Iowa Code § 715C

Enacted:  5.10.2008

Type of Data Covered: Any form of data. 

​

Is Breach Defined?

“Breach of security” means unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information. “Breach of security” also means unauthorized acquisition of personal information maintained by a person in any medium, including on paper, that was transferred by the person to that medium from computerized form and that compromises the security, confidentiality, or integrity of the personal information. 

​

​

When is notice required?

​

Notice is required for all Iowa residents affected by the breach. "The consumer notification shall be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection 3, and consistent with any measures necessary to sufficiently determine contact information for the affected consumers, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data." Written, electronic, and substitute notice are all acceptable depending on the circumstances. The notice must include a description of the breach, the approximate date it occurred, the type of information affected, contact information for consumer reporting agencies, and advice on how to deal with the situation. Notice must be given to the Attorney General within 5 days of notice being delivered to over 500 residents.

​

What are the penalties for non-compliance?

​

Violations have their own section of the law, § 715C.2(9), which reads as follows: 

​

• a.  A violation of this chapter is an unlawful practice pursuant to section 714.16 and, in addition to the remedies provided to the attorney general pursuant to section 714.16, subsection 7, the attorney general may seek and obtain an order that a party held to violate this section pay damages to the attorney general on behalf of a person injured by the violation.

• b.  The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under the law.

​

​