CLS Blue Sky Blog

Latham & Watkins Discusses Growing Number of State Data Privacy Laws

On March 28, 2023, Iowa became the sixth US state to pass a comprehensive privacy law. The Iowa data privacy law (SF 262) (Iowa Privacy Law) was passed unanimously by the state House and Senate, and signed by Governor Kim Reynolds.

The Iowa Privacy Law imposes requirements similar to those already required by other state privacy laws—most notably, Utah. The key task for companies subject to the law will be to ensure that their existing measures cover personal data collected about Iowa residents, for example, by extending their privacy notices, contracts, and user rights mechanisms to include Iowa consumer personal data.

The Iowa Privacy Law will come into force on January 1, 2025. The law applies to companies that do business in Iowa or target products or services to Iowa consumers and, during a calendar year, either:

Comparison With Other State Privacy Laws

Similar to the other state privacy laws, the Iowa Privacy Law can apply to companies even if they have no physical presence in Iowa, and will be enforced by Iowa’s attorney general. Like the other state privacy laws (with the limited exception of California), the Iowa Privacy Law has no private cause of action.

Despite notable similarities with other state privacy laws, particularly the Utah Consumer Privacy Act, the Iowa Privacy Law bears important distinctions from other states.

These contrasting provisions will likely be a source of confusion, and businesses that already offer the ability to opt out of targeted advertising in the other states may choose to play it safe and extend that opt-out right to Iowa consumers.

Takeaways

The Iowa Privacy Law adds to the patchwork of US state comprehensive privacy law requirements that companies must comply with, and businesses will need to make updates to cover Iowa in their privacy notices, contracts, and user rights mechanisms. Though there are many similarities to the five other laws, passage of the Iowa Privacy Law underscores the need for companies to closely review and consider the differences across the now six comprehensive US state privacy laws. With over 15 other states currently considering similar comprehensive privacy statutes, the US privacy environment is likely to continue to grow in complexity.

This post comes to us from Latham & Watkins LLP. It is based on the firm’s blogpost, “And Now There Are Six: Iowa Passes New Privacy Law,” dated April 3, 2023, and available here. 

Exit mobile version