| |||||||
| |||||||
| |||||||
1 | AN ACT concerning regulation.
| ||||||
2 | Be it enacted by the People of the State of Illinois,
| ||||||
3 | represented in the General Assembly:
| ||||||
4 | Section 1. Short title. This Act may be cited as the | ||||||
5 | Illinois Right to Know Data Transparency and Privacy Protection | ||||||
6 | Act. | ||||||
7 | Section 5. Findings and purpose.
| ||||||
8 | The General Assembly hereby finds and declares that the | ||||||
9 | right to privacy is a personal and fundamental right protected | ||||||
10 | by the United States Constitution. As such, all individuals | ||||||
11 | have a right to privacy in information pertaining to them. This | ||||||
12 | State recognizes the importance of providing consumers with | ||||||
13 | transparency about how their personal information, especially | ||||||
14 | information relating to their children, is shared by | ||||||
15 | businesses. This transparency is crucial for Illinois citizens | ||||||
16 | to protect themselves and their families from cyber-crimes and | ||||||
17 | identity thieves. Furthermore, for free market forces to have a | ||||||
18 | role in shaping the privacy practices and for "opt-in" and | ||||||
19 | "opt-out" remedies to be effective, consumers must be more than | ||||||
20 | vaguely informed that a business might share personal | ||||||
21 | information with third parties. Consumers must be better | ||||||
22 | informed about what kinds of personal information are shared | ||||||
23 | with other businesses. With these specifics, consumers can |
| |||||||
| |||||||
1 | knowledgeably choose to opt-in, opt-out, or choose among | ||||||
2 | businesses that disclose information to third parties on the | ||||||
3 | basis of how protective the business is of consumers' privacy. | ||||||
4 | Businesses are now collecting personal information and | ||||||
5 | sharing and selling it in ways not contemplated or properly | ||||||
6 | covered by the current law. Some websites are installing | ||||||
7 | tracking tools that record when consumers visit web pages, and | ||||||
8 | sending very personal information, such as age, gender, race, | ||||||
9 | income, health concerns, religion, and recent purchases to | ||||||
10 | third party marketers and data brokers. Third party data broker | ||||||
11 | companies are buying, selling, and trading personal | ||||||
12 | information obtained from mobile phones, financial | ||||||
13 | institutions, social media sites, and other online and brick | ||||||
14 | and mortar companies. Some mobile applications are sharing | ||||||
15 | personal information, such as location information, unique | ||||||
16 | phone identification numbers, and age, gender, and other | ||||||
17 | personal details with third party companies. As such, consumers | ||||||
18 | need to know the ways that their personal information is being | ||||||
19 | collected by companies and then shared or sold to third parties | ||||||
20 | in order to properly protect their privacy, personal safety, | ||||||
21 | and financial security.
| ||||||
22 | Section 10. Definitions.
As used in this Act:
| ||||||
23 | "Categories of personal information" includes, but is not | ||||||
24 | limited to, the following:
| ||||||
25 | (a) Identity information including, but not limited |
| |||||||
| |||||||
1 | to, real name, alias, nickname, and user name.
| ||||||
2 | (b) Address information, including, but not limited | ||||||
3 | to, postal or e-mail.
| ||||||
4 | (c) Telephone number.
| ||||||
5 | (d) Account name.
| ||||||
6 | (e) Social security number or other government-issued | ||||||
7 | identification number, including, but not limited to, | ||||||
8 | social security number, driver's license number, | ||||||
9 | identification card number, and passport number.
| ||||||
10 | (f) Birthdate or age.
| ||||||
11 | (g) Physical characteristic information, including, | ||||||
12 | but not limited to, height and weight.
| ||||||
13 | (h) Sexual information, including, but not limited to, | ||||||
14 | sexual orientation, sex, gender status, gender identity, | ||||||
15 | and gender expression.
| ||||||
16 | (i) Race or ethnicity.
| ||||||
17 | (j) Religious affiliation or activity.
| ||||||
18 | (k) Political affiliation or activity.
| ||||||
19 | (l) Professional or employment-related information.
| ||||||
20 | (m) Educational information.
| ||||||
21 | (n) Medical information, including, but not limited | ||||||
22 | to, medical conditions or drugs, therapies, mental health, | ||||||
23 | or medical products or equipment used.
| ||||||
24 | (o) Financial information, including, but not limited | ||||||
25 | to, credit, debit, or account numbers, account balances, | ||||||
26 | payment history, or information related to assets, |
| |||||||
| |||||||
1 | liabilities, or general creditworthiness.
| ||||||
2 | (p) Commercial information, including, but not limited | ||||||
3 | to, records of property, products or services provided, | ||||||
4 | obtained, or considered, or other purchasing or consumer | ||||||
5 | histories or tendencies.
| ||||||
6 | (q) Location information.
| ||||||
7 | (r) Internet or mobile activity information, | ||||||
8 | including, but not limited to, Internet protocol addresses | ||||||
9 | or information concerning the access or use of any Internet | ||||||
10 | or mobile-based site or service.
| ||||||
11 | (s) Content, including text, photographs, audio or | ||||||
12 | video recordings, or other material generated by or | ||||||
13 | provided by the customer.
| ||||||
14 | (t) Any of the above categories of information as they | ||||||
15 | pertain to the children of the customer.
| ||||||
16 | "Customer" means an individual residing in Illinois who | ||||||
17 | provides, either knowingly or unknowingly, personal | ||||||
18 | information to a private entity, with or without an exchange of | ||||||
19 | consideration, in the course of purchasing, viewing, | ||||||
20 | accessing, renting, leasing, or otherwise using real or | ||||||
21 | personal property, or any interest therein, or obtaining a | ||||||
22 | product or service from the private entity, including | ||||||
23 | advertising or any other content.
| ||||||
24 | "Designated request address" means an e-mail address or | ||||||
25 | toll-free telephone number whereby customers may request or | ||||||
26 | obtain the information required to be provided under Section 15 |
| |||||||
| |||||||
1 | of this Act.
| ||||||
2 | "Disclose" means to disclose, release, transfer, share, | ||||||
3 | disseminate, make available, or otherwise communicate orally, | ||||||
4 | in writing, or by electronic or any other means to any third | ||||||
5 | party. "Disclose" does not include the following: | ||||||
6 | (a) Disclosure of personal information by a private | ||||||
7 | entity to a third party under a written contract | ||||||
8 | authorizing the third party to utilize the personal | ||||||
9 | information to perform services on behalf of the private | ||||||
10 | entity, including maintaining or servicing accounts, | ||||||
11 | providing customer service, processing or fulfilling | ||||||
12 | orders and transactions, verifying customer information, | ||||||
13 | processing payments, providing financing, or similar | ||||||
14 | services, but only if (i) the contract prohibits the third | ||||||
15 | party from using the personal information for any reason | ||||||
16 | other than performing the specified service or services on | ||||||
17 | behalf of the private entity and from disclosing any such | ||||||
18 | personal information to additional third parties; and (ii) | ||||||
19 | the private entity effectively enforces these | ||||||
20 | prohibitions. | ||||||
21 | (b) Disclosure of personal information by a business to | ||||||
22 | a third party based on a good-faith belief that disclosure | ||||||
23 | is required to comply with applicable law, regulation, | ||||||
24 | legal process, or court order. | ||||||
25 | (c) Disclosure of personal information by a private | ||||||
26 | entity to a third party that is reasonably necessary to |
| |||||||
| |||||||
1 | address fraud, security, or technical issues; to protect | ||||||
2 | the disclosing private entity's rights or property; or to | ||||||
3 | protect customers or the public from illegal activities as | ||||||
4 | required or permitted by law.
| ||||||
5 | "Operator" means any person or entity that owns a website | ||||||
6 | located on the Internet or an online service that collects and | ||||||
7 | maintains personal information from a customer residing in | ||||||
8 | Illinois who uses or visits the website or online service if | ||||||
9 | the website or online service is operated for commercial | ||||||
10 | purposes. "Operator" does not include businesses having 10 or | ||||||
11 | fewer employees or any third party that operates, hosts, or | ||||||
12 | manages, but does not own, a website or online service on the | ||||||
13 | owner's behalf or by processing information on behalf of the | ||||||
14 | owner.
| ||||||
15 | "Personal information" means any information that | ||||||
16 | identifies, relates to, describes, or is capable of being | ||||||
17 | associated with, a particular individual, including, but not | ||||||
18 | limited to, his or her name, signature, physical | ||||||
19 | characteristics or description, address, telephone number, | ||||||
20 | passport number, driver's license or State identification card | ||||||
21 | number, insurance policy number, education, employment, | ||||||
22 | employment history, bank account number, credit card number, | ||||||
23 | debit card number, or any other financial information. | ||||||
24 | "Personal information" also means any data or information | ||||||
25 | pertaining to an individual's income, assets, liabilities, | ||||||
26 | purchases, leases, or rentals of goods, services, or real |
| |||||||
| |||||||
1 | property, if that information is disclosed, or is intended to | ||||||
2 | be disclosed, with any identifying information, such as the | ||||||
3 | individual's name, address, telephone number, or social | ||||||
4 | security number.
| ||||||
5 | "Third party" or "third parties" means (i) a private entity | ||||||
6 | that is a separate legal entity from the private entity that | ||||||
7 | has disclosed personal information; (ii) a private entity that | ||||||
8 | does not share common ownership or common corporate control | ||||||
9 | with the private entity that has disclosed personal | ||||||
10 | information; or (iii) a private entity that does not share a | ||||||
11 | brand name or common branding with the private entity that has | ||||||
12 | disclosed personal information such that the affiliate | ||||||
13 | relationship is clear to the customer. | ||||||
14 | Section 15. Notification of information sharing practices. | ||||||
15 | An operator of a commercial website or online service that | ||||||
16 | collects personal information through the Internet about | ||||||
17 | individual customers residing in Illinois who use or visit its | ||||||
18 | commercial website or online service shall, in its customer | ||||||
19 | agreement or incorporated addendum or in another conspicuous | ||||||
20 | location on its website or online service platform where | ||||||
21 | similar notices are customarily posted: (i) identify all | ||||||
22 | categories of personal information that the operator collects | ||||||
23 | through the website or online service about individual | ||||||
24 | customers who use or visit its commercial website or online | ||||||
25 | service; and (ii) provide a description of a customer's rights, |
| |||||||
| |||||||
1 | as required under Section 25 of this Act, accompanied by one or | ||||||
2 | more designated request addresses. | ||||||
3 | Section 20. Disclosure of a customer's personal | ||||||
4 | information to a third party.
| ||||||
5 | (a) An operator that discloses a customer's personal | ||||||
6 | information to a third party shall make the following | ||||||
7 | information available to the customer free of charge:
| ||||||
8 | (1) all categories of personal information that were | ||||||
9 | disclosed; and
| ||||||
10 | (2) the names of all third parties that received the | ||||||
11 | customer's personal information.
| ||||||
12 | (b) This Section applies only to personal information | ||||||
13 | disclosed after the effective date of this Act.
| ||||||
14 | Section 25. Information availability service.
| ||||||
15 | (a) An operator required to comply with Section 20 shall | ||||||
16 | make the required information available by providing a | ||||||
17 | designated request address in its customer agreement or | ||||||
18 | incorporated addendum or in another conspicuous location on its | ||||||
19 | website or online service platform where similar notices are | ||||||
20 | customarily posted, and, upon receipt of a request under this | ||||||
21 | Section, shall provide the customer with the information | ||||||
22 | required under Section 20 for all disclosures occurring in the | ||||||
23 | prior 12 months.
| ||||||
24 | (b) An operator that receives a request from a customer |
| |||||||
| |||||||
1 | under this Section at one of the designated addresses shall | ||||||
2 | provide a response to the customer within 30 days.
| ||||||
3 | (c) An operator shall not be required to respond to a | ||||||
4 | request made by the same customer more than once in a given | ||||||
5 | 12-month period. | ||||||
6 | (d) Notwithstanding the provisions of this Section, a | ||||||
7 | parent or legal guardian of a customer under the age of 18 may | ||||||
8 | submit a request under this Section on behalf of that customer. | ||||||
9 | An operator shall not be required to respond to a
request made | ||||||
10 | by the same parent or legal guardian on behalf of a customer | ||||||
11 | under the age of 18 more than once within a given
12-month | ||||||
12 | period.
| ||||||
13 | Section 30. Violation. A violation of this Act constitutes | ||||||
14 | a violation of the Consumer Fraud and Deceptive Business | ||||||
15 | Practices Act. The Office of the Attorney General or the | ||||||
16 | appropriate State's Attorney's Office shall have sole | ||||||
17 | enforcement authority of the provisions of this Act and may | ||||||
18 | enforce a violation of this Act as an unlawful practice under | ||||||
19 | the Consumer Fraud and Deceptive Business Practices Act. | ||||||
20 | Nothing in this Section shall prevent a person from seeking a | ||||||
21 | right of action for a violation of the Biometric Information | ||||||
22 | Privacy Act or otherwise seeking relief under the Code of Civil | ||||||
23 | Procedure. | ||||||
24 | Section 35. Waivers; contracts. Any waiver of the |
| |||||||
| |||||||
1 | provisions of this Act shall be void and unenforceable. Any | ||||||
2 | agreement that does not comply with the applicable provisions | ||||||
3 | of this Act shall be void and unenforceable. | ||||||
4 | Section 40. Construction.
| ||||||
5 | (a) Nothing in this Act shall be construed to conflict with | ||||||
6 | the federal Health Insurance Portability and Accountability | ||||||
7 | Act of 1996 and the rules promulgated under that Act.
| ||||||
8 | (b) Nothing in this Act shall be deemed to apply in any | ||||||
9 | manner to a financial institution or an affiliate of a | ||||||
10 | financial institution that is subject to Title V of the federal | ||||||
11 | Gramm-Leach-Bliley Act of 1999 and the rules promulgated under | ||||||
12 | that Act.
| ||||||
13 | (c) Nothing in this Act shall be construed to apply to any | ||||||
14 | State agency, federal agency, unit of local government, or any | ||||||
15 | contractor, subcontractor, or agent thereof, when working for | ||||||
16 | that State agency, federal agency, or unit of local government.
| ||||||
17 | (d) Nothing in this Act shall be construed to apply to any | ||||||
18 | entity recognized as a tax-exempt organization under 501(c)(3) | ||||||
19 | or 501(c)(4) of the Internal Revenue Code of 1986. | ||||||
20 | (e) Nothing in this Act shall be construed to apply to a | ||||||
21 | public utility, an alternative retail electric supplier, or an | ||||||
22 | alternative gas supplier, as those terms are defined in | ||||||
23 | Sections 3-105, 16-102, and 19-105 of the Public Utilities Act.
|