§ 715D.3 — Consumer data rights

Iowa § 715D.3

• Jurisdiction: Iowa
• Title XVI: CRIMINAL LAW AND PROCEDURE
• Ch. 715D: CONSUMER DATA PROTECTIONS

Text

1. A consumer may invoke the consumer rights authorized pursuant to this section at any
time by submitting a request to the controller, through the means specified by the controller
pursuant to section 715D.4, subsection 6, specifying the consumer rights the consumer
wishes to invoke. A known child’s parent or legal guardian may invoke such consumer
rights on behalf of the known child regarding processing personal data belonging to the
child. A controller shall comply with an authenticated consumer request to exercise all of
the following:
a. To confirm whether a controller is processing the consumer’s personal data and to
access such personal data.
b. To delete personal data provided by the consumer.
c. To obtain a copy of the consumer’s personal data, except as to personal data that is
definedas“personalinformation”pursuanttosection715C.1thatissubjecttosecuritybreach
5 CONSUMER DATA PROTECTIONS, §715D.4
protection, that the consumer previously provided to the controller in a portable and, to the
extent technically practicable, readily usable format that allows the consumer to transmit
the data to another controller without hindrance, where the processing is carried out by
automated means.
d. To opt out of the sale of personal data.
2. Except as otherwise provided in this chapter, a controller shall comply with a request
by a consumer to exercise the consumer rights authorized pursuant to this section as follows:
a. A controller shall respond to the consumer without undue delay, but in all cases
within ninety days of receipt of a request submitted pursuant to the methods described
in this section. The response period may be extended once by forty-five additional days
when reasonably necessary upon considering the complexity and number of the consumer’s
requests by informing the consumer of any such extension within the initial ninety-day
response period, together with the reason for the extension.
b. If a controller declines to take action regarding the consumer’s request, the controller
shallinformtheconsumerwithoutunduedelayofthejustificationfordecliningtotakeaction,
except in the case of a suspected fraudulent request, in which case the controller may state
that the controller was unable to authenticate the request. The controller shall also provide
instructions for appealing the decision pursuant to subsection 3.
c. Information provided in response to a consumer request shall be provided by a
controller free of charge, up to twice annually per consumer. If a request from a consumer
is manifestly unfounded, excessive, repetitive, technically unfeasible, or the controller
reasonably believes that the primary purpose of the request is not to exercise a consumer
right, the controller may charge the consumer a reasonable fee to cover the administrative
costs of complying with the request or decline to act on the request. The controller bears
the burden of demonstrating the manifestly unfounded, excessive, repetitive, or technically
unfeasible nature of the request.
d. If a controller is unable to authenticate a request using commercially reasonable
efforts, the controller shall not be required to comply with a request to initiate an action
under this section and may request that the consumer provide additional information
reasonably necessary to authenticate the consumer and the consumer’s request.
3. A controller shall establish a process for a consumer to appeal the controller’s refusal
to take action on a request within a reasonable period of time after the consumer’s receipt
of the decision pursuant to this section. The appeal process shall be conspicuously available
and similar to the process for submitting requests to initiate action pursuant to this section.
Within sixty days of receipt of an appeal, a controller shall inform the consumer in writing
of any action taken or not taken in response to the appeal, including a written explanation
of the reasons for the decision. If the appeal is denied, the controller shall also provide the
consumer with an online mechanism through which the consumer may contact the attorney
general to submit a complaint.