SB1995sam001 104TH GENERAL ASSEMBLY

Sen. Graciela Guzmán

Filed: 3/6/2026

10400SB1995sam001 LRB104 10883 SPS 34798 a

AMENDMENT TO SENATE BILL 1995

AMENDMENT NO. ______. Amend Senate Bill 1995 by replacing everything after the enacting clause with the following:

"Section 5. The Freedom of Information Act is amended by changing Section 2 as follows:

(5 ILCS 140/2) (from Ch. 116, par. 202)

Sec. 2. Definitions. As used in this Act:

(a) "Public body" means all legislative, executive, administrative, or advisory bodies of the State, state universities and colleges, counties, townships, cities, villages, incorporated towns, school districts and all other municipal corporations, boards, bureaus, committees, or commissions of this State, any subsidiary bodies of any of the foregoing including but not limited to committees and subcommittees thereof, and a School Finance Authority created under Article 1E of the School Code. "Public body" does not include a child death review team or the Illinois Child Death Review Teams Executive Council established under the Child Death Review Team Act, or a regional youth advisory board or the Statewide Youth Advisory Board established under the Department of Children and Family Services Statewide Youth Advisory Board Act.

(b) "Person" means any individual or any individual acting as an agent of a corporation, partnership, firm, organization or association, acting individually or as a group.

(c) "Public records" means all records, reports, forms, writings, letters, memoranda, books, papers, maps, photographs, microfilms, cards, tapes, recordings, electronic data processing records, electronic communications, recorded information and all other documentary materials pertaining to the transaction of public business, regardless of physical form or characteristics, having been prepared by or for, or having been or being used by, received by, in the possession of, or under the control of any public body. "Public records" does not include junk mail.

(c-5) "Private information" means unique identifiers, including a person's social security number, driver's license number, employee identification number, biometric identifiers, personal financial information, passwords or other access codes, medical records, home or personal telephone numbers, and personal email addresses. "Private information" also includes home address and personal license plates, except as otherwise provided by law or when compiled without possibility of attribution to any person.

Except as required under 8 U.S.C. 1373 and 1644, "private information" includes immigration or citizenship status information. As used in this subsection, "immigration or citizenship status information" means any information concerning (i) an individual's status as a citizen of the United States or any other country or (ii) the legal right, or lack thereof, of an individual to reside in or otherwise to be present in the United States. "Immigration or citizenship status information" includes an individual's nationality and country of origin.

For a public body that is a HIPAA-covered entity, "private information" includes electronic medical records and all information, including demographic information, contained within or extracted from an electronic medical records system operated or maintained by the public body in compliance with State and federal medical privacy laws and regulations, including, but not limited to, the Health Insurance Portability and Accountability Act and its regulations, 45 CFR Parts 160 and 164. As used in this subsection, "HIPAA-covered entity" has the meaning given to the term "covered entity" in 45 CFR 160.103.

(c-10) "Commercial purpose" means the use of any part of a public record or records, or information derived from public records, in any form for sale, resale, or solicitation or advertisement for sales or services. For purposes of this definition, requests made by news media and non-profit, scientific, or academic organizations shall not be considered to be made for a "commercial purpose" when the principal purpose of the request is (i) to access and disseminate information concerning news and current or passing events, (ii) for articles of opinion or features of interest to the public, or (iii) for the purpose of academic, scientific, or public research or education.

(d) "Copying" means the reproduction of any public record by means of any photographic, electronic, mechanical or other process, device or means now known or hereafter developed and available to the public body.

(e) "Head of the public body" means the president, mayor, chairman, presiding officer, director, superintendent, manager, supervisor or individual otherwise holding primary executive and administrative authority for the public body, or such person's duly authorized designee.

(f) "News media" means a newspaper or other periodical issued at regular intervals whether in print or electronic format, a news service whether in print or electronic format, a radio station, a television station, a television network, a community antenna television service, or a person or corporation engaged in making news reels or other motion picture news for public showing.

(g) "Recurrent requester", as used in Section 3.2 of this Act, means a person that, in the 12 months immediately preceding the request, has submitted to the same public body (i) a minimum of 50 requests for records, (ii) a minimum of 15 requests for records within a 30-day period, or (iii) a minimum of 7 requests for records within a 7-day period. For purposes of this definition, requests made by news media and non-profit, scientific, or academic organizations shall not be considered in calculating the number of requests made in the time periods in this definition when the principal purpose of the requests is (i) to access and disseminate information concerning news and current or passing events, (ii) for articles of opinion or features of interest to the public, or (iii) for the purpose of academic, scientific, or public research or education.

For the purposes of this subsection (g), "request" means a written document (or oral request, if the public body chooses to honor oral requests) that is submitted to a public body via personal delivery, mail, telefax, electronic mail, or other means available to the public body and that identifies the particular public record the requester seeks. One request may identify multiple records to be inspected or copied.

(h) "Voluminous request" means a request that: (i) includes more than 5 individual requests for more than 5 different categories of records or a combination of individual requests that total requests for more than 5 different categories of records in a period of 20 business days; or (ii) requires the compilation of more than 500 letter or legal-sized pages of public records unless a single requested record exceeds 500 pages. "Single requested record" may include, but is not limited to, one report, form, e-mail, letter, memorandum, book, map, microfilm, tape, or recording.

"Voluminous request" does not include a request made by news media and non-profit, scientific, or academic organizations if the principal purpose of the request is: (1) to access and disseminate information concerning news and current or passing events; (2) for articles of opinion or features of interest to the public; or (3) for the purpose of academic, scientific, or public research or education.

For the purposes of this subsection (h), "request" means a written document, or oral request, if the public body chooses to honor oral requests, that is submitted to a public body via personal delivery, mail, telefax, electronic mail, or other means available to the public body and that identifies the particular public record or records the requester seeks. One request may identify multiple individual records to be inspected or copied.

(i) "Severance agreement" means a mutual agreement between any public body and its employee for the employee's resignation in exchange for payment by the public body.

(j) "Junk mail" means (i) any unsolicited commercial mail sent to a public body and not responded to by an official, employee, or agent of the public body or (ii) any unsolicited commercial electronic communication sent to a public body and not responded to by an official, employee, or agent of the public body.

(Source: P.A. 103-554, eff. 1-1-24; 104-438, eff. 1-1-26.)

Section 10. The State Records Act is amended by adding Section 4b as follows:

(5 ILCS 160/4b new)

Sec. 4b. Immigration and citizenship status information.

(a) For purposes of this Section, "immigration and citizenship status" means any matter concerning (i) an individual's status as a citizen of the United States or any other country or (ii) the legal right, or lack thereof, of an individual to reside in or otherwise to be present in the United States. "Immigration or citizenship status information" includes an individual's nationality and country of origin.

(b) Unless required by statute, federal regulation, court order, or a lawfully issued judicial warrant, no agency shall:

(1) request, inquire about, or investigate the immigration or citizenship status or place of birth of any person; or

(2) include as part of an application, questionnaire, or interview form used in relation to any benefits, opportunities, or services provided by the State any questions regarding immigration and citizenship status.

(c) All agencies shall annually review all materials described in paragraph (2) of subsection (b) and modify the materials to conform with the requirements of this Section.

Section 15. The Local Records Act is amended by adding Section 3d as follows:

(50 ILCS 205/3d new)

Sec. 3d. Immigration and citizenship status information.

(a) For purposes of this section, "immigration and citizenship status" means any matter concerning (i) an individual's status as a citizen of the United States or any other country or (ii) the legal right, or lack thereof, of an individual to reside in or otherwise to be present in the United States. "Immigration or citizenship status information" includes an individual's nationality and country of origin.

(b) Unless required by statute, federal regulation, court order, or a lawfully issued judicial warrant, no agency shall:

(1) request, inquire about, or investigate the immigration or citizenship status or place of birth of any person; or

(2) include as part of an application, questionnaire, or interview form used in relation to any benefits, opportunities, or services provided by the unit of local government any questions regarding immigration and citizenship status.

(c) All agencies shall annually review all materials described in paragraph (2) of subsection (b) and modify the materials to conform with the requirements of this Section.

Section 20. The Personal Information Protection Act is amended by changing Sections 5 and 45 as follows:

(815 ILCS 530/5)

Sec. 5. Definitions. In this Act:

"Data collector" may include, but is not limited to, government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information.

"Breach of the security of the system data" or "breach" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. "Breach of the security of the system data" does not include good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, provided that the personal information is not used for a purpose unrelated to the data collector's business or subject to further unauthorized disclosure.

"Health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any medical information in an individual's health insurance application and claims history, including any appeals records.

"Immigration or citizenship status information" means any information concerning (i) an individual's status as a citizen of the United States or any other country or (ii) the legal right, or lack thereof, of an individual to reside in or otherwise to be present in the United States. "Immigration or citizenship status information" includes an individual's nationality and country of origin.

"Medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional, including such information provided to a website or mobile application.

"Personal information" means either of the following:

(1) An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the name or data elements have been acquired without authorization through the breach of security:

(A) Social Security number.

(B) Driver's license number or State identification card number.

(C) Account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account.

(D) Medical information.

(E) Health insurance information.

(F) Unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee to authenticate an individual, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data.

(G) Immigration or citizenship status information.

(2) User name or email address, in combination with a password or security question and answer that would permit access to an online account, when either the user name or email address or password or security question and answer are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the data elements have been obtained through the breach of security.

"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

"Publicly available information" means information that a person lawfully obtains from a record of a governmental entity, if the person collects, processes, and transfers the information in accordance with any restrictions or terms of use placed on the information by the relevant government entity.

(Source: P.A. 99-503, eff. 1-1-17.)

(815 ILCS 530/45)

Sec. 45. Data security.

(a) A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

(a-5) A data collector shall not sell, share, distribute, or otherwise disclose the personal information of an individual if the data collector:

(1) knows or should know that the recipient seeks the information for the purpose of immigration enforcement; and

(2) has not been presented with:

(A) a lawful court order;

(B) a judicial warrant signed by a judge appointed pursuant to Article III of the Constitution of the United States; or

(C) a subpoena for individual records issued by a federal or State court.

A data collector shall take reasonable steps to determine whether any person seeking access to the personal information does so for the purpose of enforcing immigration law.

(b) A contract for the disclosure of personal information concerning an Illinois resident that is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

(c) If a state or federal law requires a data collector to provide greater protection to records that contain personal information concerning an Illinois resident that are maintained by the data collector and the data collector is in compliance with the provisions of that state or federal law, the data collector shall be deemed to be in compliance with the provisions of this Section.

(d) A data collector that is subject to and in compliance with the standards established pursuant to Section 501(b) of the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. Section 6801, shall be deemed to be in compliance with the provisions of this Section.

(Source: P.A. 99-503, eff. 1-1-17.)".