103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB5836

 

Introduced 5/8/2024, by Rep. Tom Weber

 

SYNOPSIS AS INTRODUCED:
 
740 ILCS 14/10
740 ILCS 14/20
740 ILCS 14/25

    Amends the Biometric Information Privacy Act. Provides that a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of the Act has committed a single violation for which the aggrieved person is entitled to, at most, one recovery. Provides that a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection in violation of the Act has committed a single violation for which the aggrieved person is entitled to, at most, one recovery regardless of the number of times the private entity disclosed, redisclosed, or otherwise disseminated the same biometric identifier or biometric information of the same person to the same recipient. Establishes that any violations of the Act by an Internet dating service shall be enforced exclusively by the Attorney General. Provides that nothing in the Act shall be construed to apply to an Internet dating service, or a provider acting on its behalf, while engaged in the collection, capture, processing, possession, retention, disclosure, redisclosure, or dissemination of biometric information or biometric identifiers for a safety purpose. Sets forth an exemption for Internet dating services. Defines terms.


LRB103 40408 LNS 72719 b

 

 

A BILL FOR

 

HB5836LRB103 40408 LNS 72719 b

1    AN ACT concerning civil law.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Biometric Information Privacy Act is
5amended by changing Sections 10, 20, and 25 as follows:
 
6    (740 ILCS 14/10)
7    Sec. 10. Definitions. In this Act:
8    "Biometric identifier" means a retina or iris scan,
9fingerprint, voiceprint, or scan of hand or face geometry.
10Biometric identifiers do not include writing samples, written
11signatures, photographs, human biological samples used for
12valid scientific testing or screening, demographic data,
13tattoo descriptions, or physical descriptions such as height,
14weight, hair color, or eye color. Biometric identifiers do not
15include donated organs, tissues, or parts as defined in the
16Illinois Anatomical Gift Act or blood or serum stored on
17behalf of recipients or potential recipients of living or
18cadaveric transplants and obtained or stored by a federally
19designated organ procurement agency. Biometric identifiers do
20not include biological materials regulated under the Genetic
21Information Privacy Act. Biometric identifiers do not include
22information captured from a patient in a health care setting
23or information collected, used, or stored for health care

 

 

HB5836- 2 -LRB103 40408 LNS 72719 b

1treatment, payment, or operations under the federal Health
2Insurance Portability and Accountability Act of 1996.
3Biometric identifiers do not include an X-ray, roentgen
4process, computed tomography, MRI, PET scan, mammography, or
5other image or film of the human anatomy used to diagnose,
6prognose, or treat an illness or other medical condition or to
7further validate scientific testing or screening.
8    "Biometric information" means any information, regardless
9of how it is captured, converted, stored, or shared, based on
10an individual's biometric identifier used to identify an
11individual. Biometric information does not include information
12derived from items or procedures excluded under the definition
13of biometric identifiers.
14    "Confidential and sensitive information" means personal
15information that can be used to uniquely identify an
16individual or an individual's account or property. Examples of
17confidential and sensitive information include, but are not
18limited to, a genetic marker, genetic testing information, a
19unique identifier number to locate an account or property, an
20account number, a PIN number, a pass code, a driver's license
21number, or a social security number.
22    "Electronic signature" means an electronic sound, symbol,
23or process attached to or logically associated with a record
24and executed or adopted by a person with the intent to sign the
25record.
26    "Internet dating service" means a person or entity in the

 

 

HB5836- 3 -LRB103 40408 LNS 72719 b

1business of providing dating, romantic relationship, or
2matrimonial services principally on or through the Internet.
3    "Private entity" means any individual, partnership,
4corporation, limited liability company, association, or other
5group, however organized. A private entity does not include a
6State or local government agency. A private entity does not
7include any court of Illinois, a clerk of the court, or a judge
8or justice thereof.
9    "Safety purpose" means the purpose of preventing,
10detecting, investigating or responding to actual or suspected
11criminal activity, harassment, or fraud, including spam.
12    "Written release" means informed written consent,
13electronic signature, or, in the context of employment, a
14release executed by an employee as a condition of employment.
15(Source: P.A. 95-994, eff. 10-3-08.)
 
16    (740 ILCS 14/20)
17    Sec. 20. Right of action.
18    (a) Any person aggrieved by a violation of this Act shall
19have a right of action in a State circuit court or as a
20supplemental claim in federal district court against an
21offending party. A prevailing party may recover for each
22violation:
23        (1) against a private entity that negligently violates
24    a provision of this Act, liquidated damages of $1,000 or
25    actual damages, whichever is greater;

 

 

HB5836- 4 -LRB103 40408 LNS 72719 b

1        (2) against a private entity that intentionally or
2    recklessly violates a provision of this Act, liquidated
3    damages of $5,000 or actual damages, whichever is greater;
4        (3) reasonable attorneys' fees and costs, including
5    expert witness fees and other litigation expenses; and
6        (4) other relief, including an injunction, as the
7    State or federal court may deem appropriate.
8    (b) For purposes of subsection (b) of Section 15, a
9private entity that, in more than one instance, collects,
10captures, purchases, receives through trade, or otherwise
11obtains the same biometric identifier or biometric information
12from the same person using the same method of collection in
13violation of subsection (b) of Section 15 has committed a
14single violation of subsection (b) of Section 15 for which the
15aggrieved person is entitled to, at most, one recovery under
16this Section.
17    (c) For purposes of subsection (d) of Section 15, a
18private entity that, in more than one instance, discloses,
19rediscloses, or otherwise disseminates the same biometric
20identifier or biometric information from the same person to
21the same recipient using the same method of collection in
22violation of subsection (d) of Section 15 has committed a
23single violation of subsection (d) of Section 15 for which the
24aggrieved person is entitled to, at most, one recovery under
25this Section regardless of the number of times the private
26entity disclosed, redisclosed, or otherwise disseminated the

 

 

HB5836- 5 -LRB103 40408 LNS 72719 b

1same biometric identifier or biometric information of the same
2person to the same recipient.
3    (d) Any violations of this Act by an Internet dating
4service shall be enforced exclusively by the Attorney General.
5(Source: P.A. 95-994, eff. 10-3-08.)
 
6    (740 ILCS 14/25)
7    Sec. 25. Construction.
8    (a) Nothing in this Act shall be construed to impact the
9admission or discovery of biometric identifiers and biometric
10information in any action of any kind in any court, or before
11any tribunal, board, agency, or person.
12    (b) Nothing in this Act shall be construed to conflict
13with the X-Ray Retention Act, the federal Health Insurance
14Portability and Accountability Act of 1996 and the rules
15promulgated under either Act.
16    (c) Nothing in this Act shall be deemed to apply in any
17manner to a financial institution or an affiliate of a
18financial institution that is subject to Title V of the
19federal Gramm-Leach-Bliley Act of 1999 and the rules
20promulgated thereunder.
21    (d) Nothing in this Act shall be construed to conflict
22with the Private Detective, Private Alarm, Private Security,
23Fingerprint Vendor, and Locksmith Act of 2004 and the rules
24promulgated thereunder.
25    (e) Nothing in this Act shall be construed to apply to a

 

 

HB5836- 6 -LRB103 40408 LNS 72719 b

1contractor, subcontractor, or agent of a State agency or local
2unit of government when working for that State agency or local
3unit of government.
4    (f) Nothing in this Act shall be construed to apply to an
5Internet dating service, or a provider acting on its behalf,
6while engaged in the collection, capture, processing,
7possession, retention, disclosure, redisclosure, or
8dissemination of biometric information or biometric
9identifiers for a safety purpose. If an Internet dating
10service, or a provider acting on its behalf, collects,
11captures, processes, possesses, retains, discloses,
12rediscloses, or disseminates biometric information for a
13safety purpose, it is exempt from complying with subsections
14(a) through (d) of Section 15. If an Internet dating service,
15or a provider acting on its behalf, collects, captures,
16processes, possesses, retains, discloses, rediscloses, or
17disseminates biometric information for a different purpose, or
18seeks to use or convert for a different purpose biometric
19information that was collected, captured, processed,
20possessed, retained, disclosed, redisclosed, or disseminated
21for a safety purpose, the exemption in this subsection shall
22not apply.
23(Source: P.A. 95-994, eff. 10-3-08.)