Want to Read More? To continue reading this article, please Log in or Register Now

Employee Privacy: Iowa

Employee Privacy requirements for other states

Federal law and guidance on this subject should be reviewed together with this section.

Authors: Stuart R. Buttrick, Susan W. Kline and Ryann Ricchio, Faegre Baker Daniels LLP


Common Law Causes of Action

Iowa recognizes four causes of action for violations of privacy, including misappropriation/right of publicity, false light, publication of private facts, and intrusion.

Misappropriation/Right of Publicity

A person who uses the name or likeness of another individual for his or her own benefit may be liable for misappropriation/right of publicity. The use need not be for a commercial purpose or for pecuniary gain. See Stessman v. Am. Black Hawk Broad. Co., +416 N.W.2d 685 (Iowa 1987).

False Light

A person who gives publicity to a matter concerning another individual that places that other person in a false light may be liable for invasion of privacy. It the actor knew of or acted with reckless disregard regarding the falsity of the publicized matter and the false light would be highly offensive to a reasonable person, then the actor may incur liability for false light. See Winegard v. Larsen, +260 N.W.2d 816 (Iowa 1977).

Publication of Private Facts

A person who gives publicity to a matter concerning the private life of another may be liable for invasion of his privacy. If the actor publicizes facts that would be highly offensive to a reasonable person and is not of legitimate concern to the public, the actor may incur liability. If the facts are already public information, there can be no liability for publication of the facts. See Winegard v. Larsen, +260 N.W.2d 816 (Iowa 1977).

Intrusion on Seclusion

A person who intentionally intrudes upon the solitude or seclusion of another in a manner that would be highly offensive to a reasonable person may be liable for invasion of privacy. See Winegard v. Larsen, +260 N.W.2d 816 (Iowa 1977).

In at least one case, an Iowa court has held that an employee could not bring an invasion of privacy claim against his employer for searching through the contents of the employee's desk without the employee's knowledge. See O'Bryan v. KTIV Television, +868 F. Supp. 1146 (N.D. Iowa 1994). This was because the employee did not have a reasonable expectation of privacy in his desk or office area.

Statute of Limitations

Privacy claims are subject to a two-year statute of limitations under Iowa law. +Iowa Code § 614.1.

Negligent Hiring

Both physical and non-physical injuries, such as libel and defamation, can form the basis of a negligent hiring, retention or supervision claim against an employer. See Kiesau v. Bantz, +686 N.W.2d 164 (Iowa 2004).

Other Common Law Theories For Employer Liability


An employer may be liable for defamation of an employee or former employee if it publicizes written or oral statements that tend to injure the employee's reputation and good name. See Huegerich v. IBP, Inc., +547 N.W.2d 216, 221 (Iowa 1996). The statements generally must be false. For example, Iowa courts have held that an employer's statements accusing an employee of falsifying time cards or possessing illegal drugs are defamatory. See Lara v. Thomas, +512 N.W.2d 777, 785 (Iowa 1994); Vinson v. Linn-Mar Community Sch. Dist., +360 N.W.2d 108, 116 (Iowa 1984). Generally, the statements must be false and must be made to a third party.

Intentional Interference with Contract

Individuals have sued their former employers for providing false or damaging reference information to prospective employers. An employer may be liable for intentional interference with a contract if:

  • A former employee had a contract with a third party;
  • The employer knew of the contract
  • The employer intentionally and improperly interfered with the contract;
  • The interference caused the third party not to perform or made performance more burdensome or expensive; and
  • Damage to the former employee resulted.

See Jones v. Lake Park Care Ctr., Inc., +569 N.W.2d 369, (Iowa 1997). In certain circumstances, employers are immune against these types of suits if they provide reference information to a prospective employer. +Iowa Code § 91B.2. See Employer Protections.

Intentional Infliction of Emotional Distress

Individuals have also sued employers for intentional infliction of emotional distress (IIED). An employer may be liable for IIED if:

  • The employer engaged in outrageous conduct;
  • The employer intentionally caused, or recklessly disregarded the probability of causing, emotional distress;
  • The employee suffered severe or extreme emotional distress; and
  • The employer's outrageous conduct was the cause of the emotional distress.

See Vinson v. Linn-Mar Community Sch. Dist., +360 N.W.2d 108 (Iowa 1984) (the employer's accusing an employee of falsifying time cards was not sufficiently outrageous conduct to support the employee's IIED claim).

Wiretapping and Eavesdropping

Iowa's Interception of Electronic Communications statute prohibits a person from intercepting a wire, oral, or electronic communication by use of a mechanical, electronic or other device. +Iowa Code §§ 808B.1 et seq. A person is also prohibited from disclosing information that was illegally intercepted and from requesting others to engage in illegal interception of messages. There are exceptions, including if one of the parties to the communication gave prior consent. Violation of the act is a Class D felony. +Iowa Code § 808B.2 and +Iowa Code § 902.9. A person whose communications are unlawfully intercepted, disclosed or used in violation of the law may bring a civil action against the wrongdoer for actual damages, liquidated damages, punitive damages, reasonable attorneys' fees, and costs. +Iowa Code § 808B.8.

Iowa law also prohibits electronic and mechanical eavesdropping. A person cannot connect a listening device or tap into telephone or other communication wires. +Iowa Code § 727.8. The law also prohibits a person from listening, recording or otherwise interception conversations or communications of any kind. The law does not prohibit a party to the communication from recording the communication. Violation of the act is a serious misdemeanor. +Iowa Code § 727.8 and +Iowa Code § 903.1.


In Iowa, it is an invasion of privacy when someone, for the purpose of arousing or gratifying the sexual desire of any person, knowingly views, photographs, or films another person who is in a full or partial state of nudity without his/her knowledge or consent. The person being viewed, photographed, or filmed must have a reasonable expectation of privacy at that time. Violation of this statutory provision is punishable as a serious misdemeanor. +Iowa Code § 709.21.

Security Breach

The Iowa Personal Information Security Breach law requires entities that maintain, possess or store computerized data that includes personal information to notify affected Iowa residents when there is a breach of security and the entity discovers the breach. +Iowa Code 715C.2. Personal information is defined as an individual's first name or initial and last name coupled with other identifying information, such as social security number and driver's license number.

Polygraph Testing

Iowa law prohibits employers from requesting or requiring a job applicant to take a polygraph test. +Iowa Code § 730.4. An employer cannot request an applicant to waive his or her right under the law or condition an offer of employment on such waiver. Applicants have a private right of action against employers who violate the law and may seek injunctive relief, damages, costs, and reasonable attorney's fees.

Public employers are provided some exemptions from the law and can require applicants for certain positions, e.g., a law enforcement officer, to take a polygraph test.

Iowa law defines a polygraph test as any procedure, including lie detector and similar tests that uses a device or instrumentation to assist in verification of truthfulness or detection of deception.

Personnel Files

Employers should be aware that Iowa law grants employees the right to inspect their personnel files. Employees do not have the right to examine any employment references written for him or her. The employer and employee must agree on a time the employee may access his or her personnel file. +Iowa Code § 91B.1.


Employers that provide references to a former employee's prospective employer may be exposed to numerous theories of liability, including defamation and tortious interference with a contract or prospective contract. However, Iowa law does provide some protections for employers.

In addition to potential criminal liability, employers providing references to prospective employers about their former employees may be vulnerable to civil liability under numerous theories, including statutory violations and common law causes of action. Such common law causes of action include, for example, defamation and tortious interference with a contract or prospective contract. However, Iowa law does provide some protections for employers.

Employer Protections

Unless their actions are unreasonable, employers that provide work-related information concerning current or former employees are immune from civil liability. +Iowa Code § 91B.2.

The work-related information must be provided upon either:

  • The request or authorization of the employee; or
  • The request of a person the employer in good faith believes is a representative of a former or current employee's prospective employer.

If the employer acted unreasonably when providing the work-related information, the employer will not be afforded immunity by the statute. An employer acts unreasonably if:

  • The work-related information violates the employee's civil rights;
  • The employer knowingly provided work-related information to someone who does not have a legitimate and common interest in receiving it; or
  • The employer provided the work-related information (a) with malice, (b) without a good faith belief in its truth, or (c) that is not relevant to the inquiry.

In addition to the protections afforded by this statute, former employers that provide references to prospective employers may have a qualified privilege defense afforded by common law against defamation suits. However, the qualified privilege will be lost if the scope of the disclosure exceeds the privilege or the privilege is abused including, for example, if the employer entertained serious doubts about the statement's truth or if the employer relayed the statement to improper parties.

Employers should obtain written authorization from the job applicant/employee that identifies the parties who are authorized to provide and receive information contained in a work reference. Employers should be careful not to provide or request information that is not work-related or that exceeds the scope of the information authorized in the written authorization.

Further, Iowa's drug testing statute provides a defense to defamation actions if the requirements of the statute are met. See Drug Testing.


Iowa law prohibits employers from blacklisting former employees or attempting to prevent former employees from obtaining other employment. +Iowa Code § 730.2. The law applies to former employees who voluntarily left employment or who were discharged. Former employers may provide, upon request, a writing containing a truthful statement concerning the cause of discharge. +Iowa Code § 730.1.

A former employee who is harmed by an employer's violation of the law has a private right of action against the employer and may seek triple damages. +Iowa Code § 730.2. Employers who violate the law may also be guilty of a serious misdemeanor.

Reference Checks For Former Public Employees

If a job applicant was a former public employee, an employer can take advantage of Iowa's open records act to obtain useful information about the applicant's employment history.

Recent amendments to the law permit governmental bodies to disclose the following information about state employees:

  • Name;
  • Dates of employment;
  • Compensation;
  • Positions held;
  • Educational background;
  • Employment history and names of previous employers; and
  • Whether the employee was terminated after final disciplinary action.

Genetic Testing

Iowa law makes it unlawful for an employer:

  • To ask or require an employee to take a genetic test;
  • To condition the terms of employment on an employee's taking a genetic test;
  • To enter into an agreement with an employee offering pay or other benefits in return for taking a genetic test; or
  • To retaliate against an employee for filing a complaint against the employer for violating the genetic testing law.

+Iowa Code § 729.6.

The law does not prohibit employees from requesting genetic testing for purposes of a workers' compensation claim or exposure to potentially toxic substances or chemicals in the workplace. The employee must give written, informed consent. The employer cannot take any adverse action against the employee based on the test results. Employees have a private right of action against employers who violate the genetic testing law and may seek injunctive relief, damages, costs, and reasonable attorneys' fees.

Drug Testing

If an employer requires job applicants or employees to undergo drug or alcohol testing, the employer must ensure that the records concerning the testing only show, or make use of, information regarding alcohol or drugs in the body. +Iowa Code § 730.5. Before conducting any tests, Iowa law requires employers to establish a written drug and alcohol testing policy that contains specific content. For example, the policy must state:

  • The standard for alcohol content that violates the policy (.02 BAC). See +2017 Bill Text IA H.B. 2383.
  • Uniform disciplinary or rehabilitative requirements that will be imposed against an employee or job applicant in the event of a confirmed positive test result or a refusal to provide a sample; and
  • Any action taken against the job applicant or employee will be based only on the test results.

+Iowa Code § 730.5.

Employers should provide job applicants and employees the policy in advance of testing and should make the policy available for review. The statute imposes special requirements if the job applicant is a minor. Employers must provide a copy of the policy to the minor's parent and obtain an acknowledgment of receipt from the parent. See Recruiting and Hiring > Preemployment Screening and Testing: Iowa.

All confirmatory drug testing must be conducted at a laboratory certified by the U.S. or Iowa departments of health. +Iowa Code § 730.5 and +641 Iowa Admin. Code 12.1(730) et seq. An employer must inform an employee with a confirmed positive test result that the employee has the right to access any records relating to the employee's drug or alcohol test, including the records of the laboratory where the testing was conducted, upon the written request of the employee. The employer must provide the employee access to the records if the employee so requests. Prospective employees must make requests within 15 days of receiving notice of the results of the drug or alcohol test. +Iowa Code § 730.5.

Except as provided by law, communications received through the employer's drug or alcohol testing program are confidential and cannot be disclosed by the employer. Iowa law does permit disclosure in certain circumstance, including:

  • During proceedings for unemployment insurance or workers' compensation claims; and
  • To substance abuse facilities or other professionals for purposes of treating or evaluating the employee.

+Iowa Code § 730.5.

Employer Protections

Employers that establish a drug or alcohol testing program in accordance with the statute are immune from liability in certain circumstances. For example, if an employer makes an employment decision based on an employee's false positive test result, the employer is immune from civil liability unless they knew or clearly should have known the results were erroneous and ignored the correct results because of recklessness, maliciousness, negligence or willful intent to be deceived (or to deceive). Employers that rely on a false positive result reasonably and in good faith are not liable for monetary damages. +Iowa Code § 730.5.

Employers establishing "a program of drug or alcohol testing in accordance" with the statute are not liable for defamation or reputational injury unless:

  • They disclose the test result to a person not authorized to receive the results, i.e. any person other than the employer, an authorized agent of the employer, the tested applicant, an authorized representative of the applicant, or an authorized EAP program or substance abuse treatment program;
  • The test result is a false positive; and
  • Their disclosure was negligent.

+Iowa Code § 730.5.

Employers who violate the statute may be required to pay lost wages, attorney fees, and provide other relief such as reinstatement. Iowa's drug-testing law is relatively detailed and employers should consult counsel when implementing a drug-testing program or to ensure that an existing drug-testing program complies with the law. +Iowa Code § 730.5.

Hair Testing

Pursuant to an amendment to Iowa's drug testing law, an employer may conduct hair testing of prospective employees. The amendment further provides that samples are subject to standards adopted by the United States Department of Health and Human Services' Substance Abuse and Mental Health Services Administration. If nationally accepted standards have not been adopted to test a particular specimen, the standard used must be the same standard that has been cleared or approved by the Food and Drug Administration for the particular specimen testing utilized. The amended law provides that testing of a hair sample shall be limited to samples not longer than one and one-half inches. Testing of a hair sample shall be limited to the portion of the hair that was closest to the skin.

+Iowa Code § 730.5; +2017 Bill Text IA S.B. 32.

See Preemployment Screening and Testing: Iowa.

AIDS/HIV Testing

Iowa law prohibits employers from asking or requiring employees to take HIV tests. Employers cannot condition terms of employment, such as discipline, discharge or pay, on an employee's agreement to take a test and cannot factor an employee's HIV or AIDS status into employment decisions. +Iowa Code § 216.6(1). Iowa law makes records concerning HIV tests confidential and the records can only be disclosed under certain circumstances. +Iowa Code § 141A.9.

The law against HIV and AIDS status discrimination does not apply in the event Iowa's Director of Public Health determines that the occupation is such that there is a risk of transmission of HIV from employees infected with the disease. +Iowa Code § 216.6(1)(d).

Medical Testing

With respect to medical testing, Iowa's anti-discrimination law generally follows federal anti-discrimination laws. Employers may not request a medical test or make any medical inquiries prior to making a conditional job offer to the applicant. The employer may not withdraw a conditional offer based on test results unless the unfavorable results are job related and consistent with business necessity. See Recruiting and Hiring > Recruiting: Iowa.


Employers must segregate an employee's medical information from the rest of the employee's personnel file. Employers must also ensure that medical records are treated as confidential. See Preemployment Screening and Testing > Medical Testing.

In addition to confidentiality obligations and concerns under anti-discrimination statutes, employers should be aware that Iowa law closely regulates the disclosure of medical records, particularly those concerning mental health and AIDS. Iowa Code Chapters 228, 141A. For example, Iowa law prohibits any person possessing psychological test material from disclosing the material, including disclosure to the test subject, although the test subject can request disclosure to a designated licensed psychologist. +Iowa Code § 228.9.

Criminal Records

Criminal investigation files of law enforcement agencies are subject to the confidentiality provisions of Iowa's public records act. +Iowa Code § 22.7(9). However, records of an employee's arrest history and criminal history are considered public records. Id. An employer may request an employee's criminal history from the Iowa Department of Public Safety, Division of Criminal Investigation.

Employers will need a signed release from an employee to obtain criminal history data concerning:

Employers should note that an applicant's record as maintained by the Iowa Department of Public Safety does not include:

  • Arrests that resulted in acquittal or dismissal, with the exception of certain types of acquittals and dismissals, e.g., an acquittal by reason of insanity or adjudications of mental incompetence;
  • Certain juvenile records; or
  • Certain traffic offenses.

See also Recruiting and Hiring > Preemployment Screening and Testing > Criminal Records: Iowa.

Future Developments

There are no new developments to report at this time. Continue to check XpertHR regularly for the latest information on this and other topics.

Additional Resources

Employee Management > Employee Privacy

Recruiting and Hiring > Preemployment Screening and Testing: Iowa