Tag: Iowa’s Data Privacy Law

Iowa Passes New Comprehensive Data Privacy Law March 27, 2023 In a unanimous decision between the Iowa House and Senate, Iowa has passed a comprehensive privacy law. Once the Governor signs it, Iowa will join five other states that have also passed comprehensive privacy laws. The data privacy law, if passed, will apply to the following companies: Companies that control or process data for at least 100,000 Iowa consumers Companies that control or process data for a minimum of 25,000 Iowa consumers and obtain half of their revenue from selling personal data Several states have laws that exempt data regulated by the Fair Credit Reporting Act (FCRA). As such, employers conducting background checks should familiarize themselves with these states: Colorado, Virginia, Utah, California, Connecticut, and Iowa. Furthermore, the Iowa Privacy Law provides some exemptions. For example, it does not apply to entities covered by the Health Insurance Portability and Accountability Act (HIPAA). It also exempts HIPAA-protected health information, financial institutions regulated by the Gramm-Leach-Bliley Act (GLBA), non-profit organizations, or higher education institutions. Other examples include the Family Educational Rights and Privacy Act (FERPA) data. Like other data privacy laws, Iowa's Data Privacy Law tasks controllers and processors of personal data with certain requirements. For example, controllers decide the purpose of processing and how to process personal data. Processors will process the personal data while acting for controllers. Additionally, the law provides consumers and data subjects with rights. These rights include: Confirming if the personal data will process and the right to access this data Deleting personal data that the consumer has provided Acquiring a copy of the consumer-provided personal data has undergone automated processing. This example excludes data defined as "personal information" under Iowa's data breach notification law Opting out of having personal data sold to third parties Opting out of targeted advertising Controllers also have to give consumers a privacy notice that indicates the following: Which categories of personal data will undergo processing The reasons for the processing The process by which consumers can exercise their data privacy rights If the controller shares personal data with third parties Iowa's law differs from the data privacy laws in other states. For example, it does not give consumers the right to correct inaccurate information in their personal data. Instead, the law mandates that controllers and processors implement an agreement regarding the scope of the services the processor provides at the controller's instruction. Iowa's Data Privacy Law does not create a private right of action. However, once a 90-day cure has passed, the Iowa Attorney General can issue injunctions and civil penalties. These penalties may be as much as $7,500 for each violation not cured within the period. If the Governor signs the law, it will take effect on January 1, 2025. If this law passes, some companies may need to check their policies to remain compliant. However, it should not affect how companies conduct background checks due to the exemption for data regulated by the FCRA. Nevertheless, the best way for companies to ensure that their background checks comply with all applicable laws is to partner with a background check company they can trust. The right provider will help them conduct thorough background screenings that comply with the law. Keep your business up to date on new laws and regulations with Pre-employ’s free news resources. Contact a sales rep today. Source

Tag: Iowa’s Data Privacy Law

Iowa Passes New Comprehensive Data Privacy Law

Our Process

Our Platform

Screenings

For Your Industry

For Your Role

Webinar

Resources Library

Logins

E-Book

Services

Industry

Resources

Our Company