Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Iowa recently joined an increasing number of states that require notification of state regulatory authorities following a breach, as well as a handful of states in which paper records can trigger notification obligations.  On April 3, 2014, Iowa Governor Terry Branstad signed <a href="http://coolice.legis.iowa.gov/linc/85/external/govbills/SF2259.pdf">S.F. 2259</a> into law, amending Iowa’s Personal Information Security Breach Protection statute (<a href="http://coolice.legis.iowa.gov/cool-ice/default.asp?category=billinfo&amp;service=iowacode&amp;ga=83&amp;input=715C">Iowa Code §§ 715C.1–715C.2</a>) to require that written notice be provided to the director of the consumer protection division of the office of the Iowa Attorney General regarding a breach of security affecting 500 or more Iowa residents no later than five business days after providing notice of the breach to any affected Iowa residents under the statute.  S.F. 2259 also expands the scope of the statute’s definition of the term “breach of security” to include unauthorized acquisition of personal information “maintained by a person in any medium, including on paper, that was transferred by the person to that medium from computerized form.”  Further, S.F. 2259 clarifies that “personal information” includes information that is encrypted, redacted, or otherwise altered such that it is unreadable if the keys to unencrypt, unredact, or otherwise read the information have also been obtained through a breach of security, and specifies that an individual’s financial account number, credit card number, or debit card number in combination with a required “expiration date” or other password or security code that would permit access to an individual’s financial account can qualify as personal information capable of triggering notification obligations.

These changes take effect July 1, 2014.

For additional information regarding data breach notification statutes enacted in the United States and worldwide, please refer to BakerHostetler’s <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/State_Data_Breach_Statute_Form.pdf">State-by-State Survey of Data Breach Notification Laws</a&gt;; <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf">Key Issues in State Data Breach Notification Laws</a&gt;; and <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/International-Compendium-of-Data-Privacy-Laws.pdf">International Compendium of Data Privacy Laws</a>, all of which are available at <a href="http://www.dataprivacymonitor.com">www.dataprivacymonitor.com</a>.

Iowa Breach Notification Law Now Requires AG Notification, Applies to Paper Records