Law note · Iowa
Iowa Consumer Data Protection Act (ICDPA), publicly available information exemption
What it asks of an app
- Personal data that is lawfully made available through a government record, or that a consumer or widely distributed media has lawfully made available to the public without restricting it to a specific audience, falls outside the ICDPA's definition of personal data.
- Do not assume Iowa consumers can opt out of automated profiling for consequential decisions the way Colorado or Connecticut consumers can; the ICDPA grants no such right.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Section 715D.1(18) defines personal data to exclude de-identified or aggregate data or publicly available information, and section 715D.1(24) defines publicly available information as information lawfully made available through federal, state, or local government records, or information a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it to the general public via a channel of mass media without restricting it to a specific audience.
As in several peer states, this exemption is built into the definition of personal data itself, so scraped public-record or public-media personal data falls outside the ICDPA's scope by definition. The Act applies to persons conducting business in Iowa or targeting Iowa residents who, during a calendar year, control or process the personal data of at least 100,000 consumers, with a second, lower-threshold prong for entities deriving a substantial share of revenue from data sales.
Notably, unlike Colorado, Connecticut, and Virginia, the ICDPA does not grant Iowa consumers a right to opt out of automated profiling used in consequential decisions, a meaningful gap relative to those states.