US state Iowa passes new Data Privacy law

Iowa has become the sixth state in the US to pass a comprehensive data privacy law, which applies to companies that control or process data of at least 100,000 Iowa consumers, or control or process data of at least 25,000 Iowa consumers and derive 50% of their revenue from the sale of personal data. The law establishes rights for consumers, including the right to access and delete personal data, opt out of the sale of personal data, and obtain a copy of personal data. The law also assigns specific requirements to controllers and processors of personal data and requires a privacy notice for consumers. The law does not create a private right of action but permits consumers to report violations to the Iowa Attorney General, who may seek injunctive relief and levy a civil penalty of up to $7,500 per violation. The law is expected to take effect on January 1, 2025.