SB3816 104TH GENERAL ASSEMBLY

LRB104 20207 LNS 33658 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3816

Introduced 2/6/2026, by Sen. Celina Villanueva

SYNOPSIS AS INTRODUCED:

New Act
5 ILCS 140/7

Creates the Automated License Plate Recognition System Act. Sets forth provisions regarding authorized uses of an automated license plate recognition system, data retention, prohibited uses of an automated license plate recognition system, restrictions, requirements for use, preservation and disclosure, required data collection, reporting requirements, admissibility, privacy, penalties, and a private right of action. Makes a conforming change in the Freedom of Information Act. Effective immediately.

A BILL FOR

AN ACT concerning transportation.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Automated License Plate Recognition System Act.

Section 5. Definitions. As used in this Act:

"ALPR user" means a person or entity that owns or operates an ALPR device.

"Automatic license plate reader" or "ALPR" means software, hardware or equipment, including mobile applications or fixed, mobile, or portable cameras, used to automatically record data, capture images, take photos and store vehicle license plate information. "Automatic license plate reader" or "ALPR" includes a device that is owned or operated by a person who is not an employee of a law enforcement agency or government entity to the extent that data collected by the reader is or may be shared with a law enforcement agency or government entity.

"Automated license plate reader system" or "ALPR system" means a system, software, or computer algorithm, whether used independently or in combination with one or more fixed, mobile, or portable automated cameras or mobile applications, that is used to read and convert images of license plates and the characters they contain into computer-readable data, that may result in a searchable computerized database. "Automated license plate reader system" or "ALPR system" includes an automated license plate recognition system.

"Biometric identifier" has the same meaning as in the Biometric Information Privacy Act.

"Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. "Biometric information" does not include information derived from items or procedures excluded under the definition of biometric identifiers.

"Captured plate data" or "data" means the GPS coordinates, date and time, photograph and other digital images, license plate number, and any other information or data captured by, derived from, or inferred from any automated license plate reader system, including, but not limited to, make, model, color, and automobile characteristics.

"Employee of a foreign entity" means an employee or contractor of any branch of the federal government or federal agency, a state or local agency or unit of local government other than this State.

"Employee of a government entity" means an employee or contractor of any State or local agency, unit of local government, or private entity charged with the enforcement of State, county, or municipal laws. "Employee of a government entity" does not include law enforcement agencies.

"Employee of a law enforcement agency" means any department or agency of this State or a political subdivision of this State or local agency, or unit of local government, charged with the enforcement of State, county, or municipal laws or with managing custody of detained persons in this State or jurisdiction, or vested by law with the duty to maintain public order and to enforce criminal laws, or an individual acting for or on behalf of the State or political subdivision thereof.

"Facial recognition" means any combination of hardware, software, firmware, application, or tools that assists in identifying or verifying or persistently tracking an individual based on a scan of an individual's face geometry in still or video images, streams, or recordings.

"Forcible felony" means the following offenses as defined in the Criminal Code of 2012 or substantially similar federal or other State criminal laws: first degree murder, second degree murder, predatory criminal sexual assault of a child, aggravated criminal sexual assault, criminal sexual assault, trafficking in persons, involuntary servitude, armed robbery, home invasion, aggravated arson, arson, aggravated kidnaping, kidnapping, and aggravated battery resulting in great bodily harm or permanent disability or disfigurement.

"Foreign entity" means any branch of the federal government or federal agency or a state or local agency or unit of local government other than this State.

"Government entity" means a State or local agency, unit of local government, or private entity charged with the enforcement of State, county, or municipal laws. "Government entity" does not include law enforcement agencies.

"Hot list" means a predetermined list or database of license plates relevant and material to an ongoing investigation for comparison against license plates or vehicles scanned by ALPRs.

"Law enforcement agency" means any department or agency of this State or a political subdivision of this State or local agency, or unit of local government, charged with the enforcement of State, county, or municipal laws or with managing custody of detained persons in this State or jurisdiction, or vested by law with the duty to maintain public order and to enforce criminal laws, or an individual acting for or on behalf of the State or a political subdivision thereof.

Section 10. Authorized uses.

(a) It is unlawful for any law enforcement agency or government entity to use, operate, or access any ALPR, ALPR system, or captured plate data, except when authorized by subsections (b), (c), and (d) and used in compliance with this Act.

(b) An ALPR, ALPR system, or captured plate data may be used, operated, or accessed by a law enforcement agency for the comparison of captured plate data with (i) Illinois Amber Alert, Silver Search, Endangered Missing Person Advisory, and FBI Kidnapping and Missing Persons lists, (ii) the Secretary of State Department of Police and Vehicle Services Department databases maintained by the Secretary of State, (iii) the Law Enforcement Agencies Data System maintained by the Illinois State Police, and (iv) license plate numbers that have been manually entered into a State or local ALPR system database upon an officer's determination that the vehicles or individuals associated with the license plate number are relevant and material to an investigation of a vehicle that is:

(1) associated with a missing person as defined by Illinois Amber Alert, Silver Search or Endangered Missing Person Advisory criteria;

(2) stolen;

(3) associated with a hit and run crash;

(4) registered to an individual for whom there is an outstanding felony warrant; or

(5) related to or involved in a forcible felony.

(c) An ALPR, ALPR system, or captured plate data may be used, operated, or accessed by a government entity:

(1) for the purpose of electronic toll assessment and collection;

(2) by parking enforcement entities for regulating the use of parking facilities or enforcing time restrictions on the use of parking spaces; or

(3) for controlling access to secured areas that have clear boundaries, entry only through specific controlled points and limited access.

(d) An ALPR, ALPR system, or captured plate data may be used, operated, or accessed by a law enforcement agency or government entity to identify and track vehicles used by foreign entities, or employees of foreign entities, for the purpose of investigating whether vehicles, individuals, or agencies associated with the license plates are engaged in the following unlawful conduct:

(1) monitoring, tracking, or detaining individuals or groups engaging in political protests, marches, demonstrations, or other assembly protected by the First Amendment;

(2) immigration enforcement without a judicial order;

(3) vehicle crashes;

(4) swapping, altering, tampering with, or otherwise making any change to a license plate that is properly displayed on a vehicle in violation of subsection (l) of Section 3-413 of the Illinois Vehicle Code;

(5) displaying or affixing to a vehicle any license plate not authorized by law and issued by the Secretary of State for use on that vehicle in violation of paragraph (4) of subsection (a) of Section 4-104 of the Illinois Vehicle Code;

(6) actions of foreign entities, and employees of foreign entities, that are relevant to the Illinois Accountability Commission's work, or that of any other State, city, municipal, or federal body created to gather information, documentation, and reports of potential violations of law by federal agencies, employees, or contractors, for investigation purposes; or

(7) violations of State, county or municipal laws or ordinances.

(e) Law enforcement agencies and government entities authorized to use ALPRs, ALPR systems or captured plate data under this Section are required to update their ALPR systems in real-time at the beginning of each shift, or whenever such updates are available, and must document the reason for each manually entered license plate.

Section 15. Data retention for authorized uses. Captured plate data collected by or on behalf of a law enforcement agency or government entity, as authorized for collection under Section 10, shall not be used, operated, or accessed for any other purpose and shall be deleted within 3 days, except that such data may be retained:

(1) for as long as such captured plate data is needed as evidence of specific unlawful conduct enumerated in subsection (b) of Section 10, as long as captured plate data is a confirmed hit and is destroyed at the conclusion of either an investigation that does not result in any criminal charges being filed, or any criminal action undertaken in the matter involving the captured plate data;

(2) for purposes of and only to the extent necessary under subsection (c) of Section 10;

(3) for as long as such captured plate data is needed for identification, tracking, or investigation purposes under paragraphs (1) through (5) and (7) of subsection (d) of Section 10;

(4) for as long as such captured plate data is needed to document and investigate the conduct of federal agencies, employees, or contractors under paragraph (d)(6) of Section 10, and is destroyed at the conclusion of (i) an Illinois Accountability Commission investigation that does not result in a referral, (ii) an investigation conducted by an agency or entity based on a referral by the Illinois Accountability Commission as authorized by Executive Order 2025-06, or (iii) any other State, municipal, or federal investigation described in paragraph (6) of subsection (d) of Section 10;

(5) Pursuant to a preservation request or disclosure order under Section 35; or

(6) Pursuant to a valid criminal warrant issued upon a judicial determination of probable cause, and in compliance with the requirements of the Fourth Amendment to the U.S. Constitution and Article I, Section 6 of the Illinois Constitution.

Section 20. Prohibited uses.

(a) It is unlawful for any law enforcement agency or government entity to:

(1) sell, lease, rent, or purchase any captured plate data;

(2) share, transfer, or otherwise provide captured plate data to any foreign entity or employee of a foreign entity, except if authorized under subparagraph (B) of paragraph (3) of subsection (b) of Section 25;

(3) use or allow access to any ALPR, ALPR system, or captured plate data to seek or compile information on any individual, group, or organization based solely on:

(A) political, social, or religious views or activities;

(B) participation in non-criminal organizations or lawful events;

(C) race, ethnicity, citizenship, age, disability, gender, gender identity, sexual orientation, or other classification protected by law; or

(D) seeking or providing access to lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act;

(4) use, or allow access to, any ALPR, ALPR system or captured plate data to:

(A) monitor, track, investigate or detain individuals (i) engaging in political protests, marches, demonstrations, trainings and community gatherings, or other assembly protected by the First Amendment, (ii) seeking or providing lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act, or (iii) for immigration enforcement purposes;

(B) monitor, track, or investigate organizations that organize or provide support for (i) activities related to freedom of speech, freedom of the press, the right to peaceably assemble, and the right to petition the government as protected by the First Amendment and Illinois law or (ii) access to lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act; or

(C) gather location data or compile information, including for the purpose of creating or populating any database, watch list, or any other mechanism that can be used to target and surveil (i) political protests, marches, demonstrations, community trainings, or gatherings or other assembly protected by the First Amendment, (ii) health facilities that provide lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act, or (iii) public schools, public libraries, courthouses, and shelters for immigration enforcement purposes;

(5) use, or allow access to, an ALPR, ALPR system, or captured plate data for immigration enforcement;

(6) use facial recognition software or technology, or other biometric information, in combination with any ALPR, ALPR system, or captured plate data; or

(7) enter into a contract, continue to contract with, or share information with a vendor when the agency or entity knows, or should have known, that captured plate data shared using the vendor's ALPR or ALPR system has been or will be used to:

(A) monitor, track, investigate or detain individuals (i) engaging in political protest, marches, demonstrations, trainings and community gatherings, or other assembly protected by the First Amendment, (ii) seeking or providing lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act, or (iii) for immigration enforcement purposes; or

(B) monitor, track, or investigate organizations that organize or provide support for (i) activities related to freedom of speech, freedom of the press, the right to peaceably assemble, and the right to petition the government as protected by the First Amendment and State law or (ii) access to lawful health care as defined in Section 28-10 of the Lawful Health Care Activity Act.

(b) It is unlawful for any vendor or contractor to sell, share, allow access to, or transfer captured plate data with any foreign entity unless the requesting agency has obtained a criminal warrant issued upon a judicial determination of probable cause, and in compliance with the requirements of the Fourth Amendment to the U.S. Constitution and Article I, Section 6 of the Illinois Constitution.

(c) It is unlawful for any law enforcement agency, government entity, or vendor, to operate, maintain or access an ALPR, an ALPR system, or captured plate data unless that agency, entity or vendor is in full compliance with the requirements set forth in this Act.

Section 25. Restrictions on use.

(a) Beginning after the effective date of this Act, all new, updated expansions of, or addenda of contractual agreements with ALPR vendors shall mandate that no default access is provided to any national ALPR database and law enforcement agency or government entity captured plate data, is by default, not accessible to any other law enforcement agency, government entity, or foreign entity.

(b) It is unlawful to access, share, transfer, or otherwise provide locally collected captured plate data unless:

(1) the law enforcement agency or government entity in receipt of the request is authorized to access, share, transfer, or otherwise provide the captured plate data under this Act;

(2) the captured plate data requested is authorized under subsection (b) or (d) of Section 10; and

(3) the requester is:

(A) an in-state law enforcement agency, in compliance with this Act, the requesting agency is in receipt of a valid written declaration as required under Section 2-130 of the Illinois Vehicle Code, and the request is accompanied by a valid and current case file number that is linked to a downloadable detailed file or report;

(B) making the request pursuant to a valid criminal warrant issued upon a judicial determination of probable cause, and in compliance with the requirements of the Fourth Amendment to the U.S. Constitution and Article I, Section 6 of the Illinois Constitution; or

(C) making the request pursuant to a disclosure order authorized under Section 35.

Section 30. Requirements for use.

(a) Prior to using, operating, maintaining, or accessing any ALPR, ALPR system, or captured plate data, a law enforcement agency or government entity shall:

(1) Provide a presentation that includes a meaningful opportunity for public comment at a regularly scheduled public meeting of the governing body of the law enforcement agency or government entity.

(A) Before a decision is made to use an ALPR, ALPR system, or captured plate data, the law enforcement agency or government entity shall provide a public presentation that includes (i) information about the ALPR, including information on the technology, equipment, tools, and associated vendors, (ii) authorized uses under this Act, and (iii) where, why, and how it may be used. The presentation must provide a meaningful opportunity for the public to comment, ask questions, give feedback, and raise concerns.

(B) If use of an ALPR system was approved and implemented before the effective date of this Act, the law enforcement agency or government entity shall provide a public presentation, prior to the effective date of this Act, that includes (i) information about the ALPR systems, including information on the technology, equipment, tools, and vendors used, (ii) where, why, and how they have been used, (iii) the types and description of information collected, shared, and received, and (iv) any changes that will be made to comply with this Act. The presentation must provide a meaningful opportunity for the public to comment, ask questions, give feedback, and raise concerns. If the presentation is not made before the effective date of this Act, the law enforcement agency or government entity shall be prohibited from continuing to operate, use or access any ALPR, ALPR system or captured plate data until a presentation that meets the requirements under this subsection is completed.

(2) Adopt, implement, disclose, and maintain an ALPR usage and privacy policy that ensures that the collection, access, use, sharing, retention and deletion of ALPR captured plate data is authorized under this Act and consistent with respect for individuals' privacy, civil liberties, and civil rights, including prohibiting non-essential data collection and sharing, and protecting the security of data collected. The ALPR usage and privacy policy shall be made available to the public in writing and shall be conspicuously posted or linked to its Internet website in a manner that is easily accessible to individuals. The usage and privacy policy shall, at a minimum, include the following information:

(A) authorized uses of ALPRs, ALPR systems, and captured plate data;

(B) authorized purposes for collecting, accessing, and using captured plate data;

(C) the purposes, process, and restrictions related to the sharing or transfer of captured plate data with other law enforcement agencies, government entities, or foreign entities;

(D) a description of the measures that will be used to ensure the accuracy of captured plate data and correct data errors;

(E) the length of time captured plate data will be retained, including the maximum data retention period for non-hit data and data collected and used as authorized by Sections 10 and 15;

(F) a description of the job title or other designation of the employees and independent contractors who are authorized to access and use captured plate data. The policy shall identify the screening and training requirements necessary for those authorized employees and independent contractors;

(G) a description of how ALPRs, ALPR systems, and captured plate data will be monitored to ensure the security of the information accessed or used, compliance with all applicable privacy laws, and a process for periodic system audits; and

(H) a description of the range of disciplinary actions available for violation of the usage and privacy policies.

(3) Adopt, implement, and maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect captured plate data from unauthorized access, destruction, use, modification, or disclosure, including, but not limited to:

(A) safeguards for managing which employees can see the data from its systems, including requiring supervisory approval, robust authentication protocols for establishing an account to access an ALPR system and tracking searches of captured plate data made by employees;

(B) requiring data security training and data privacy training for all employees that access captured plate data; and

(C) an audit process to ensure that captured plate data obtained through the use of an ALPR or ALPR system is used only for authorized purposes, including audits of requests made by individual law enforcement agencies or government entities.

(b) Any ALPR operator that accesses or provides access to captured plate data under this Act shall maintain a record of when captured plate data is accessed that shall include, at a minimum:

(1) the date and time the information is accessed;

(2) the license plate number or other data elements used to query the ALPR system;

(3) the username of the person who accesses the information, and, as applicable, the organization or entity with whom the person is affiliated;

(4) the purpose for accessing the information; and

(5) the justification for the search, a linked copy of the justification saved and linked to the search query, and whether access was authorized by (i) a case file number, accompanied by a detailed case file or report, (ii) a criminal warrant issued upon a judicial determination of probable cause, and in compliance with the requirements of the Fourth Amendment to the U.S. Constitution and Article I, Section 6 of the Illinois Constitution, or (iii) a written declaration as required under Section 2-130 of the Illinois Vehicle Code.

Section 35. Preservation and disclosure.

(a) Upon the written request of a law enforcement agency, government entity, or a defendant in a criminal case, a law enforcement agency or government entity that uses, operates, or accesses an ALPR, ALPR system, or captured plate data shall take all necessary steps to preserve specified captured plate data in its possession for 30 days pending the issuance of a court order sought pursuant to subsection (b) if the requesting law enforcement agency, government entity or defendant in a criminal case makes a retention request and specifies in a written, sworn statement:

(1) the specific camera or cameras for which captured data must be preserved, or the specific license plate for which captured plate data must be preserved;

(2) the date or dates and timeframes for which captured plate data must be preserved; and

(3) that a court order for the retention and disclosure of captured plate data will be sought, pursuant to subsection (b), in a court of competent jurisdiction within 5 days of the transmission of the preservation request.

(b) A law enforcement agency, government entity or defendant in a criminal case may apply for a court order for the extended retention and disclosure of captured plate data, which shall be issued by any court of competent jurisdiction, if the law enforcement agency, government entity, or defendant in a criminal case offers specific and articulable facts showing there is probable cause to believe that captured plate data is relevant and material to an ongoing felony criminal or missing persons investigation, prosecution, or defense.

(c) Captured plate data held by a law enforcement agency or government entity for more than 30 days pursuant to subsection (b) preservation request shall be destroyed within 24 hours if:

(1) an application for the court order is not made within five days of the preservation request; or

(2) the application for the court order made pursuant to subsection (b) is denied.

(d) Notice of a data deletion triggering event as enumerated in paragraph (1) or (2) of subsection (c), shall be provided within 24 hours of its occurrence by the person, agency, or entity who made the preservation request authorized by subsection (a) to the recipient of that request.

Section 40. Required data collection. Any law enforcement agency or government entity that uses, operates, or accesses ALPRs, ALPR systems, or captured plate data shall, at a minimum, collect information related to following categories for reporting purposes:

(1) ALPR and ALPR systems and vendors, including:

(A) the total number of ALPRs operated, or otherwise accessed, including the specific number of fixed, mobile and portable devices, and mobile applications;

(B) a complete list of all other ALPR systems used, operated, or otherwise accessed;

(C) the specific number of ALPRs and ALPR systems owned or leased but not in use at any time during the reporting period and reasons why they were not operational; and

(D) a complete list of ALPR related vendors, including the vendor services used and length of the contract term for each vendor.

(2) Captured plate data collection and uses, including:

(A) the total number of license plates scanned for uses authorized under subsection (c) of Section 10;

(B) the total number of manually entered license plates, and the specific number of manually entered license plates for each offense category authorized under subsection (b) of Section 10, and the number of confirmed matches for each category;

(C) the total number of arrests directly attributed to ALPR hot list detections authorized under subsection (b) of Section 10 and the specific number by each enumerated category;

(D) the total number of convictions directly attributed to ALPR hot list detections authorized under subsection (b) of Section 10 and the specific number by each enumerated category;

(E) the total number of license plates scanned for the purposes authorized by subsection (d) of Section 10 and the specific number by each enumerated category;

(F) the total number of investigations conducted as authorized under subsection (d) of Section 10 and the specific number by each enumerated category;

(G) the total number of investigations that resulted in a finding of unlawful conduct under subsection (d) of Section 10 and the specific number by each enumerated category; and

(H) the total number of investigations authorized under paragraph (5) of subsection (d) of Section 10 that resulted in a referral to the Illinois Accountability Commission.

(3) Requests for captured plate data, including:

(A) the total number of requests received;

(B) the total number of requests that resulted in the release of information and the authorization used to release the information;

(C) the total number of in-state requests, and for each in-state requester, (i) the specific number of requests that resulted in the release of information, (ii) the authorization used to release the information, and (iii) the name and municipality of the requester;

(D) the total number of out-of-state requests, and for each out-of-state requester, (i) the specific number of requests that resulted in a release of information, (ii) the authorization used to release the information, and (iii) the name and state of the requester;

(E) the total number of federal requests, and for each federal requester, (i) the specific number of requests that resulted in a release of information, (ii) the authorization used to release the information, and (iii) the name and associated agency of the requester;

(F) the total number of valid written declarations entered into as required under subsection (c) of Section 2-130 of the Illinois Vehicle Code, and for each written declaration:

(i) the name and state of each law enforcement agency that submitted a written declaration;

(ii) the length of the sharing authorized under the written declaration and whether sharing is still authorized as of the reporting period; and

(iii) whether there have been any instances of non-compliance with the data requirements outlined in Section 2-130 of the Illinois Vehicle Code during the reporting period;

(G) the total number and kind of any other data sharing practices or agreements entered into with any other ALPR user, and for each of the data sharing practices or agreements:

(i) the name, state, and type of ALPR user;

(ii) the authorization for data sharing and whether the agreement allows data sharing only, data receiving only, or data sharing and receiving;

(iii) the length of sharing authorized under the data sharing practice or agreement and whether sharing is still authorized as of the reporting period; and

(iv) whether there have been any instances of non-compliance with the data sharing practice or agreement during the reporting period;

(4) Protections and transparency, including:

(A) the number of unauthorized uses of any ALPR, ALPR system, or captured plate data;

(B) the number of data breaches of the ALPR system or captured plate data; and

(C) a list of internal or external audits that were completed and by whom.

Section 45. Reporting.

(a) All law enforcement agencies and government entities shall publicly disclose whether they operate, use, or otherwise access an ALPR, ALPR system, or captured plate data on or before April 1 of each year. The reporting requirements under this subsection shall begin on the first April after the effective date of this Act and annually thereafter.

(1) Any law enforcement agency or government entity that operates, uses, or otherwise accesses any ALPR system shall report in writing, and publish on its publicly available website, a report that includes the required data collected under Section 40 from February 1 of the previous calendar year through January 31 of the reporting year. The report shall also contain a copy of, or link to, the agency's latest ALPR policy as required under Section 30 as of March 1 of the reporting year.

(2) Any law enforcement agency or government entity that does not own, operate, or otherwise access an ALPR, ALPR system, or captured plate data shall report in writing, and publish on its publicly available website, that it did not own or use an ALPR, ALPR system, or captured plate data between February 1 of the previous calendar year through January 31 of the reporting year.

(b) All law enforcement agencies or government entities shall report to the Secretary of State, and any local body that governs that agency or entity, whether they own, operate, or otherwise access an ALPR, ALPR system, or captured plate data on or before April 1 of each year, beginning after the effective date of this Act.

(1) Any law enforcement agency or government entity that owns, operates, or otherwise accesses an ALPR, ALPR system, or captured plate data, shall submit the report required under subsection (a) and certify in writing that it is in compliance with the provisions of this Act.

(2) Any law enforcement agency or government entity that does not own or use an ALPR, ALPR system, or captured data shall report in writing that it was not in possession of any ALPR, ALPR system, or captured plate data between February 1 of the previous calendar year through January 31 of the reporting year.

(c) On or before May 1 of each year, beginning after the effective date of this Act, the Secretary of State shall publish on its publicly available website a report, or link to a report that includes:

(1) the total number of ALPRs operated in the State by law enforcement agencies and by governmental entities;

(2) the total number of law enforcement agencies and total number of governmental entities that own, operate, or otherwise access ALPR systems or captured plate data between February 1 of the previous calendar year through January 31 of the reporting year, and for each law enforcement agency or government entity, a list, separated by county and municipality:

(A) the number and kinds of ALPRs or ALPR systems, including the specific number of fixed, mobile and portable devices, and mobile applications; and

(B) the list of vendors, and related services provided by each vendor;

(3) the total number of law enforcement agencies with valid written declaration as required under subsection (c) of Section 2-130 of the Illinois Vehicle Code, and for each law enforcement agency:

(A) the name and state of the out-of-state law enforcement agencies that submitted a written declaration;

(B) the length of the sharing authorized under the written declaration and whether sharing is still authorized, as of the reporting period; and

(C) whether there have been any instances of non-compliance with the data requirements outlined in Section 2-130 of the Illinois Vehicle Code by the out-of-state law enforcement agency during the reporting period;

(4) the total number and kind of any other data sharing practices or agreements entered into by law enforcement and by governmental entities with any other ALPR user, and for each of those entities:

(A) the name, state, and type of ALPR user;

(B) the authorization for data sharing and whether the agreement allows data sharing, data receiving or both sharing and receiving;

(C) the length of the sharing authorized under the data sharing practice or agreement and whether sharing is still authorized, as of the reporting period; and

(D) whether there have been any instances of non-compliance with the data sharing practice or agreement during the reporting period;

(5) the total number of requests made to law enforcement agencies, and the number of requests that resulted in the release of information, including the specific number of:

(A) in-state requests, and in-state requests that resulted in the release of information;

(B) out-of-state requests, and out-of-state requests that resulted in the release of information; and

(C) federal requests, and federal requests that resulted in the release of information;

(6) the total number of requests made to governmental entities, and the number of requests that resulted in the release of information, including the specific number of:

(A) in-state requests and in-state requests that resulted in the release of information;

(B) out-of-state requests and out-of-state requests that resulted in the release of information; and

(C) federal requests and federal requests that resulted in the release of information;

(7) the number of unauthorized uses of any ALPR, ALPR system, or captured plate data;

(8) the number of data breaches of the ALPR system or captured plate data;

(9) a list of, and a link to, any audits completed by the Secretary of State;

(10) a list of law enforcement agencies and a list of government entities that did not own, operate, or otherwise access any ALPR, ALPR system, or captured plate data in the previous calendar year, as reported to the Secretary of State under subsection (b); and

(11) a direct link to the publicly available report submitted by each law enforcement agency or government entity as required under subsection (a).

Section 50. Admissibility.

(a) If a court finds by a preponderance of the evidence that captured plate data was gathered, stored, used, or disclosed in violation of this Act, then that information shall be presumed to be inadmissible in any judicial or administrative proceeding. The State may overcome this presumption by proving the applicability of a judicially recognized exception to the exclusionary rule of the Fourth Amendment to the U.S. Constitution or Article I, Section 6 of the Illinois Constitution, or by a preponderance of the evidence that the individual, partnership, corporation, association, or the law enforcement officer was acting in good faith and reasonably believed that one or more of the exceptions identified in subsection (b), (c), or (d) of Section 10 existed at the time that the captured plate information was gathered, stored, used, or disclosed.

(b) No captured plate data and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the State, or a political subdivision thereof, if the disclosure of that information would be in violation of this Act.

Section 55. Privacy.

(a) Captured plate data is not considered a public record for the purposes of Section 7 of the Freedom of Information Act and may only be disclosed to the person to whom the vehicle is registered, or with the prior written consent of the person to whom the vehicle is registered.

(b) Upon the presentation to an appropriate governmental entity of a valid, outstanding protection order protecting the driver of a vehicle jointly registered with or registered solely in the name of the individual against whom the order was issued, captured plate data may not be disclosed except pursuant to a disclosure order under Section 35 or as the result of a match pursuant to Section 10.

Section 60. Penalties.

(a) An officer or employee of a law enforcement agency or employee of a government entity, who intentionally fails to perform any act required by this Act is guilty of official misconduct and may be punished in accordance with Section 33-3 of the Criminal Code of 2012.

(b) The knowing and intentional violation of Section 10, 15, 20, 25, 30, 35, 40, or 45 by an officer or employee of any law enforcement agency or employee of a government entity shall constitute a cause for discipline, including termination of employment.

(c) Any law enforcement agency or government entity that fails to use, operate, maintain, or access an ALPR, an ALPR system, or captured plate data in full compliance with the requirements set forth in this Act shall trigger a 3-month use prohibition for the first offense and a 6-month use prohibition for each subsequent offense.

(d) Any violation of the requirements under this Act made by or the result of the actions or inactions of a vendor shall render the contract null and void and without legal force or effect.

Section 65. Private right of action.

(a) Notwithstanding any other provision of law, any person who violates the provisions of this Act is subject to legal action for damages, to be brought by any other person claiming that a violation of this Act has injured the person's business, the person, or the person's reputation. A person so injured is entitled to actual damages, including mental pain and suffering endured by the person on account of violation of the provisions of this Act, or liquidated damages, and reasonable attorney's fees, and other costs of litigation.

(b) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation:

(1) against any offending party that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater;

(2) against any offending party that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater;

(3) reasonable attorney's fees and costs, including expert witness fees and other litigation expenses; and

(4) other relief, including an injunction, as the State or federal court may deem appropriate.

(c) Any law enforcement agency or government entity aggrieved by a vendor's violation of this Act may file suit in any court of competent jurisdiction for injuries sustained as a result of the vendor's violation. Each individual search or share of information constitutes a separate violation. If such violation is found to occur, the court may assess a civil penalty of $10,000 per violation, injunctive relief, and reasonable attorney's fees and costs. This subsection shall not constitute a limitation on any other private right of action.

Section 900. The Freedom of Information Act is amended by changing Section 7 as follows:

(5 ILCS 140/7)

(Text of Section before amendment by P.A. 104-300)

Sec. 7. Exemptions.

(1) When a request is made to inspect or copy a public record that contains information that is exempt from disclosure under this Section, but also contains information that is not exempt from disclosure, the public body may elect to redact the information that is exempt. The public body shall make the remaining information available for inspection and copying. Subject to this requirement, the following shall be exempt from inspection and copying:

(a) Information specifically prohibited from disclosure by federal or State law or rules and regulations implementing federal or State law.

(b) Private information, unless disclosure is required by another provision of this Act, a State or federal law, or a court order.

(b-5) Files, documents, and other data or databases maintained by one or more law enforcement agencies and specifically designed to provide information to one or more law enforcement agencies regarding the physical or mental status of one or more individual subjects.

(c) Personal information contained within public records, the disclosure of which would constitute a clearly unwarranted invasion of personal privacy, unless the disclosure is consented to in writing by the individual subjects of the information. "Unwarranted invasion of personal privacy" means the disclosure of information that is highly personal or objectionable to a reasonable person and in which the subject's right to privacy outweighs any legitimate public interest in obtaining the information. The disclosure of information that bears on the public duties of public employees and officials shall not be considered an invasion of personal privacy.

(d) Records in the possession of any public body created in the course of administrative enforcement proceedings, and any law enforcement or correctional agency for law enforcement purposes, but only to the extent that disclosure would:

(i) interfere with pending or actually and reasonably contemplated law enforcement proceedings conducted by any law enforcement or correctional agency that is the recipient of the request;

(ii) interfere with active administrative enforcement proceedings conducted by the public body that is the recipient of the request;

(iii) create a substantial likelihood that a person will be deprived of a fair trial or an impartial hearing;

(iv) unavoidably disclose the identity of a confidential source, confidential information furnished only by the confidential source, or persons who file complaints with or provide information to administrative, investigative, law enforcement, or penal agencies; except that the identities of witnesses to traffic crashes, traffic crash reports, and rescue reports shall be provided by agencies of local government, except when disclosure would interfere with an active criminal investigation conducted by the agency that is the recipient of the request;

(v) disclose unique or specialized investigative techniques other than those generally used and known or disclose internal documents of correctional agencies related to detection, observation, or investigation of incidents of crime or misconduct, and disclosure would result in demonstrable harm to the agency or public body that is the recipient of the request;

(vi) endanger the life or physical safety of law enforcement personnel or any other person; or

(vii) obstruct an ongoing criminal investigation by the agency that is the recipient of the request.

(d-5) A law enforcement record created for law enforcement purposes and contained in a shared electronic record management system if the law enforcement agency or criminal justice agency that is the recipient of the request did not create the record, did not participate in or have a role in any of the events which are the subject of the record, and only has access to the record through the shared electronic record management system. As used in this subsection (d-5), "criminal justice agency" means the Illinois Criminal Justice Information Authority or the Illinois Sentencing Policy Advisory Council.

(d-6) Records contained in the Officer Professional Conduct Database under Section 9.2 of the Illinois Police Training Act, except to the extent authorized under that Section. This includes the documents supplied to the Illinois Law Enforcement Training Standards Board from the Illinois State Police and Illinois State Police Merit Board.

(d-7) Information gathered or records created from the use of automatic license plate readers in connection with Section 2-130 of the Illinois Vehicle Code.

(e) Records that relate to or affect the security of correctional institutions and detention facilities.

(e-5) Records requested by persons committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail if those materials are available in the library of the correctional institution or facility or jail where the inmate is confined.

(e-6) Records requested by persons committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail if those materials include records from staff members' personnel files, staff rosters, or other staffing assignment information.

(e-7) Records requested by persons committed to the Department of Corrections or Department of Human Services Division of Mental Health if those materials are available through an administrative request to the Department of Corrections or Department of Human Services Division of Mental Health.

(e-8) Records requested by a person committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail, the disclosure of which would result in the risk of harm to any person or the risk of an escape from a jail or correctional institution or facility.

(e-9) Records requested by a person in a county jail or committed to the Department of Corrections or Department of Human Services Division of Mental Health, containing personal information pertaining to the person's victim or the victim's family, including, but not limited to, a victim's home address, home telephone number, work or school address, work telephone number, social security number, or any other identifying information, except as may be relevant to a requester's current or potential case or claim.

(e-10) Law enforcement records of other persons requested by a person committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail, including, but not limited to, arrest and booking records, mug shots, and crime scene photographs, except as these records may be relevant to the requester's current or potential case or claim.

(f) Preliminary drafts, notes, recommendations, memoranda, and other records in which opinions are expressed, or policies or actions are formulated, except that a specific record or relevant portion of a record shall not be exempt when the record is publicly cited and identified by the head of the public body. The exemption provided in this paragraph (f) extends to all those records of officers and agencies of the General Assembly that pertain to the preparation of legislative documents.

(g) Trade secrets and commercial or financial information obtained from a person or business where the trade secrets or commercial or financial information are furnished under a claim that they are proprietary, privileged, or confidential, and that disclosure of the trade secrets or commercial or financial information would cause competitive harm to the person or business, and only insofar as the claim directly applies to the records requested.

The information included under this exemption includes all trade secrets and commercial or financial information obtained by a public body, including a public pension fund, from a private equity fund or a privately held company within the investment portfolio of a private equity fund as a result of either investing or evaluating a potential investment of public funds in a private equity fund. The exemption contained in this item does not apply to the aggregate financial performance information of a private equity fund, nor to the identity of the fund's managers or general partners. The exemption contained in this item does not apply to the identity of a privately held company within the investment portfolio of a private equity fund, unless the disclosure of the identity of a privately held company may cause competitive harm.

Nothing contained in this paragraph (g) shall be construed to prevent a person or business from consenting to disclosure.

(h) Proposals and bids for any contract, grant, or agreement, including information which if it were disclosed would frustrate procurement or give an advantage to any person proposing to enter into a contractor agreement with the body, until an award or final selection is made. Information prepared by or for the body in preparation of a bid solicitation shall be exempt until an award or final selection is made.

(i) Valuable formulae, computer geographic systems, designs, drawings, and research data obtained or produced by any public body when disclosure could reasonably be expected to produce private gain or public loss. The exemption for "computer geographic systems" provided in this paragraph (i) does not extend to requests made by news media as defined in Section 2 of this Act when the requested information is not otherwise exempt and the only purpose of the request is to access and disseminate information regarding the health, safety, welfare, or legal rights of the general public.

(j) The following information pertaining to educational matters:

(i) test questions, scoring keys, and other examination data used to administer an academic examination;

(ii) information received by a primary or secondary school, college, or university under its procedures for the evaluation of faculty members by their academic peers;

(iii) information concerning a school or university's adjudication of student disciplinary cases, but only to the extent that disclosure would unavoidably reveal the identity of the student; and

(iv) course materials or research materials used by faculty members.

(k) Architects' plans, engineers' technical submissions, and other construction related technical documents for projects not constructed or developed in whole or in part with public funds and the same for projects constructed or developed with public funds, including, but not limited to, power generating and distribution stations and other transmission and distribution facilities, water treatment facilities, airport facilities, sport stadiums, convention centers, and all government owned, operated, or occupied buildings, but only to the extent that disclosure would compromise security.

(l) Minutes of meetings of public bodies closed to the public as provided in the Open Meetings Act until the public body makes the minutes available to the public under Section 2.06 of the Open Meetings Act.

(m) Communications between a public body and an attorney or auditor representing the public body that would not be subject to discovery in litigation, and materials prepared or compiled by or for a public body in anticipation of a criminal, civil, or administrative proceeding upon the request of an attorney advising the public body, and materials prepared or compiled with respect to internal audits of public bodies.

(n) Records relating to a public body's adjudication of employee grievances or disciplinary cases; however, this exemption shall not extend to the final outcome of cases in which discipline is imposed.

(o) Administrative or technical information associated with automated data processing operations, including, but not limited to, software, operating protocols, computer program abstracts, file layouts, source listings, object modules, load modules, user guides, documentation pertaining to all logical and physical design of computerized systems, employee manuals, and any other information that, if disclosed, would jeopardize the security of the system or its data or the security of materials exempt under this Section.

(p) Records relating to collective negotiating matters between public bodies and their employees or representatives, except that any final contract or agreement shall be subject to inspection and copying.

(q) Test questions, scoring keys, and other examination data used to determine the qualifications of an applicant for a license or employment.

(r) The records, documents, and information relating to real estate purchase negotiations until those negotiations have been completed or otherwise terminated. With regard to a parcel involved in a pending or actually and reasonably contemplated eminent domain proceeding under the Eminent Domain Act, records, documents, and information relating to that parcel shall be exempt except as may be allowed under discovery rules adopted by the Illinois Supreme Court. The records, documents, and information relating to a real estate sale shall be exempt until a sale is consummated.

(s) Any and all proprietary information and records related to the operation of an intergovernmental risk management association or self-insurance pool or jointly self-administered health and accident cooperative or pool. Insurance or self-insurance (including any intergovernmental risk management association or self-insurance pool) claims, loss or risk management information, records, data, advice, or communications.

(t) Information contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of a public body responsible for the regulation or supervision of financial institutions, insurance companies, or pharmacy benefit managers, unless disclosure is otherwise required by State law.

(u) Information that would disclose or might lead to the disclosure of secret or confidential information, codes, algorithms, programs, or private keys intended to be used to create electronic signatures under the Uniform Electronic Transactions Act.

(v) Vulnerability assessments, security measures, and response policies or plans that are designed to identify, prevent, or respond to potential attacks upon a community's population or systems, facilities, or installations, but only to the extent that disclosure could reasonably be expected to expose the vulnerability or jeopardize the effectiveness of the measures, policies, or plans, or the safety of the personnel who implement them or the public. Information exempt under this item may include such things as details pertaining to the mobilization or deployment of personnel or equipment, to the operation of communication systems or protocols, to cybersecurity vulnerabilities, or to tactical operations.

(w) (Blank).

(x) Maps and other records regarding the location or security of generation, transmission, distribution, storage, gathering, treatment, or switching facilities owned by a utility, by a power generator, or by the Illinois Power Agency.

(y) Information contained in or related to proposals, bids, or negotiations related to electric power procurement under Section 1-75 of the Illinois Power Agency Act and Section 16-111.5 of the Public Utilities Act that is determined to be confidential and proprietary by the Illinois Power Agency or by the Illinois Commerce Commission.

(z) Information about students exempted from disclosure under Section 10-20.38 or 34-18.29 of the School Code, and information about undergraduate students enrolled at an institution of higher education exempted from disclosure under Section 25 of the Illinois Credit Card Marketing Act of 2009.

(aa) Information the disclosure of which is exempted under the Viatical Settlements Act of 2009.

(bb) Records and information provided to a mortality review team and records maintained by a mortality review team appointed under the Department of Juvenile Justice Mortality Review Team Act.

(cc) Information regarding interments, entombments, or inurnments of human remains that are submitted to the Cemetery Oversight Database under the Cemetery Care Act or the Cemetery Oversight Act, whichever is applicable.

(dd) Correspondence and records (i) that may not be disclosed under Section 11-9 of the Illinois Public Aid Code or (ii) that pertain to appeals under Section 11-8 of the Illinois Public Aid Code.

(ee) The names, addresses, or other personal information of persons who are minors and are also participants and registrants in programs of park districts, forest preserve districts, conservation districts, recreation agencies, and special recreation associations.

(ff) The names, addresses, or other personal information of participants and registrants in programs of park districts, forest preserve districts, conservation districts, recreation agencies, and special recreation associations where such programs are targeted primarily to minors.

(gg) Confidential information described in Section 1-100 of the Illinois Independent Tax Tribunal Act of 2012.

(hh) The report submitted to the State Board of Education by the School Security and Standards Task Force under item (8) of subsection (d) of Section 2-3.160 of the School Code and any information contained in that report.

(ii) Records requested by persons committed to or detained by the Department of Human Services under the Sexually Violent Persons Commitment Act or committed to the Department of Corrections under the Sexually Dangerous Persons Act if those materials: (i) are available in the library of the facility where the individual is confined; (ii) include records from staff members' personnel files, staff rosters, or other staffing assignment information; or (iii) are available through an administrative request to the Department of Human Services or the Department of Corrections.

(jj) Confidential information described in Section 5-535 of the Civil Administrative Code of Illinois.

(kk) The public body's credit card numbers, debit card numbers, bank account numbers, Federal Employer Identification Number, security code numbers, passwords, and similar account information, the disclosure of which could result in identity theft or impression or defrauding of a governmental entity or a person.

(ll) Records concerning the work of the threat assessment team of a school district, including, but not limited to, any threat assessment procedure under the School Safety Drill Act and any information contained in the procedure.

(mm) Information prohibited from being disclosed under subsections (a) and (b) of Section 15 of the Student Confidential Reporting Act.

(nn) Proprietary information submitted to the Environmental Protection Agency under the Drug Take-Back Act.

(oo) Records described in subsection (f) of Section 3-5-1 of the Unified Code of Corrections.

(pp) Any and all information regarding burials, interments, or entombments of human remains as required to be reported to the Department of Natural Resources pursuant either to the Archaeological and Paleontological Resources Protection Act or the Human Remains Protection Act.

(qq) Reports described in subsection (e) of Section 16-15 of the Abortion Care Clinical Training Program Act.

(rr) Information obtained by a certified local health department under the Access to Public Health Data Act.

(ss) For a request directed to a public body that is also a HIPAA-covered entity, all information that is protected health information, including demographic information, that may be contained within or extracted from any record held by the public body in compliance with State and federal medical privacy laws and regulations, including, but not limited to, the Health Insurance Portability and Accountability Act and its regulations, 45 CFR Parts 160 and 164. As used in this paragraph, "HIPAA-covered entity" has the meaning given to the term "covered entity" in 45 CFR 160.103 and "protected health information" has the meaning given to that term in 45 CFR 160.103.

(tt) Proposals or bids submitted by engineering consultants in response to requests for proposal or other competitive bidding requests by the Department of Transportation or the Illinois Toll Highway Authority.

(uu) Documents that, pursuant to the State of Illinois' 1987 Agreement with the U.S. Nuclear Regulatory Commission and the corresponding requirement to maintain compatibility with the National Materials Program, have been determined to be security sensitive. These documents include information classified as safeguards, safeguards-modified, and sensitive unclassified nonsafeguards information, as identified in U.S. Nuclear Regulatory Commission regulatory information summaries, security advisories, and other applicable communications or regulations related to the control and distribution of security sensitive information.

(vv) Any captured plate data under the Automated License Plate Recognition System Act.

(1.5) Any information exempt from disclosure under the Judicial Privacy Act shall be redacted from public records prior to disclosure under this Act.

(1.6) Any information exempt from disclosure under the Public Official Safety and Privacy Act shall be redacted from public records prior to disclosure under this Act.

(1.7) Any information exempt from disclosure under paragraph (3.5) of Section 9-15 of the Election Code shall be redacted from public records prior to disclosure under this Act.

(2) A public record that is not in the possession of a public body but is in the possession of a party with whom the agency has contracted to perform a governmental function on behalf of the public body, and that directly relates to the governmental function and is not otherwise exempt under this Act, shall be considered a public record of the public body, for purposes of this Act.

(3) This Section does not authorize withholding of information or limit the availability of records to the public, except as stated in this Section or otherwise provided in this Act.

(Source: P.A. 103-154, eff. 6-30-23; 103-423, eff. 1-1-24; 103-446, eff. 8-4-23; 103-462, eff. 8-4-23; 103-540, eff. 1-1-24; 103-554, eff. 1-1-24; 103-605, eff. 7-1-24; 103-865, eff. 1-1-25; 104-438, eff. 1-1-26; 104-443, eff. 1-1-26; revised 1-7-26.)

(Text of Section after amendment by P.A. 104-300)

Sec. 7. Exemptions.

(1) When a request is made to inspect or copy a public record that contains information that is exempt from disclosure under this Section, but also contains information that is not exempt from disclosure, the public body may elect to redact the information that is exempt. The public body shall make the remaining information available for inspection and copying. Subject to this requirement, the following shall be exempt from inspection and copying:

(a) Records created or compiled by a State public defender agency or commission subject to the State Public Defender Act that contain: individual client identity; individual case file information; individual investigation records and other records that are otherwise subject to attorney-client privilege; records that would not be discoverable in litigation; records under Section 2.15; training materials; records related to attorney consultation and representation strategy; or any of the above concerning clients of county public defenders or other defender agencies and firms. This exclusion does not apply to deidentified, aggregated, administrative records, such as general case processing and workload information.

(a-5) Information specifically prohibited from disclosure by federal or State law or rules and regulations implementing federal or State law.

(b) Private information, unless disclosure is required by another provision of this Act, a State or federal law, or a court order.

(b-5) Files, documents, and other data or databases maintained by one or more law enforcement agencies and specifically designed to provide information to one or more law enforcement agencies regarding the physical or mental status of one or more individual subjects.

(c) Personal information contained within public records, the disclosure of which would constitute a clearly unwarranted invasion of personal privacy, unless the disclosure is consented to in writing by the individual subjects of the information. "Unwarranted invasion of personal privacy" means the disclosure of information that is highly personal or objectionable to a reasonable person and in which the subject's right to privacy outweighs any legitimate public interest in obtaining the information. The disclosure of information that bears on the public duties of public employees and officials shall not be considered an invasion of personal privacy.

(d) Records in the possession of any public body created in the course of administrative enforcement proceedings, and any law enforcement or correctional agency for law enforcement purposes, but only to the extent that disclosure would:

(i) interfere with pending or actually and reasonably contemplated law enforcement proceedings conducted by any law enforcement or correctional agency that is the recipient of the request;

(ii) interfere with active administrative enforcement proceedings conducted by the public body that is the recipient of the request;

(iii) create a substantial likelihood that a person will be deprived of a fair trial or an impartial hearing;

(iv) unavoidably disclose the identity of a confidential source, confidential information furnished only by the confidential source, or persons who file complaints with or provide information to administrative, investigative, law enforcement, or penal agencies; except that the identities of witnesses to traffic crashes, traffic crash reports, and rescue reports shall be provided by agencies of local government, except when disclosure would interfere with an active criminal investigation conducted by the agency that is the recipient of the request;

(v) disclose unique or specialized investigative techniques other than those generally used and known or disclose internal documents of correctional agencies related to detection, observation, or investigation of incidents of crime or misconduct, and disclosure would result in demonstrable harm to the agency or public body that is the recipient of the request;

(vi) endanger the life or physical safety of law enforcement personnel or any other person; or

(vii) obstruct an ongoing criminal investigation by the agency that is the recipient of the request.

(d-5) A law enforcement record created for law enforcement purposes and contained in a shared electronic record management system if the law enforcement agency or criminal justice agency that is the recipient of the request did not create the record, did not participate in or have a role in any of the events which are the subject of the record, and only has access to the record through the shared electronic record management system. As used in this subsection (d-5), "criminal justice agency" means the Illinois Criminal Justice Information Authority or the Illinois Sentencing Policy Advisory Council.

(d-6) Records contained in the Officer Professional Conduct Database under Section 9.2 of the Illinois Police Training Act, except to the extent authorized under that Section. This includes the documents supplied to the Illinois Law Enforcement Training Standards Board from the Illinois State Police and Illinois State Police Merit Board.

(d-7) Information gathered or records created from the use of automatic license plate readers in connection with Section 2-130 of the Illinois Vehicle Code.

(e) Records that relate to or affect the security of correctional institutions and detention facilities.

(e-5) Records requested by persons committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail if those materials are available in the library of the correctional institution or facility or jail where the inmate is confined.

(e-6) Records requested by persons committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail if those materials include records from staff members' personnel files, staff rosters, or other staffing assignment information.

(e-7) Records requested by persons committed to the Department of Corrections or Department of Human Services Division of Mental Health if those materials are available through an administrative request to the Department of Corrections or Department of Human Services Division of Mental Health.

(e-8) Records requested by a person committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail, the disclosure of which would result in the risk of harm to any person or the risk of an escape from a jail or correctional institution or facility.

(e-9) Records requested by a person in a county jail or committed to the Department of Corrections or Department of Human Services Division of Mental Health, containing personal information pertaining to the person's victim or the victim's family, including, but not limited to, a victim's home address, home telephone number, work or school address, work telephone number, social security number, or any other identifying information, except as may be relevant to a requester's current or potential case or claim.

(e-10) Law enforcement records of other persons requested by a person committed to the Department of Corrections, Department of Human Services Division of Mental Health, or a county jail, including, but not limited to, arrest and booking records, mug shots, and crime scene photographs, except as these records may be relevant to the requester's current or potential case or claim.

(f) Preliminary drafts, notes, recommendations, memoranda, and other records in which opinions are expressed, or policies or actions are formulated, except that a specific record or relevant portion of a record shall not be exempt when the record is publicly cited and identified by the head of the public body. The exemption provided in this paragraph (f) extends to all those records of officers and agencies of the General Assembly that pertain to the preparation of legislative documents.

(g) Trade secrets and commercial or financial information obtained from a person or business where the trade secrets or commercial or financial information are furnished under a claim that they are proprietary, privileged, or confidential, and that disclosure of the trade secrets or commercial or financial information would cause competitive harm to the person or business, and only insofar as the claim directly applies to the records requested.

The information included under this exemption includes all trade secrets and commercial or financial information obtained by a public body, including a public pension fund, from a private equity fund or a privately held company within the investment portfolio of a private equity fund as a result of either investing or evaluating a potential investment of public funds in a private equity fund. The exemption contained in this item does not apply to the aggregate financial performance information of a private equity fund, nor to the identity of the fund's managers or general partners. The exemption contained in this item does not apply to the identity of a privately held company within the investment portfolio of a private equity fund, unless the disclosure of the identity of a privately held company may cause competitive harm.

Nothing contained in this paragraph (g) shall be construed to prevent a person or business from consenting to disclosure.

(h) Proposals and bids for any contract, grant, or agreement, including information which if it were disclosed would frustrate procurement or give an advantage to any person proposing to enter into a contractor agreement with the body, until an award or final selection is made. Information prepared by or for the body in preparation of a bid solicitation shall be exempt until an award or final selection is made.

(i) Valuable formulae, computer geographic systems, designs, drawings, and research data obtained or produced by any public body when disclosure could reasonably be expected to produce private gain or public loss. The exemption for "computer geographic systems" provided in this paragraph (i) does not extend to requests made by news media as defined in Section 2 of this Act when the requested information is not otherwise exempt and the only purpose of the request is to access and disseminate information regarding the health, safety, welfare, or legal rights of the general public.

(j) The following information pertaining to educational matters:

(i) test questions, scoring keys, and other examination data used to administer an academic examination;

(ii) information received by a primary or secondary school, college, or university under its procedures for the evaluation of faculty members by their academic peers;

(iii) information concerning a school or university's adjudication of student disciplinary cases, but only to the extent that disclosure would unavoidably reveal the identity of the student; and

(iv) course materials or research materials used by faculty members.

(k) Architects' plans, engineers' technical submissions, and other construction related technical documents for projects not constructed or developed in whole or in part with public funds and the same for projects constructed or developed with public funds, including, but not limited to, power generating and distribution stations and other transmission and distribution facilities, water treatment facilities, airport facilities, sport stadiums, convention centers, and all government owned, operated, or occupied buildings, but only to the extent that disclosure would compromise security.

(l) Minutes of meetings of public bodies closed to the public as provided in the Open Meetings Act until the public body makes the minutes available to the public under Section 2.06 of the Open Meetings Act.

(m) Communications between a public body and an attorney or auditor representing the public body that would not be subject to discovery in litigation, and materials prepared or compiled by or for a public body in anticipation of a criminal, civil, or administrative proceeding upon the request of an attorney advising the public body, and materials prepared or compiled with respect to internal audits of public bodies.

(n) Records relating to a public body's adjudication of employee grievances or disciplinary cases; however, this exemption shall not extend to the final outcome of cases in which discipline is imposed.

(o) Administrative or technical information associated with automated data processing operations, including, but not limited to, software, operating protocols, computer program abstracts, file layouts, source listings, object modules, load modules, user guides, documentation pertaining to all logical and physical design of computerized systems, employee manuals, and any other information that, if disclosed, would jeopardize the security of the system or its data or the security of materials exempt under this Section.

(p) Records relating to collective negotiating matters between public bodies and their employees or representatives, except that any final contract or agreement shall be subject to inspection and copying.

(q) Test questions, scoring keys, and other examination data used to determine the qualifications of an applicant for a license or employment.

(r) The records, documents, and information relating to real estate purchase negotiations until those negotiations have been completed or otherwise terminated. With regard to a parcel involved in a pending or actually and reasonably contemplated eminent domain proceeding under the Eminent Domain Act, records, documents, and information relating to that parcel shall be exempt except as may be allowed under discovery rules adopted by the Illinois Supreme Court. The records, documents, and information relating to a real estate sale shall be exempt until a sale is consummated.

(s) Any and all proprietary information and records related to the operation of an intergovernmental risk management association or self-insurance pool or jointly self-administered health and accident cooperative or pool. Insurance or self-insurance (including any intergovernmental risk management association or self-insurance pool) claims, loss or risk management information, records, data, advice, or communications.

(t) Information contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of a public body responsible for the regulation or supervision of financial institutions, insurance companies, or pharmacy benefit managers, unless disclosure is otherwise required by State law.

(u) Information that would disclose or might lead to the disclosure of secret or confidential information, codes, algorithms, programs, or private keys intended to be used to create electronic signatures under the Uniform Electronic Transactions Act.

(v) Vulnerability assessments, security measures, and response policies or plans that are designed to identify, prevent, or respond to potential attacks upon a community's population or systems, facilities, or installations, but only to the extent that disclosure could reasonably be expected to expose the vulnerability or jeopardize the effectiveness of the measures, policies, or plans, or the safety of the personnel who implement them or the public. Information exempt under this item may include such things as details pertaining to the mobilization or deployment of personnel or equipment, to the operation of communication systems or protocols, to cybersecurity vulnerabilities, or to tactical operations.

(w) (Blank).

(x) Maps and other records regarding the location or security of generation, transmission, distribution, storage, gathering, treatment, or switching facilities owned by a utility, by a power generator, or by the Illinois Power Agency.

(y) Information contained in or related to proposals, bids, or negotiations related to electric power procurement under Section 1-75 of the Illinois Power Agency Act and Section 16-111.5 of the Public Utilities Act that is determined to be confidential and proprietary by the Illinois Power Agency or by the Illinois Commerce Commission.

(z) Information about students exempted from disclosure under Section 10-20.38 or 34-18.29 of the School Code, and information about undergraduate students enrolled at an institution of higher education exempted from disclosure under Section 25 of the Illinois Credit Card Marketing Act of 2009.

(aa) Information the disclosure of which is exempted under the Viatical Settlements Act of 2009.

(bb) Records and information provided to a mortality review team and records maintained by a mortality review team appointed under the Department of Juvenile Justice Mortality Review Team Act.

(cc) Information regarding interments, entombments, or inurnments of human remains that are submitted to the Cemetery Oversight Database under the Cemetery Care Act or the Cemetery Oversight Act, whichever is applicable.

(dd) Correspondence and records (i) that may not be disclosed under Section 11-9 of the Illinois Public Aid Code or (ii) that pertain to appeals under Section 11-8 of the Illinois Public Aid Code.

(ee) The names, addresses, or other personal information of persons who are minors and are also participants and registrants in programs of park districts, forest preserve districts, conservation districts, recreation agencies, and special recreation associations.

(ff) The names, addresses, or other personal information of participants and registrants in programs of park districts, forest preserve districts, conservation districts, recreation agencies, and special recreation associations where such programs are targeted primarily to minors.

(gg) Confidential information described in Section 1-100 of the Illinois Independent Tax Tribunal Act of 2012.

(hh) The report submitted to the State Board of Education by the School Security and Standards Task Force under item (8) of subsection (d) of Section 2-3.160 of the School Code and any information contained in that report.

(ii) Records requested by persons committed to or detained by the Department of Human Services under the Sexually Violent Persons Commitment Act or committed to the Department of Corrections under the Sexually Dangerous Persons Act if those materials: (i) are available in the library of the facility where the individual is confined; (ii) include records from staff members' personnel files, staff rosters, or other staffing assignment information; or (iii) are available through an administrative request to the Department of Human Services or the Department of Corrections.

(jj) Confidential information described in Section 5-535 of the Civil Administrative Code of Illinois.

(kk) The public body's credit card numbers, debit card numbers, bank account numbers, Federal Employer Identification Number, security code numbers, passwords, and similar account information, the disclosure of which could result in identity theft or impression or defrauding of a governmental entity or a person.

(ll) Records concerning the work of the threat assessment team of a school district, including, but not limited to, any threat assessment procedure under the School Safety Drill Act and any information contained in the procedure.

(mm) Information prohibited from being disclosed under subsections (a) and (b) of Section 15 of the Student Confidential Reporting Act.

(nn) Proprietary information submitted to the Environmental Protection Agency under the Drug Take-Back Act.

(oo) Records described in subsection (f) of Section 3-5-1 of the Unified Code of Corrections.

(pp) Any and all information regarding burials, interments, or entombments of human remains as required to be reported to the Department of Natural Resources pursuant either to the Archaeological and Paleontological Resources Protection Act or the Human Remains Protection Act.

(qq) Reports described in subsection (e) of Section 16-15 of the Abortion Care Clinical Training Program Act.

(rr) Information obtained by a certified local health department under the Access to Public Health Data Act.

(ss) For a request directed to a public body that is also a HIPAA-covered entity, all information that is protected health information, including demographic information, that may be contained within or extracted from any record held by the public body in compliance with State and federal medical privacy laws and regulations, including, but not limited to, the Health Insurance Portability and Accountability Act and its regulations, 45 CFR Parts 160 and 164. As used in this paragraph, "HIPAA-covered entity" has the meaning given to the term "covered entity" in 45 CFR 160.103 and "protected health information" has the meaning given to that term in 45 CFR 160.103.

(tt) Proposals or bids submitted by engineering consultants in response to requests for proposal or other competitive bidding requests by the Department of Transportation or the Illinois Toll Highway Authority.

(uu) Documents that, pursuant to the State of Illinois' 1987 Agreement with the U.S. Nuclear Regulatory Commission and the corresponding requirement to maintain compatibility with the National Materials Program, have been determined to be security sensitive. These documents include information classified as safeguards, safeguards-modified, and sensitive unclassified nonsafeguards information, as identified in U.S. Nuclear Regulatory Commission regulatory information summaries, security advisories, and other applicable communications or regulations related to the control and distribution of security sensitive information.

(vv) Any captured plate data under the Automated License Plate Recognition System Act.

(1.5) Any information exempt from disclosure under the Judicial Privacy Act shall be redacted from public records prior to disclosure under this Act.

(1.6) Any information exempt from disclosure under the Public Official Safety and Privacy Act shall be redacted from public records prior to disclosure under this Act.

(1.7) Any information exempt from disclosure under paragraph (3.5) of Section 9-15 of the Election Code shall be redacted from public records prior to disclosure under this Act.

(2) A public record that is not in the possession of a public body but is in the possession of a party with whom the agency has contracted to perform a governmental function on behalf of the public body, and that directly relates to the governmental function and is not otherwise exempt under this Act, shall be considered a public record of the public body, for purposes of this Act.

(3) This Section does not authorize withholding of information or limit the availability of records to the public, except as stated in this Section or otherwise provided in this Act.

(Source: P.A. 103-154, eff. 6-30-23; 103-423, eff. 1-1-24; 103-446, eff. 8-4-23; 103-462, eff. 8-4-23; 103-540, eff. 1-1-24; 103-554, eff. 1-1-24; 103-605, eff. 7-1-24; 103-865, eff. 1-1-25; 104-300, eff. 1-1-27; 104-438, eff. 1-1-26; 104-443, eff. 1-1-26; revised 1-7-26.)

Section 995. No acceleration or delay. Where this Act makes changes in a statute that is represented in this Act by text that is not yet or no longer in effect (for example, a Section represented by multiple versions), the use of that text does not accelerate or delay the taking effect of (i) the changes made by this Act or (ii) provisions derived from any other Public Act.

Section 997. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 999. Effective date. This Act takes effect upon becoming law.