Companies doing business in Iowa or targeting products/services to Iowa consumers are subject to the Iowa Act Relating to Consumer Data Protection ("ICDPA"). The ICDPA will require that consumers are supplied with a privacy notice that includes:

• categories of personal data processed and shared with third parties;
• the third parties with which personal data is shared;
• purposes for which personal data is processed; and
• how subjects can exercise their consumer data rights.

The law applies if a business controls or processes personal data of at least 100,000 Iowa consumers or 25,000 Iowa consumers from which the business derives over 50 percent of gross revenue from the sale of personal data.

It is important to note that the law includes both entity- and data-level exemptions for certain entities and scenarios including:

• Consumer reporting agencies, furnishers or users of a consumer report to the extent such activity is regulated by the Fair Credit Reporting Act ("FCRA")
• Financial institutions, affiliates of financial institutions and data subject to the Gramm-Leach-Bliley Act ("GLBA")
• Organizations subject to Health Insurance Portability and Accountability Act ("HIPAA") and personal health information (PHI) covered by HIPAA
• Specifically defined nonprofit organizations and higher education institutions
• Data handled in compliance with the Driver's Privacy Protection Act ("DPPA")
• Data regulated by Family Educational Rights and Privacy Act ("FERPA")

Following a two-year implementation process after an April 2021 update to the bill, Michigan residents will have certain convictions automatically cleared from their public records.

Under the new law, a computer-based program has been developed for the setting aside of certain convictions. Convictions are eligible for automatic expungement include:

• Unlimited misdemeanors punishable by less than 92 days imprisonment, after seven years have passed since the date of imposition of the sentence;
• No more than four misdemeanors punishable by 93 days or more of imprisonment, after seven years have passed since the imposition of the sentence; and
• No more than two felonies after ten years have passed since the imposition of a sentence or completion of any term of imprisonment with the Michigan Department of Corrections, whichever occurs later.

Automatic expungement will only occur if there are no pending criminal charges or additional criminal offenses recorded in the Michigan State Police Criminal History Record database against the individual since the seven- or ten-year period.

Convictions of the following types are not eligible for automatic expungement:

• An assaultive crime;
• A serious misdemeanor;
• A crime of dishonesty;
• Any other offense punishable by ten or more year's imprisonment;
• Crimes involving minors, vulnerable adults, injury or serious impairment, or death;
• Human trafficking violations; and
• Certain traffic offenses, including:
• Operating while intoxicated;
• Committing a traffic offense while operating a commercial vehicle as a CDL holder; and
• A traffic offense involving injury or death.

These cleaned records are no longer accessible by public record. Therefore, as a result, certain records that used to be reportable to employers may no longer appear on a consumer report.

Austin officials say that these bills could remove the Fair Chance Hiring Ordinance protections which bans employers from asking job applicants about their criminal history until after an interview.

The CFPB has provided an updated model form.