This bill amends Iowa's consumer data protection laws, specifically updating the definition of "child" from under thirteen to under eighteen years of age. It introduces new definitions for terms such as "health data," which pertains to an individual's health status, and "profiling," which involves automated processing of personal data to evaluate various factors related to an individual. Additionally, the bill expands the definition of "health record" to include nonhealth information related to health information provided to healthcare providers in confidence.

The bill also outlines exemptions from the consumer data protection chapter, particularly concerning health data, and specifies that public health authorities can maintain data with consumer consent. It establishes consumer rights regarding profiling, requiring clear notifications about data usage and the option to opt out. The bill is retroactively applicable to January 1, 2025, ensuring that the new provisions are enforceable from that date.

Statutes affected:
Introduced: 715D.1, 715D.2, 715D.3