Iowa introduced a new bill, SSB 3200, on February 20 to establish a state privacy breach notification law.
As originally worded it would have also required merchants to follow credit and debit card industry data security rules and make them liable to banks for costs they incurred after a breach of payment card transaction data not retained in compliance with those rules. However, in the past week SSB 3200 was amended in committee to remove the retailer liability provisions.
A companion bill, HSB 721, was introduced February 26.