security rules such as financial institutions, covered entities under HIPAA/HITECH, those covered by the Federal Farm Credit Act, nonprofit organizations, and educational institutions which are otherwise covered by FERPA. 

Consumer Rights

New Section 715D.3 provides substantive new consumer data rights for any information which does not fit within the fairly broad and encompassing carveouts as noted above. The consumer has the right to submit a notice to the company through its “controller” as defined in the statute to invoke their consumer rights. A child’s parent or legal guardian may also invoke such consumer rights on behalf of the child. 

Consumer rights include the following: 

• Confirming if the company is processing the consumer’s personal data.
• Deleting personal data provided by the consumer.
• Obtaining a copy of the consumer’s personal data being held or maintained by the company.
• To opt out of the sale of personal data. 

The company, through its controller, is required to respond promptly to the consumer, usually within 90 days or sooner. The response period, not unlike HIPAA, may be extended for 45 additional days if reasonably necessary but the company must inform the consumer of the extension within the initial 90-day period and also provide the business reasoning for the need for the extension.

The company may decline to act but must provide prompt information to the consumer about why action has not been taken. If the company believes that information fits within one of the exceptions, such as it is HIPAA-protected data or protected by FERPA, those reasons must be clearly stated in the denial. Note that the company is required to have a process by which the consumer can appeal any decision not to provide information. Failure to provide such a process is likely to be considered a violation of the statute. It is incumbent upon companies to determine how processes will be advertised but one methodology typically used by healthcare providers is to provide a notice of privacy practices and basic policy requirements on their website as well as post such policies. 

Information production can be expensive. The statute further includes that “information provided in response to a consumer request shall be provided by controller free of charge, up to twice annually per consumer.” Reasonable fees may be charged in alternative circumstances if the requests are “manifestly unfounded, excessive, repetitive…” and for certain other limited purposes.  The burden of showing that something should not be produced or that a fee shall be charged rests with the company.

Notice

As we frequently say with HIPAA, this rule is a rule of notice. Consumers must know what type of data is being collected, how it is being stored and secured, and how it is being used. The statute, in Section 715D.4(2), specifically states: “A controller shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and opportunity to opt out of such processing...” Further noted in subsection (3) is that a company may not retaliate against a consumer for exercising any of the rights contained in the statute.

Additionally, in assessing what would be required in a privacy notice companies must include:  

• Categories of personal data processed
• Purpose of processing the data
• How consumers may exercise their rights including how they may appeal any denial
• The categories of data that are shared with third parties
• The types of third parties with whom data may be shared

Note that Section 715D.5 encompasses what the statute terms “processors” which are the equivalent of HIPAA subcontractors. In other words, if you are a company and you subcontract out your data for projects that company, is also liable under the statute for misuse. Like HIPAA, the company and the “processor” must enter into an agreement regarding the processors' procedures which is likely to mirror the business associate agreements we see with HIPAA.

Finally, this law is to be enforced by the Iowa Attorney General’s Office and the statute notes that the Attorney General has “exclusive authority” to enforce the provisions of the chapter. There appears to be no private right of action.

The Big Picture

The new statute is complex but draws upon well-established legal principles in HIPAA/HITECH, FERPA, the Red Flag Rules and FTC regulations, and similar statutes which were federally promulgated to protect the privacy and security of consumer data. Because this can be a complex process if the company has not already been through privacy and security auditing, companies should start early in identifying systems, the nature, and type of data as well as identifying a privacy and security committee or officers to ensure a clear line of authority when it comes to making policy and practical decisions. Policies and training will be critical to show good faith compliance. A significant number of resources are available, primarily targeted to HIPAA, for companies to do internal information audits and engage in similar activities. Many of these were formulated by the Office of the National Coordinator for healthcare entities and can be found at healthit.gov.