Law note · Iowa
Personal Information Security Breach Protection
Notification of a breach of security must be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. A business subject to a breach requiring notification to more than 500 Iowa residents must also give written notice to the director of the consumer protection division of the Attorney General's office within five business days of notifying consumers.
A violation is an unlawful practice under section 714.16, and the Attorney General may recover damages on behalf of an injured person, but that recovery runs through the Attorney General rather than arming the person with a direct private right of action. This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.
What it asks of an app
- Notify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay.
- Notify the Iowa Attorney General's consumer protection division within five business days of notifying consumers, if the breach requires notifying more than 500 Iowa residents.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Iowa statute text, Iowa Code chapter 715C