Iowa Code Chapter 715C: A Written Harm Determination and a Clock That Starts at Consumer Notice

What Chapter 715C Covers

Chapter 715C has two sections, definitions and duties. Its "person" includes government, governmental subdivisions, agencies and public corporations alongside businesses, so public bodies are inside the same chapter. The notice duty in 715C.2(1) attaches to personal information "used in the course of the person's business, vocation, occupation, or volunteer activities."

Section 715C.1(1) defines a breach as unauthorized acquisition of computerized personal information that compromises its security, confidentiality or integrity. It then adds information kept "in any medium, including on paper, that was transferred by the person to that medium from computerized form." A printout of a database is therefore covered, while a paper record that never existed electronically is not. Good-faith acquisition by an employee or agent is excluded only if the information is not used unlawfully or in a way that "harms or poses an actual threat" to it.

Personal information pairs a name with any of five elements: a Social Security number; a driver's license or other government-issued unique identification number; a financial account or card number with any required expiration date, code or password; a unique electronic identifier or routing code with its access code; or unique biometric data. Encrypted or redacted data falls outside the definition unless the keys "have been obtained through the breach of security." Redaction has a numeric meaning: no more than five digits of a Social Security number, or the last four digits of other listed numbers, remain accessible. Encryption must follow "accepted industry standards."

How the Text Reached Its Current Form

The Code's history note lists the original 2008 Acts chapter 1154 and amendments by 2013 Acts chapter 90, 2014 Acts chapters 1026 and 1062, and 2018 Acts chapter 1091. The 2014 change of substance was chapter 1062, Senate File 2259, titled an act "modifying provisions applicable to personal information security breach notification requirements, and making penalties applicable." It restated section 715C.2 with a new subsection 8 on notice to the Attorney General, renumbering the remedies subsection as 9.

Chapter 1091 of 2018, Senate File 2177, amended the encryption definition and both subsections 7 and 8. Two differences between the 2014 text and Iowa Code 2026 follow from it. The 2014 subsection 8 required notice to the Attorney General "following discovery of such breach of security, or receipt of notification under subsection 2," and within five business days after consumer notice; the current subsection keeps only the second timing reference. And the 2014 exemption list stopped at Gramm-Leach-Bliley, while the 2018 text adds a paragraph for HIPAA and HITECH.

The Risk-of-Harm Exception and Its Documentation

Section 715C.2(6) excuses notice if, "after an appropriate investigation or after consultation with the relevant federal, state, or local agencies responsible for law enforcement," the person determined that "no reasonable likelihood of financial harm" to affected consumers has resulted or will result. The harm measured is financial, not harm in general.

The exception carries a record: "Such a determination must be documented in writing and the documentation must be maintained for five years." The chapter does not require that the document be sent to anyone, and it does not say who may demand it.

Notice to the Attorney General

Subsection 8, as it now reads, applies where a breach requires notice "to more than five hundred residents of this state." The person must then give written notice "to the director of the consumer protection division of the office of the attorney general within five business days after giving notice of the breach of security to any consumer pursuant to this section." The clock runs from the first consumer notice sent, not from discovery, and it is counted in business days.

The Attorney General's security breach notifications page gives databreach@ag.iowa.gov as the submission address and organizes the notices it has received into annual pages listing the date reported and the organization. The statute itself prescribes no content for the filing.

Content of Consumer Notice

Section 715C.2(5) requires, at a minimum:

1. a description of the breach of security;
2. its approximate date;
3. the type of personal information obtained;
4. contact information for consumer reporting agencies; and
5. "Advice to the consumer to report suspected incidents of identity theft to local law enforcement or the attorney general."

Consumer notice is due "in the most expeditious manner possible and without unreasonable delay," consistent with law enforcement needs and with measures to determine contact information and scope and to restore the data's integrity. A law enforcement delay requires that the agency "has made a written request," and notice follows once the agency tells the person in writing that it will not compromise the investigation. A service provider holding data for another must notify the owner "immediately following discovery." Substitute notice is available above $250,000 in cost or 350,000 affected consumers. The chapter contains no duty to notify consumer reporting agencies themselves.

Who Is Outside the Chapter

Section 715C.2(7) removes four groups: persons following a federal regulator's breach rules that give "greater protection" and "at least as thorough disclosure requirements"; persons complying with another state or federal law meeting the same test; and persons "subject to and" complying with the Gramm-Leach-Bliley Title V regulations or the HIPAA and HITECH rules. Each financial and health exemption is conditioned on compliance, not merely on being subject to the federal law.

Enforcement

Under 715C.2(9)(a), a violation "is an unlawful practice pursuant to section 714.16," Iowa's Consumer Fraud Act, and the Attorney General may also obtain an order to "pay damages to the attorney general on behalf of a person injured by the violation." Section 714.16(7) authorizes a civil penalty "not to exceed forty thousand dollars per violation," and adds that "a course of conduct shall not be considered to be separate and different violations merely because the conduct is repeated to more than one person."

The Attorney General announced on March 31, 2026 a suit against Change Healthcare over a breach that affected nearly 2.2 million Iowans, stating that Change "delayed notifying affected Iowans, doing so only after five months." The petition, filed in Polk County against Change Healthcare Inc., UnitedHealth Group and Optum, pleads the chapter in its second count. It cites the expeditious-notice standard in 715C.2(1) and the notice methods in 715C.2(4), and alleges that direct notice began in July 2024 at the earliest and was still being sent in October 2025. It also alleges that substitute notice under 715C.2(4)(c) was not timely made.

Paragraph 99 of the petition alleges that "each such failure is its own violation of the statute," and the prayer seeks $40,000 per violation. The count does not invoke subsection 8, the Attorney General notice. These are allegations; no ruling in the case was located for this post.

Frequently Asked Questions