Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party social media tools that collect personal information in Iowa? What are the requirements?

Based on the context documents, there are specific requirements for the release of personal information in Iowa.

Regarding third-party social media tools that collect personal information, there are no specific regulations in Iowa that address this issue. However, Iowa law requires that licensees exercise due diligence in the selection of third-party service providers, conduct oversight of all third-party service provider arrangements, and require all third-party service providers to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the licensee’s third-party service providers [7.1].

If the third-party social media tool collects personal information of employees of the department who are officers as defined in Iowa Code section 80F.1, the release of their personal information is subject to specific requirements. An official photograph of or personal information about an employee of the department who is an officer shall be released only if either the employee has signed a written release giving permission to release the photograph or personal information or a request has been received to release the photograph or personal information pursuant to Iowa Code chapter 22. A photograph of or personal information about any employee of the department shall not be released if its release could jeopardize an ongoing investigation or place the employee at risk. An officer’s personal information, including but not limited to the officer’s home address, personal telephone number, personal electronic mail address, date of birth, social security number, and driver’s license number, shall be confidential and redacted prior to a record’s release to the public by the department [1.1].

If the third-party social media tool collects personal information in the possession of a public agency, the agency shall not release, publicize, or otherwise disclose personal information in the possession of the public agency without the express, written permission of every member, supporter, volunteer, and donor of the tax-exempt entity identified in the information and the tax-exempt entity [2.1].

If the third-party social media tool collects personal information related to motor vehicle records, the department shall require a requester who requests personal information or highly restricted personal information about another individual to complete Form 431069, “Privacy Act Agreement for Request of Motor Vehicle Records,” and submit the form to any driver’s license service center or the motor vehicle division. The department shall require a requester who requests personal information or highly restricted personal information about themselves to either complete and submit Part A of Form 431069, “Privacy Act Agreement for Request of Motor Vehicle Records,” including a photocopy of the requester’s driver’s license or nonoperator’s identification card or provide valid proof of the requester’s identity to any driver’s license service center or the motor vehicle division. Personal information and highly restricted personal information, except for an individual’s photograph or image, may be disclosed with the express written consent of the individual or vehicle owner to whom such information applies. When the requester has obtained the written consent of the individual or vehicle owner to whom the information applies, the requester must attach that written consent on a completed Form 431069, “Privacy Act Agreement for Request of Motor Vehicle Records,” and submit the form to any driver’s license service center or the motor vehicle division [3.2].

If the third-party social media tool collects social security numbers, an individual applying for a license from a board within the bureau shall disclose the individual’s social security number on the application form unless the applicant demonstrates to the satisfaction of the board that the applicant does not possess and is not eligible for a social security number or the applicant demonstrates or attests that the applicant is in the process of applying for a social security number and will provide such number within 60 days of the date on which the applicant submits the application to the board. The license of an applicant who is licensed pursuant to this subrule may be revoked for failure to provide a valid social security number within 60 days of the date on which the application was filed. An applicant who does not possess a social security number and is not eligible for a social security number will be required to demonstrate lawful presence in the United States, if applicable, and provide government-issued photo identification as needed to verify identity. If circumstances change and the applicant or licensee later attains a social security number, the applicant or licensee shall disclose the social security number to the board within 30 days of the date on which the social security number is issued [4.1][5.1].

In summary, there are no specific regulations in Iowa that address the use of third-party social media tools that collect personal information. However, Iowa law requires that licensees exercise due diligence in the selection of third-party service providers, conduct oversight of all third-party service provider arrangements, and require all third-party service providers to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the licensee’s third-party service providers. If the third-party social media tool collects personal information subject to specific requirements, such as motor vehicle records or personal information of employees who are officers, the release of such information is subject to specific requirements. If the third-party social media tool collects social security numbers, there are specific requirements for disclosure.

Source(s):
Jurisdiction

Iowa