Section 603A.NEW - [Newly enacted section not yet numbered] [Restrictions on sale of consumer health data]1. A person shall not sell or offer to sell consumer health data:(a) Without the written authorization of the consumer to whom the data pertains; or(b) If the consumer provides such written authorization, in a manner that is outside the scope of or inconsistent with the written authorization.2. A person shall not condition the provision of goods or services on a consumer authorizing the sale of consumer health data pursuant to subsection 1.3. Written authorization pursuant to subsection 1 must be provided in a form written in plain language which includes, without limitation:(a) The name and contact information of the person selling the consumer health data;(b) A description of the specific consumer health data that the person intends to sell;(c) The name and contact information of the person purchasing the consumer health data;(d) A description of the purpose of the sale, including, without limitation, the manner in which the consumer health data will be gathered and the manner in which the person described in paragraph (c) intends to use the consumer health data;(e) A statement of the provisions of subsection 2;(f) A statement that the consumer may revoke the written authorization at any time and a description of the means established pursuant to subsection 4 for revoking the authorization;(g) A statement that any consumer health data sold pursuant to the written authorization may be disclosed to additional persons and entities by the person described in paragraph (c) and, after such disclosure, is no longer subject to the protections of this section;(h) The date on which the written authorization expires pursuant to subsection 5; and(i) The signature of the consumer to which the consumer health data pertains.4. A person who sells consumer health data shall establish a means by which a consumer may revoke a written authorization made pursuant to subsection 1.5. Written authorization provided pursuant to subsection 1 expires 1 year after the date on which the authorization is given.6. A written authorization provided pursuant to subsection 1 is not valid if the written authorization: (a) Was a condition for the provision of goods or services to the consumer in violation of subsection 2;(b) Does not comply with the requirements of subsection 3;(c) Has been revoked pursuant to subsection 4; or(d) Has expired pursuant to subsection 5.7. A person who sells consumer health data shall provide a copy of the written authorization provided pursuant to subsection 1 to the consumer who signed the written authorization and the purchaser of the consumer health data.8. A seller and purchaser of consumer health data shall each retain a copy of the written authorization provided pursuant to subsection 1 for at least 6 years after the date on which the written authorization expired pursuant to subsection 5.Added by 2023, Ch. 525,§30, eff. 3/31/2024.