Iowa Senate OKs bill giving consumers more control over their personal data online

DES MOINES — A bill giving Iowans more control over their personal data online is one step closer to law after passing in the Senate on Monday.

The Iowa Senate on Monday unanimously passed Senate File 262. If signed into law, Iowa would be the sixth state in the U.S. to establish data privacy rights.

Sen. Chris Cournoyer, R-LeClaire, who chairs the Senate Technology Committee, said the bill is designed to increase protections for Iowa consumers in the absence of a federal law that regulates how companies can collect data.

“While I expect this may eventually be preempted by federal legislation, I would also expect that what we pass here will influence what Congress does in the future and used as a potential model,” Cournoyer said.

The bill requires companies that control the personal data of at least 100,000 Iowans — or 25,000 when half of their revenue comes from selling data — to notify consumers of their data collection practices and provide them with the data upon request.

Under the bill, consumers would be able to request a company to provide a copy of their personal data or delete the data collected on them.

Companies also would need to notify users about the type of personal data they collect, what they use the data for and whether they share the data with third parties. If a company sells data or uses targeted advertising, it would be required to disclose that and allow users to opt out.

It includes a raft of exemptions, including data related to health records and information collected for research.

The bill is modeled after laws passed in states like Virginia and Utah that impose similar requirements on companies collecting consumer data. California, Colorado and Connecticut have similar data protection laws.

The bill was supported by the Technology Association of Iowa, which represents technology-based companies in the state. Mollie Ross, the group’s vice president of operations, said the measure would give Iowans control over their data and provide consistency for companies that operate in the state.

“This is a big step forward in granting (Iowans) some rights for their data,” she said. “And also from an industry perspective, it lays some guidelines, sets up groundwork so that everybody is playing within the same boundaries.”

As the bill has made its way through the legislative process, lawmakers and representatives for technology companies said they would prefer to see data privacy measures enacted at the federal level, but the bill is an attempt to set out parameters until a nationwide law is passed.

“This may be used as a format the federal government could take on, but at least getting it passed here in the state would be a good first step,” Ross said.

The attorney general would have exclusive jurisdiction over enforcing the provisions of the bill. The requirements would take effect in 2025, which Ross said would give companies enough time to adjust to the requirements.

House File 346, a companion bill, advanced out of a committee last month but has yet to be passed by the House.