WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(1) "Biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1)" means any information about or based on an individual's biometric identifierBiometric identifier"Biometric identifier" means an individual's retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is described by all of the following: (1) The feature is inherently tied to a specific individual. (2) The feature is considered permanent, difficult to replicate, and remains relatively stable over time. (3) The feature is unique enough to identify a person with a high degree of accuracy. "Biometric identifier" does not include any of the following: (1) Writing samples, written signatures, and similar products. (2) Photographs. (3) Biological samples used for scientific testing or screening. (4) Demographic data. (5) Physical descriptions including but not limited to tattoo descriptions, height, weight, eye color, and hair color. (6) Information gained from an individual's health care treatment, including but not limited to biological samples taken from an individual. (7) A biometric scan, mammography, X ray, roentgen process, computed tomography, magnetic resonance imaging, positron emission tomography scan, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or medical condition, or used for scientific testing or screening.Iowa Code § 554J.1(2).
(2)(a)–(b) a. "Biometric identifierBiometric identifier"Biometric identifier" means an individual's retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is described by all of the following: (1) The feature is inherently tied to a specific individual. (2) The feature is considered permanent, difficult to replicate, and remains relatively stable over time. (3) The feature is unique enough to identify a person with a high degree of accuracy. "Biometric identifier" does not include any of the following: (1) Writing samples, written signatures, and similar products. (2) Photographs. (3) Biological samples used for scientific testing or screening. (4) Demographic data. (5) Physical descriptions including but not limited to tattoo descriptions, height, weight, eye color, and hair color. (6) Information gained from an individual's health care treatment, including but not limited to biological samples taken from an individual. (7) A biometric scan, mammography, X ray, roentgen process, computed tomography, magnetic resonance imaging, positron emission tomography scan, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or medical condition, or used for scientific testing or screening.Iowa Code § 554J.1(2)" means an individual's retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is described by all of the following: (1) The feature is inherently tied to a specific individual. (2) The feature is considered permanent, difficult to replicate, and remains relatively stable over time. (3) The feature is unique enough to identify a person with a high degree of accuracy. b. "Biometric identifierBiometric identifier"Biometric identifier" means an individual's retina, iris, fingerprint, voice, hand, facial geometry, or other physical feature that is described by all of the following: (1) The feature is inherently tied to a specific individual. (2) The feature is considered permanent, difficult to replicate, and remains relatively stable over time. (3) The feature is unique enough to identify a person with a high degree of accuracy. "Biometric identifier" does not include any of the following: (1) Writing samples, written signatures, and similar products. (2) Photographs. (3) Biological samples used for scientific testing or screening. (4) Demographic data. (5) Physical descriptions including but not limited to tattoo descriptions, height, weight, eye color, and hair color. (6) Information gained from an individual's health care treatment, including but not limited to biological samples taken from an individual. (7) A biometric scan, mammography, X ray, roentgen process, computed tomography, magnetic resonance imaging, positron emission tomography scan, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or medical condition, or used for scientific testing or screening.Iowa Code § 554J.1(2)" does not include any of the following: (1) Writing samples, written signatures, and similar products. (2) Photographs. (3) Biological samples used for scientific testing or screening. (4) Demographic data. (5) Physical descriptions including but not limited to tattoo descriptions, height, weight, eye color, and hair color. (6) Information gained from an individual's health care treatment, including but not limited to biological samples taken from an individual. (7) A biometric scan, mammography, X ray, roentgen process, computed tomography, magnetic resonance imaging, positron emission tomography scan, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or medical condition, or used for scientific testing or screening.
(3) "DepartmentDepartment"Department" means the department of inspections, appeals, and licensing.Iowa Code § 554J.1(3)" means the department of inspections, appeals, and licensing.
(4) "Private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4)" means any nongovernmental entity or group.
(5) "SubjectSubject"Subject" means an individual to whom particular biometric data pertains.Iowa Code § 554J.1(5)" means an individual to whom particular biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) pertains.
Section 554J.1 establishes the definitional foundation for the chapter. Biometric identifier is defined broadly to cover retina, iris, fingerprint, voice, hand, facial geometry, and other stable physical features, but explicitly excludes writing samples, photographs, demographic data, physical descriptions, health care information, and medical imaging. Biometric data is any information about or based on a biometric identifier. The regulated party is the private entity, defined as any nongovernmental entity or group — an extremely broad scope covering any non-government actor.
(1)(a)–(c) 1 a. A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) in possession of biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) shall develop a written policy to establish a schedule for how long the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) will retain biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) before the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) destroys the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1). b. A written policy shall be available to the public. c. A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) shall not retain biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) for more than three years after the subject of the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) last interacts with the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) or until the purposes for which the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) was collected have been accomplished, whichever is longer.
(2)(a)–(b) 2 A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) shall not collect, capture, purchase, or otherwise obtain an individual's biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) unless, prior to receiving the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1), the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) does all of the following: a. Informs the subject of the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1), or the subjectSubject"Subject" means an individual to whom particular biometric data pertains.Iowa Code § 554J.1(5)'s legal representative, in writing, that the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) intends to collect the subjectSubject"Subject" means an individual to whom particular biometric data pertains.Iowa Code § 554J.1(5)'s biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1). b. Informs the subject of the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1), or the subjectSubject"Subject" means an individual to whom particular biometric data pertains.Iowa Code § 554J.1(5)'s legal representative, in writing, of the purposes and length of time for which the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) intends to retain the biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1).
(3) 3 A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) shall not sell, lease, trade, or otherwise profit from an individual's biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1).
(4) 4 A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) shall store, transmit, and protect biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) using reasonable methods that are widely accepted within the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4)'s industry and are equivalent to, or more protective than, the manner in which the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) protects passwords and other information that can be used to provide access to an individual's account or property.
Section 554J.2 contains the chapter's four substantive obligations on private entities. Subsection 1 requires a written retention and destruction policy that must be publicly available and caps retention at three years after last interaction or until the collection purpose is accomplished, whichever is longer. Subsection 2 prohibits collection of biometric data without first providing written notice to the subject of the intent to collect and the purpose and retention period. Subsection 3 prohibits selling, leasing, trading, or otherwise profiting from biometric data. Subsection 4 requires industry-standard security for storage and transmission.
This chapter shall not apply to an employer that uses an employee's biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) solely within the scope of the employee's employment.
Section 554J.3 carves out two categories from the chapter's scope. First, employers using employee biometric data solely within the scope of employment are exempt. Second, the chapter does not apply to government entity contractors, subcontractors, or agents acting in their governmental capacity. These are scope limitations, not affirmative obligations.
(1) The departmentDepartment"Department" means the department of inspections, appeals, and licensing.Iowa Code § 554J.1(3) shall enforce this chapter and may seek injunctive relief for a violation of this chapter.
(2) The departmentDepartment"Department" means the department of inspections, appeals, and licensing.Iowa Code § 554J.1(3) shall establish electronic means for an individual to report a violation of this chapter.
(3) If a private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) in violation of this chapter has not previously violated this chapter, the departmentDepartment"Department" means the department of inspections, appeals, and licensing.Iowa Code § 554J.1(3) shall send notice to the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) informing the private entity of the violation and allowing the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) thirty calendar days to cure the violation.
(4)(a)–(c) A private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) that violates this chapter is subjectSubject"Subject" means an individual to whom particular biometric data pertains.Iowa Code § 554J.1(5) to the following civil penalties: a. One thousand dollars for a first violation. b. Five thousand dollars for a second violation, regardless of whether the private entityPrivate entity"Private entity" means any nongovernmental entity or group.Iowa Code § 554J.1(4) cured a first violation within the time allowed under subsection 3. c. Ten thousand dollars for a third or subsequent violation.
(5) Civil penalties collected under this section shall be deposited into the general fund of the state.
(6) The departmentDepartment"Department" means the department of inspections, appeals, and licensing.Iowa Code § 554J.1(3) shall adopt rules pursuant to chapter 17A to implement and enforce this chapter.
Section 554J.4 designates the Department of Inspections, Appeals, and Licensing (DIAL) as the sole enforcement authority. DIAL may seek injunctive relief and must establish electronic complaint reporting. A mandatory 30-day cure period applies to first-time violators — DIAL must send notice and allow 30 calendar days to cure before penalties attach. Penalties escalate: $1,000 for a first violation, $5,000 for a second (regardless of whether the first was cured), and $10,000 for subsequent violations. All collected penalties go to the state general fund. DIAL must adopt implementing rules under Chapter 17A.
(1) This chapter shall not be construed to affect the admission or discovery of biometric dataBiometric data"Biometric data" means any information about or based on an individual's biometric identifier.Iowa Code § 554J.1(1) in a court action or in an administrative action under chapter 17A.
(2) This chapter shall not be construed to affect a contractor, subcontractor, or agent of a government entity while the contractor, subcontractor, or agent is acting in the capacity for which the government entity employed or contracted the contractor, subcontractor, or agent.
(3) This chapter shall not be construed to create a private right of action.
Section 554J.5 contains three interpretive limitations. The chapter does not affect admission or discovery of biometric data in court or administrative proceedings, does not apply to government contractors acting in their governmental capacity, and does not create a private right of action. These are savings and scope-limiting provisions that impose no new compliance obligations.