Effective January 1, 2025:  Businesses that operate as controllers of personal data are required to provide consumers with a “reasonably accessible, clear, and meaningful privacy notice” that includes the following:

• The categories of personal data processed by the controller.
• The purpose for processing personal data.
• How consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision regarding the consumer’s request.
• The categories of personal data that the controller shares with third parties, if any.
• The categories of third parties, if any, with whom the controller shares personal data.

The law defines “controllers of personal data” as those controlling or possessing the personal data of 100,000 Iowa consumers or deriving 50% of revenue from selling the data of more than 25,000 consumers.

The Iowa law also provides consumers with the following rights:

• To confirm whether a controller is processing the consumer’s personal data and to access such personal data.
• To delete personal data provided by the consumer.
• To obtain a copy of the consumer’s data (subject to certain exceptions).
• To opt out of the sale of personal data.

Iowa is now the sixth state to pass a comprehensive state privacy law. However, among other differences, Iowa’s law does not include (1) a private right of action, (2) a requirement for businesses to undertake data protection assessments, or (3) the ability of consumers to opt out of targeted advertising.

Click here for the full text.

As Hire Image predicted in our Top Ten Background Screening Predictions for 2023, we will likely see similar privacy laws being passed this year, and these laws will undoubtedly impact background screening. Hire Image will continue to keep you updated as to the passage of additional privacy laws in other states.

Contact us if you have any questions about how this law may affect you or about your background screening processes in general.