This bill amends Iowa's consumer data protection laws, primarily by redefining the term "child" to include individuals younger than 18 years of age instead of the previous threshold of 13. It also expands the definition of "health record" to encompass not only health-related information but also associated non-health information provided in confidence to healthcare providers. Additionally, the bill introduces new definitions for "health data," which pertains to an individual's health status, and "profiling," which involves automated processing of personal data to evaluate various factors related to an individual.

Furthermore, the bill clarifies that the consumer data protection chapter does not apply to certain entities, including state and local governments, financial institutions, and organizations compliant with specific federal health regulations, except in relation to health data. It allows consumers the right to be notified of or opt out of profiling that significantly affects them, with requirements for clear communication regarding the data involved. The bill also includes provisions for retroactive applicability, effective from January 1, 2025.

Statutes affected:
Introduced: 715D.1, 715D.2, 715D.3