103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB2979

 

Introduced 1/31/2024, by Sen. Bill Cunningham

 

SYNOPSIS AS INTRODUCED:
 
740 ILCS 14/10
740 ILCS 14/20

    Amends the Biometric Information Privacy Act. Defines "electronic signature" as an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record. Provides that "written release" includes an electronic signature. Provides that a private entity that more than once collects or discloses a person's biometric identifier or biometric information from the same person in violation of the Act has committed a single violation for which the aggrieved person is entitled to, at most, one recovery. Effective immediately.


LRB103 36771 JRC 66881 b

 

 

A BILL FOR

 

SB2979LRB103 36771 JRC 66881 b

1    AN ACT concerning civil law.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Biometric Information Privacy Act is
5amended by changing Sections 10 and 20 as follows:
 
6    (740 ILCS 14/10)
7    Sec. 10. Definitions. In this Act:
8    "Biometric identifier" means a retina or iris scan,
9fingerprint, voiceprint, or scan of hand or face geometry.
10Biometric identifiers do not include writing samples, written
11signatures, photographs, human biological samples used for
12valid scientific testing or screening, demographic data,
13tattoo descriptions, or physical descriptions such as height,
14weight, hair color, or eye color. Biometric identifiers do not
15include donated organs, tissues, or parts as defined in the
16Illinois Anatomical Gift Act or blood or serum stored on
17behalf of recipients or potential recipients of living or
18cadaveric transplants and obtained or stored by a federally
19designated organ procurement agency. Biometric identifiers do
20not include biological materials regulated under the Genetic
21Information Privacy Act. Biometric identifiers do not include
22information captured from a patient in a health care setting
23or information collected, used, or stored for health care

 

 

SB2979- 2 -LRB103 36771 JRC 66881 b

1treatment, payment, or operations under the federal Health
2Insurance Portability and Accountability Act of 1996.
3Biometric identifiers do not include an X-ray, roentgen
4process, computed tomography, MRI, PET scan, mammography, or
5other image or film of the human anatomy used to diagnose,
6prognose, or treat an illness or other medical condition or to
7further validate scientific testing or screening.
8    "Biometric information" means any information, regardless
9of how it is captured, converted, stored, or shared, based on
10an individual's biometric identifier used to identify an
11individual. Biometric information does not include information
12derived from items or procedures excluded under the definition
13of biometric identifiers.
14    "Confidential and sensitive information" means personal
15information that can be used to uniquely identify an
16individual or an individual's account or property. Examples of
17confidential and sensitive information include, but are not
18limited to, a genetic marker, genetic testing information, a
19unique identifier number to locate an account or property, an
20account number, a PIN number, a pass code, a driver's license
21number, or a social security number.
22    "Electronic signature" means an electronic sound, symbol,
23or process attached to or logically associated with a record
24and executed or adopted by a person with the intent to sign the
25record.
26    "Private entity" means any individual, partnership,

 

 

SB2979- 3 -LRB103 36771 JRC 66881 b

1corporation, limited liability company, association, or other
2group, however organized. A private entity does not include a
3State or local government agency. A private entity does not
4include any court of Illinois, a clerk of the court, or a judge
5or justice thereof.
6    "Written release" means informed written consent,
7electronic signature, or, in the context of employment, a
8release executed by an employee as a condition of employment.
9(Source: P.A. 95-994, eff. 10-3-08.)
 
10    (740 ILCS 14/20)
11    Sec. 20. Right of action.
12    (a) Any person aggrieved by a violation of this Act shall
13have a right of action in a State circuit court or as a
14supplemental claim in federal district court against an
15offending party. A prevailing party may recover for each
16violation:
17        (1) against a private entity that negligently violates
18    a provision of this Act, liquidated damages of $1,000 or
19    actual damages, whichever is greater;
20        (2) against a private entity that intentionally or
21    recklessly violates a provision of this Act, liquidated
22    damages of $5,000 or actual damages, whichever is greater;
23        (3) reasonable attorneys' fees and costs, including
24    expert witness fees and other litigation expenses; and
25        (4) other relief, including an injunction, as the

 

 

SB2979- 4 -LRB103 36771 JRC 66881 b

1    State or federal court may deem appropriate.
2    (b) For purposes of subsection (b) of Section 15, a
3private entity that, in more than one instance, collects,
4captures, purchases, receives through trade, or otherwise
5obtains the same biometric identifier or biometric information
6from the same person using the same method of collection in
7violation of subsection (b) of Section 15 has committed a
8single violation of subsection (b) of Section 15 for which the
9aggrieved person is entitled to, at most, one recovery under
10this Section.
11    (c) For purposes of subsection (d) of Section 15, a
12private entity that, in more than one instance, discloses,
13rediscloses, or otherwise disseminates the same biometric
14identifier or biometric information from the same person to
15the same recipient using the same method of collection in
16violation of subsection (d) of Section 15 has committed a
17single violation of subsection (d) of Section 15 for which the
18aggrieved person is entitled to, at most, one recovery under
19this Section regardless of the number of times the private
20entity disclosed, redisclosed, or otherwise disseminated the
21same biometric identifier or biometric information of the same
22person to the same recipient.
23(Source: P.A. 95-994, eff. 10-3-08.)
 
24    Section 99. Effective date. This Act takes effect upon
25becoming law.