The business landscape is constantly changing due to the introduction of new laws and regulations. This can be especially daunting for a financial services provider since ensuring compliance with all applicable rules and regulations is part of running a successful business. Recently, Iowa enacted a data privacy law that provides protection for consumers’ personal information when used by companies like banks, credit unions, or other similar institutions in conducting their operations. In this blog post, we will discuss what you need to know about Iowa’s Data Privacy Law so that your organization can stay in compliance and serve customers confidently without sacrificing safety or security.
Overview of Iowa’s Data Privacy Law – what it is and who it Applies to
On March 28, 2023, Iowa joined California, Colorado, Connecticut, Utah, and Virginia as the sixth state to approve a comprehensive consumer privacy law. On January 1, 2025, the Iowa Act Relating to Consumer Data Protection (“ICDPA”) will go into effect.
Iowa’s Data Privacy Law is a comprehensive piece of legislation that is focused on protecting consumers’ personal information when used by financial institutions. This law applies to any organization or company within the state of Iowa that collects, stores, or transmits customer data in their operations. The law requires organizations to take reasonable steps to protect customer information from unauthorized access, use, or disclosure. Examples of covered entities include banks, credit unions, mortgage companies, and other financial service providers.
Who Must Comply with the Iowa Data Protection Act?
Under the Iowa Data Protection Act, all organizations and companies that collect, store, or transmit consumer data must comply with its provisions. This includes any company doing business in the state of Iowa or offering services to customers located in the state of Iowa. The law also applies to third-party providers (such as vendors) who process customer data on behalf of a covered entity.
The Iowa legislation applies to anybody doing business in Iowa or producing products or services aimed at Iowa residents
- Control or process at least 100,000 Iowan consumers’ personal data.
- Make more than half of their revenue by selling the personal information of at least 25,000 Iowa residents.
Exemptions under Iowa privacy law
- non-profit organizations
- higher education institutions
- The state and its political subdivisions
- financial institutions subject to the Gramm-Leach-Bliley Act
- entities subject to the HIPAA (Health Insurance Portability and Accountability Act
What are the Key Provisions of Iowa’s Data Privacy Law?
The ICDPA has several key provisions that organizations must be mindful of in order to remain compliant with the law. These include:
• Requiring companies to notify customers about data collection, use, and disclosure practices;
• Establishing security measures to protect customer data;
• Limiting the use of customer data for marketing purposes;
• Prohibiting companies from selling customer data without explicit consent; and
• Requiring companies to provide customers with access to their personal information.
The ICDPA also provides consumers with certain rights, such as the right to opt out of having their personal information shared or sold and the right to access and correct their own data.
what types of data are protected under Iowa’s Data Privacy Law
The ICDPA protects a variety of types of consumer data, including:
• Customer’s Name, phone number, address, and email address
• credit card numbers, bank account numbers and other Financial information
• Social Security numbers and medical records and other Sensitive personal information
• Internet activity data such as browsing history, search terms, and IP addresses;
• Geolocation data from device location tracking;
• Biometric information such as fingerprints.
Requirements for proper data handling and storage by businesses
Organizations must take certain steps in order to comply with the ICDPA. Specifically, businesses must:
• Develop and follow a data privacy policy;
• Provide customers with clear and conspicuous notices about their data collection, use, and disclosure practices;
• Establish sufficient security measures to protect customer data from unauthorized access, use, or disclosure;
• Limit the use of customer data for marketing and advertising purposes;
• Give consumers access to their personal information and allow them to opt out of sharing or selling their data.
• Respond promptly to customer requests for access or correction of data; and
• Educate staff on the importance of data privacy and security.
Penalties for Non-Compliance with Iowa’s Data Privacy Law
Organizations that fail to comply with the ICDPA can be subject to fines and other penalties.The Iowa Attorney General is required to provide a 90-day notice to the applicable business to correct the alleged violation. Then the Iowa Attorney General may issue civil penalties of up to $7,500 per violation and may also seek damages on behalf of affected customers. Additionally, customers have the right to bring a private action against organizations for violations of the law. Companies can also be held liable for the actions of their third-party vendors if those vendors process customer data on behalf of a covered entity.
In order to ensure compliance with the ICDPA, organizations must develop and implement comprehensive data privacy policies and practices that protect customer information. Companies should regularly review their policies and procedures and update them as necessary
What are the rights of Iowa consumers?
Iowa consumers have the right to access and correct their personal information, as well as the right to opt out of having their data shared or sold by companies. Right to confirm processing and access personal data,Right to also delete personal data provided by the consumer ,Right to obtain a copy of the personal data provided by the consumer
Additionally, customers have the right to bring a private action against organizations for violations of ICDPA. Furthermore, if customers feel that their privacy rights were violated, they can contact the Iowa Attorney General’s office to file a complaint. The AG’s office will investigate the allegation and take appropriate action if necessary.
Definition of personal data under Iowa privacy law?
Iowa’s privacy law defines personal data as any information that identifies or contacts an individual. This includes name, address, phone number, email address, financial details like bank account or credit card numbers, Social Security number, medical records, internet activity such as browsing history and search queries, geolocation data, biometric information like fingerprints, and any other data that uniquely identifies a person.
Best practices for data privacy and security for Iowa businesses
Organizations that collect, use, or disclose personal data must ensure proper handling and storage of customer information. To do this, businesses should:
• Develop and follow a comprehensive data privacy policy;
• Provide clear and conspicuous notices about their data collection, use, and disclosure practices;
• Establish adequate security measures to protect customer data from unauthorized access, use, or disclosure;
• Limit the use of customer data for marketing and advertising purposes;
• Give consumers access to their personal information and allow them to opt out of sharing or selling their data.
• Respond promptly to customer requests for access or correction of data
• Educate staff on the importance of data privacy and security.
The ICDPA also requires organizations to notify customers and the Iowa Attorney General in the event of a data breach or unauthorized access to personal information. Companies must provide notice as soon as possible, regardless of whether or not customer data was actually compromised. Organizations should have clear procedures in place for how to respond to a data breach, including informing customers and the Iowa Attorney General within 72 hours of determining that a breach occurred.
Enhance Security Measures to Safeguard Customer Data
Further, companies should develop a remediation plan to address any issues caused by the breach. These plans should include steps such as deactivating compromised user accounts, resetting passwords, and providing additional security measures for customer data. Iowa businesses should also ensure that they have adequate insurance coverage to protect against potential financial losses related to a data breach. The ICDPA requires organizations to take reasonable steps to protect customer data and notify customers of any security incidents in a timely manner. By following best practices for data privacy and security, Iowa businesses can help ensure compliance with the ICDPA and p
