On March 29, 2023, Iowa Gov. Kim Reynolds signed into law Senate File 262, the Iowa Act Relating to Consumer Data Protection (ICDPA). Taking effect nearly two years from now on January 1, 2025, the ICDPA makes Iowa the sixth state to enact a comprehensive data privacy law. In many ways, the new law parallels the Utah Consumer Privacy Act (UCPA) and the Virginia Consumer Data Protection Act (VCDPA), which are generally considered more business-friendly and less restrictive than the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA) and the California Consumer Privacy Act (CCPA) (as amended by the California Privacy Rights Act (CPRA)).

Key Provisions

• Consumer Opt Out for Sale of Data – consumers have a right to opt out of processing for the sale of personal data or for use in targeted advertisements, much like under the VCDPA and CPA.
• No Right to Opt Out of Profiling – unlike the VCDPA and CPA, consumers do not have a right to opt out of profiling.¹
• Service Provider Contracts – controllers are required to establish contracts with processors establishing the instructions and obligations for the respective parties around the data processing. Like the VCDPA and CPA, controllers may request that processors delete or return personal data.
• Sensitive Data Processing Requirements – like the UCPA, data controllers must provide consumers with notice and an opportunity to opt out before processing sensitive data.
• 90-Day Cure Period – the ICDPA provides a...

Read Full Story: https://news.google.com/rss/articles/CBMiYWh0dHBzOi8vd3d3LmFraW5ndW1wLmNvbS9l...