HF 2048

As introduced: - Requires companies processing personal data of 5,000 or more Iowa residents to provide clear disclosures regarding the purposes for collecting the data, including whether it will be used for automated decision making or artificial intelligence training, the type of personal data to be collected, the types of persons the data will be shared with, and whether the individual will be compensated. - Requires companies to obtain affirmative consent before processing personal data. Limits collection to what is reasonably necessary. - Prohibits companies from denying or downgrading service to individuals for exercising their data privacy rights. - Grants consumers the right to confirm data is being processed, obtain a summary of data processed, right to correct, right to delete, and right to revoke consent. - Creates a limited private right of action for a security breach or a violation that resulted in actual damages. - Authorizes the attorney general to enforce its provisions and seek civil penalties of up to $7,500 per violation.