CHAPTER 1073 REGIONAL TRANSIT DISTRICT CUSTOMER DATA — DISCLOSURE RESTRICTIONS
AN ACT restricting disclosures of specified information by regional transit districts, and providing a penalty.
Be It Enacted by the General Assembly of the State of Iowa:
Section 1. Section 28M.1, Code 2014, is amended by adding the following new subsections: NEW SUBSECTION. 0A. “Aggregate data on user and customer transaction history and
fare card use” means data relating to the dates fare cards were used, the times fare cards were used, the types of transit services used, the types of fare products used, and information about the dates, times, and types of fare products purchased. NEW SUBSECTION. 1B. “Fare collection system” means a system created and
administered by a regional transit district that is used for collecting fares or providing fare cards or passes for public transit services including fixed-route bus service, paratransit bus service, rideshare programs, transportation services provided pursuant to section 249A.12, and light rail or commuter rail service. NEW SUBSECTION. 1C. “Governmental entity” means the same as defined in section
8A.101. NEW SUBSECTION. 1D. “Personalized internet services” means services for which
regional transit district applicants, users, and customers must establish an internet user account.
Sec. 2. NEW SECTION. 28M.7 Regional transit district customer data — disclosure restrictions — penalty. 1. Data concerning applicants, users, and customers of a regional transit district collected
by or through personalized internet services or a fare collection system shall be considered private and not subject to disclosure except as provided in this section. 2. A regional transit district may disclose aggregate data on user and customer transaction
history and fare card use to government entities, organizations, school districts, educational institutions, and employers that subsidize or provide fare cards to their clients, students, or employees. Government entities, organizations, school districts, educational institutions, and employers may use the aggregate data only for purposes of measuring and promoting fare card use and evaluating the cost-effectiveness of their fare card programs. The disclosure of nonaggregate or personalized data on user and customer transaction history and fare card use to government entities, organizations, school districts, educational institutions, and employers shall be strictly prohibited. 3. A regional transit district may disclose data concerning applicants, users, and customers
collected by or through personalized internet services or a fare collection system to another government entity to prevent a breach of security regarding electronic systems maintained by the regional transit district or the governmental entity, or pursuant to a subpoena issued in connection with a civil or criminal investigation. 4. A violation of this section is punishable by a civil penalty in an amount not to exceed five
thousand dollars for each violation.
Approved April 3, 2014
Thu Aug 14 17:00:11 2014 1/ 1