Iowa 2023-2024 Regular Session Status: Enacted

SF 262 — A bill for an act relating to consumer data protection, providing civil penalties, and including effective date provisions.

Last action — Signed by Governor.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. ✓
    Passed Senate
  4. ✓
    Passed House
  5. ✓
    To Executive
  6. 6
    Enacted

This bill has been enacted into law. Introduced February 13, 2023. Enacted.

Signed by Governor Kim Reynolds (Republican) on March 28, 2023.

Prognosis

Advancing 50% · moderate confidence

Where this bill stands today.

Odds of enactment

High

How often bills like it became law.

  • Enacted

    Current position in the legislative process.

  • 1 sponsor

    1 primary, 0 co-sponsors signed on.

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Bill Text

What changed in the latest version

680 added · 707 removed

680 line(s) added, 707 removed.

→
Previous
Latest
KMRENLDS OFFICE OF THE GOVERNOR AAMGEGG GVENOR TGVENOR Mach8,03 TheooabePulae Sceayofttefowa SaeCptl Desons,owa019 DarM.Sceay, Ihrbyrnm:
Senate File 262 - Enrolled Senate File 262 AN ACT RELATING TO CONSUMER DATA PROTECTION, PROVIDING CIVIL PENALTIES, AND INCLUDING EFFECTIVE DATE PROVISIONS.
Snteie6,ancteaigocnsmrdtartci,poidngvleate.
adicuigfetveaepvsos.
TeabveeaeFleseeyaprvdonhsae.
Sneey, Kim Gvenrofoa c:
ertryfteSnte lrkfteHuse TTECPTOL SMINS,OWA0191.851 FX557.57 WW.OERORIOA.OV r _•i'l1III 1 uunn..
Go..•s• ,-^• r - .lu,,.nuunuuww uuummuuum uuu u IWI C•7Lm"', w ,_•----_..-_-_-..-•_.._.....-z t • ny H ^ J • > allIIIII-'1111111111111I1• .il I1 1 kiV % -% % I'il/lil/•I 'S1 ii11 I I I'1 :I1 i1':1 :! t I ls I 1 V, :
•.•.
G ' E N F d R .
A SSF A N 1l I LA 01I!II tlI il llIIUI1 ;' :I I CA1 UC3!,1 7III 9IUI 11!! Senate File 262 AN ACT RELATING TO CONSUMER DATA PROTECTION, PROVIDING CIVIL PENALTIES, AND INCLUDING EFFECTIVE DATE PROVISIONS.
Section 1 .
Section 1.
Affiliate - means a legal entity that controls, is controlled by, or is under common control with another legal entity or shares common branding with another legal entity.
“Affiliate” means a legal entity that controls, is controlled by, or is under common control with another legal entity or shares common branding with another legal entity.
For the purposes of this definition, -control - or -controlled means:
For the purposes of this definition, “control” or “controlled” means:
a .
a.
2.Aggregate data - means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer.
2.
3.Authenticate - means verifying through reasonable means that a consumer, entitled to exercise their consumer rights in Senate File 262, p .
“Aggregate data” means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer.
2 section 715D.3, i s the same consumer exercising such consumer rights with respect to the personal data at issue.
3.
“Authenticate” means verifying through reasonable means that a consumer, entitled to exercise their consumer rights in Senate File 262, p.
2 section 715D.3, is the same consumer exercising such consumer rights with respect to the personal data at issue.
"Biometric data -means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that i s used to identify a specific individual.
“Biometric data” means data generated by automatic measurements of an individual’s biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual.
-Biometric data does not include a physical or digital photograph, a video or audio recording or data generated therefrom, or information collected, used, or stored for health care treatment, payment or operations under HIPAA.
“Biometric data” does not include a physical or digital photograph, a video or audio recording or data generated therefrom, or information collected, used, or stored for health care treatment, payment, or operations under HIPAA.
"Child -means any natural person younger than thirteen years of age.
“Child” means any natural person younger than thirteen years of age.
Consent ~means a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.
“Consent” means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.
-Consent- may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
“Consent” may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
"Consumer -means a natural person who i s a resident of the state acting only i n an individual or household context and excluding a natural person acting in a commercial or employment context.
“Consumer” means a natural person who is a resident of the state acting only in an individual or household context and excluding a natural person acting in a commercial or employment context.
"Controller -means a person that, alone or jointly with others, determines the purpose and means of processing personal data.
“Controller” means a person that, alone or jointly with others, determines the purpose and means of processing personal data.
~Covered entity ~means the same as ~covered entity ~ defined by HIPAA.
“Covered entity” means the same as “covered entity” defined by HIPAA.
-De-identified data - means data that cannot reasonably be linked to an identified or identifiable natural person.
“De-identified data” means data that cannot reasonably be linked to an identified or identifiable natural person.
-Fund -means the consumer education and litigation fund established pursuant to section 714.16C.
“Fund” means the consumer education and litigation fund established pursuant to section 714.16C.
"Health care provider - means any of the following:
“Health care provider” means any of the following:
Health care provider - does not include a continuing care retirement community or any nursing facility of a religious body which depends upon prayer alone for healing.
“Health care provider” does not include a continuing care retirement community or any nursing facility of a religious body which depends upon prayer alone for healing.
Health Insurance Portabi1ity and Accountabi1ity Act or -HIPAA -means the federal Health Insurance Portability and Accountability Act of 1996, Pub.
“Health Insurance Portability and Accountability Act” or “HIPAA” means the federal Health Insurance Portability and Accountability Act of 1996, Pub.
Health record means any written, printed, or electronically recorded material maintained by a health care provider in the course of providing health services to an individual concerning the individual and the services provided, including related health information provided in confidence to a health care provider.
“Health record” means any written, printed, or electronically recorded material maintained by a health care provider in the course of providing health services to an individual concerning the individual and the services provided, including related health information provided in confidence to a health care provider.
Identified or identifiable natural person - means a person who can be readily identified, directly or indirectly.
“Identified or identifiable natural person” means a person who can be readily identified, directly or indirectly.
Institution of higher education - means nonprofit private institutions of higher education and proprietary private institutions of higher education in the state, community colleges, and each associate-degree-granting and baccalaureate public institutions of higher education in the state.
“Institution of higher education” means nonprofit private institutions of higher education and proprietary private institutions of higher education in the state, community colleges, and each associate-degree-granting and baccalaureate public institutions of higher education in the state.
Nonprofit organization - means any corporation organized under chapter 504, any organization exempt from taxation under sections 501(c)(3), 501(c)(6), or 501(c)(12) of the Internal Revenue Code, any organization exempt from taxation under section 501(c)(4) of the Internal Revenue Code that is established to detect or prevent insurance-related crime or fraud, and any subsidiaries and affiliates of entities organized pursuant to chapter 499.
“Nonprofit organization” means any corporation organized under chapter 504, any organization exempt from taxation under sections 501(c)(3), 501(c)(6), or 501(c)(12) of the Internal Revenue Code, any organization exempt from taxation under section 501(c)(4) of the Internal Revenue Code that is established to detect or prevent insurance-related crime or fraud, and any subsidiaries and affiliates of entities organized pursuant to chapter 499.
Personal data - means any information that is linked or reasonably linkable to an identified or identifiable natural person.
“Personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person.
Personal data - does not include de-identified or aggregate data or publicly available information.
“Personal data” does not include de-identified or aggregate data or publicly available information.
'Precise geolocation data - means information derived Senate File 262, p .
“Precise geolocation data” means information derived Senate File 262, p.
Precise geolocation data- does not include the content of communications, or any data generated by or connected to utility metering infrastructure systems or equipment for use by a utility.
“Precise geolocation data” does not include the content of communications, or any data generated by or connected to utility metering infrastructure systems or equipment for use by a utility.
Show all 108 changed rows (68 more)
Previous
Latest
Process - or processing - means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
“Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
Processor' means a person that processes personal data on behalf of a controller.
“Processor” means a person that processes personal data on behalf of a controller.
"Protected health information - means the same as protected health information established by HIPAA.
“Protected health information” means the same as protected health information established by HIPAA.
-Pseudonymous data - means personal data that cannot be attributed to a specific natural person without the use of additional information, provided that such additional information i s kept separately and i s subject to appropriate technical and organizational measures to ensure that the personal data i s not attributed to an identified or identifiable natural person.
“Pseudonymous data” means personal data that cannot be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
-Publicly available information - means information that is lawfully made available through federal, state, or local government records, or information that a business has reasonable basis to believe i s lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.
“Publicly available information” means information that is lawfully made available through federal, state, or local government records, or information that a business has reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.
-Sale of personal data - means the exchange of personal data for monetary consideration by the controller to a third party.
“Sale of personal data” means the exchange of personal data for monetary consideration by the controller to a third party.
Sale of personal data - does not include:
“Sale of personal data” does not include:
The disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.
The disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets.
Sensitive data - means a category of personal data that includes the following:
“Sensitive data” means a category of personal data that includes the following:
State agency - means the same as defined in 129 IAC 10.2(8B).
“State agency” means the same as defined in 129 IAC 10.2(8B).
Targeted advertising - means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests.
“Targeted advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests.
Targeted advertising -does not include the following:
“Targeted advertising” does not include the following:
Advertisements based on activities within a controller's own or affiliated websites or online applications.
Advertisements based on activities within a controller’s own or affiliated websites or online applications.
Advertisements based on the context of a consumer's Senate File 262, p.
Advertisements based on the context of a consumer’s Senate File 262, p.
Advertisements directed to a consumer in response to the consumer's request for information or feedback.
Advertisements directed to a consumer in response to the consumer’s request for information or feedback.
'Third party - means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.
“Third party” means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.
Trade secret - means information, including but not limited to a formula, pattern, compilation, program, device, method, technique, or process, that consists of the following:
“Trade secret” means information, including but not limited to a formula, pattern, compilation, program, device, method, technique, or process, that consists of the following:
V of the federal Gramm-Leach-Bliley Act of 1999, 15 U.S.C.
V of the federal Gramm-Leach-Bliley Act of 1999, l5 U.S.C.
F , of the federal Health Insurance Portability and Accountability Act of 1996, Pub.
F, of the federal Health Insurance Portability and Accountability Act of 1996, Pub.
6 , 50, and 56.
6, 50, and 56.
1.
l.
8 consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act, 15 U.S.C.
8 consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act, 15 U.S.C.
Personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C.
Personal data collected, processed, sold, or disclosed in compliance with the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C.
(3) That is necessary to retain to administer benefits for another individual relating to the individual under subparagraph (1 ) and used for the purposes of administering those benefits.
(3) That is necessary to retain to administer benefits for another individual relating to the individual under subparagraph (1) and used for the purposes of administering those benefits.
Personal data used in accordance with the federal Children's Online Privacy Protection Act, 15 U.S.C.
Personal data used in accordance with the federal Children’s Online Privacy Protection Act, 15 U.S.C.
§6501 — 6506, and its rules, regulations, and exceptions thereto.
§6501 – 6506, and its rules, regulations, and exceptions thereto.
A consumer may invoke the consumer rights authorized pursuant to this section at any time by submitting a request to the controller, through the means specified by the controller pursuant to section 715D.4, subsection 6 , specifying the consumer rights the consumer wishes to invoke.
A consumer may invoke the consumer rights authorized pursuant to this section at any time by submitting a request to the controller, through the means specified by the controller pursuant to section 715D.4, subsection 6, specifying the consumer rights the consumer wishes to invoke.
A known child's parent or legal guardian may invoke such consumer rights on behalf of the known child regarding processing personal data belonging to the child.
A known child’s parent or legal guardian may invoke such consumer rights on behalf of the known child regarding processing personal data belonging to the child.
A controller shall comply with an authenticated consumer request to exercise all of the Senate File 262, p .
A controller shall comply with an authenticated consumer request to exercise all of the Senate File 262, p.
To confirm whether a controller is processing the consumer's personal data and to access such personal data.
To confirm whether a controller is processing the consumer’s personal data and to access such personal data.
To obtain a copy of the consumer's personal data, except as to personal data that is defined as personal information pursuant to section 715C.1 that is subject to security breach protection, that the consumer previously provided to the controller in a portable and, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means.
To obtain a copy of the consumer’s personal data, except as to personal data that is defined as “personal information” pursuant to section 715C.1 that is subject to security breach protection, that the consumer previously provided to the controller in a portable and, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means.
The response period may be extended once by forty-five additional days when reasonably necessary upon considering the complexity and number of the consumer's requests by informing the consumer of any such extension within the initial ninety-day response period, together with the reason for the extension.
The response period may be extended once by forty-five additional days when reasonably necessary upon considering the complexity and number of the consumer’s requests by informing the consumer of any such extension within the initial ninety-day response period, together with the reason for the extension.
b, If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay of the justification for declining to take action, except in the case of a suspected fraudulent request, in which case the controller may state that the controller was unable to authenticate the request.
b.
If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay of the justification for declining to take action, except in the case of a suspected fraudulent request, in which case the controller may state that the controller was unable to authenticate the request.
If a controller is unable to authenticate a request using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action under this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.
If a controller is unable to authenticate a request using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action under this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer’s request.
A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision pursuant to this section.
A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the consumer’s receipt of the decision pursuant to this section.
A controller shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and an opportunity to opt out of such processing, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act, 15 U.S.C.
A controller shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and an opportunity to opt out of such processing, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children’s Online Privacy Protection Act, 15 U.S.C.
However, nothing in this chapter shall be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer's right to opt out pursuant to section 715D.3 or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
However, nothing in this chapter shall be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer’s right to opt out pursuant to section 715D.3 or the offer is related to a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
How consumers may exercise their consumer rights pursuant to section 715D.3, including how a consumer may appeal a controller's decision with regard to the consumer's request.
How consumers may exercise their consumer rights pursuant to section 715D.3, including how a consumer may appeal a controller’s decision with regard to the consumer’s request.
If a controller sells a consumer's personal data to third parties or engages in targeted advertising, the controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt Senate File 262, p.
If a controller sells a consumer’s personal data to third parties or engages in targeted advertising, the controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt Senate File 262, p.
To fulfill the controller's obligation to respond to consumer rights requests pursuant to section 715D.3.
To fulfill the controller’s obligation to respond to consumer rights requests pursuant to section 715D.3.
To meet the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a security breach of the processor pursuant to section 715C.2.
To meet the controller’s obligations in relation to the security of processing the personal data and in relation to the notification of a security breach of the processor pursuant to section 715C.2.
A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller.
A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller.
At the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law.
At the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law.
Upon the reasonable request of the controller, make available to the controller all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations in this chapter.
Upon the reasonable request of the controller, make available to the controller all information in the processor’s possession necessary to demonstrate the processor’s compliance with the obligations in this chapter.
Nothing in this section shall be construed to relieve a controller or a processor from imposed liabilities by virtue of the controller or processor's role in the processing relationship as defined by this chapter.
Nothing in this section shall be construed to relieve a controller or a processor from imposed liabilities by virtue of the controller or processor’s role in the processing relationship as defined by this chapter.
A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor.
A processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor.
715D.6 Processing data — exemptions.
715D.6 Processing data —— exemptions.
Senate File 262, p .
Senate File 262, p.
Consumer rights contained in sections 715D.3 and 715D.4 shall not apply to pseudonymous data in cases where the controller is able to demonstrate any information necessary to identify the consumer is kept separately and i s subject to appropriate technical and organizational measures to ensure that the personal data i s not attributed to an identified or identifiable natural person.
Consumer rights contained in sections 715D.3 and 715D.4 shall not apply to pseudonymous data in cases where the controller is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
Controllers that disclose pseudonymous data o r de-identified data shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data i s subject and shall take appropriate steps to address any breaches of those contractual commitments.
Controllers that disclose pseudonymous data or de-identified data shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data is subject and shall take appropriate steps to address any breaches of those contractual commitments.
Nothing in this chapter shall be construed to restrict a controller's or processor's ability to do the following:
Nothing in this chapter shall be construed to restrict a controller’s or processor’s ability to do the following:
Provide a product or service specifically requested by a consumer or parent or guardian of a child, perform a contract to which the consumer or parent or guardian of a child i s a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent or guardian of a child prior to entering into a contract.
Provide a product or service specifically requested by a consumer or parent or guardian of a child, perform a contract to which the consumer or parent or guardian of a child is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent or guardian of a child prior to entering into a contract.
Take immediate steps to protect an interest that i s essential for the life or physical safety of the consumer or Senate File 262, p.
Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or Senate File 262, p.
g, Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity.
g.
Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity.
The obligations imposed on a controller or processor under this chapter shall not restrict a controller's or processor's ability to collect, use, or retain data as follows:
The obligations imposed on a controller or processor under this chapter shall not restrict a controller’s or processor’s ability to collect, use, or retain data as follows:
To perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or parent or guardian of a child or the performance of a contract to which the consumer or Senate File 262, p.
To perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer’s existing relationship with the controller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or parent or guardian of a child or the performance of a contract to which the consumer or Senate File 262, p.
Senate File 262, p .
Senate File 262, p.
If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements in subsection 6 .
If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements in subsection 6.
B.
8.
715D.8 Enforcement — penalties.
715D.8 Enforcement —— penalties.
Prior to initiating any action under this chapter, the attorney general shall provide a controller or processor ninety days" written notice identifying the specific provisions of this chapter the attorney general alleges have been or are being violated.
Prior to initiating any action under this chapter, the attorney general shall provide a controller or processor ninety days’ written notice identifying the specific provisions of this chapter the attorney general alleges have been or are being violated.
This Act takes effect January 1 , 2025.
This Act takes effect January 1, 2025.
• AMY SINC 1•IR PAT GRASSLEY President of the Senate Speaker of t e House I hereby certify that this bill originated in the Senate and is known as Senate File 262, Ninetieth General Assembly.
______________________________ ______________________________ AMY SINCLAIR PAT GRASSLEY President of the Senate Speaker of the House I hereby certify that this bill originated in the Senate and is known as Senate File 262, Ninetieth General Assembly.
PJ .
______________________________ W.
C k v l w C O- ca W.
CHARLES SMITHSON Secretary of the Senate Approved _______________, 2023 ______________________________ KIM REYNOLDS Governor
CHARLES SMITHSON Secretary of the Senate Approved , 2023 Governor
⬇ Download PDF
View plain text versions (3)

Action History

  1. Signed by Governor.

  2. Reported correctly enrolled, signed by President and Speaker, and sent to Governor.

  3. Message from House.

  4. Immediate message.

  5. Passed House, yeas 97, nays 0.

  6. Substituted for HF 346.

  7. Read first time, passed on file.

  8. Message from Senate.

  9. Immediate message.

  10. Passed Senate, yeas 47, nays 0.

  11. Committee report, approving bill.

  12. Introduced, placed on calendar.

Sponsors

  • COMMITTEE ON TECHNOLOGY · Primary

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 0 co-sponsors · 149 not signed on

Sponsors (1)

  • COMMITTEE ON TECHNOLOGY

Co-sponsors (0)

None.

Not signed on (149)

149 members have not signed on to this bill.

Show all 149 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

civil-rights technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SF 262?
SF 262 is sponsored by COMMITTEE ON TECHNOLOGY.
What is the current status of SF 262?
This bill has been enacted into law. Introduced February 13, 2023. Enacted.
Where can I track SF 262?
Track SF 262 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SF 262

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SF 262

Last checked for changes 2 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →