| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
| ||||||||||||||||||||
1 | AN ACT concerning criminal law.
| |||||||||||||||||||
2 | Be it enacted by the People of the State of Illinois,
| |||||||||||||||||||
3 | represented in the General Assembly:
| |||||||||||||||||||
4 | Section 1. Short title. This Act may be cited as the | |||||||||||||||||||
5 | Protecting Privacy from Government Intrusion Act. | |||||||||||||||||||
6 | Section 5. Definitions. In this Act: | |||||||||||||||||||
7 | "Automated license plate recognition system" means one or | |||||||||||||||||||
8 | more mobile or fixed cameras combined with computer algorithms | |||||||||||||||||||
9 | to convert images of license plates into computer-readable | |||||||||||||||||||
10 | data. | |||||||||||||||||||
11 | "Captured plate data" means the global positioning device | |||||||||||||||||||
12 | coordinates, date and time, photograph, license plate number, | |||||||||||||||||||
13 | and any other data captured by or derived from any automated | |||||||||||||||||||
14 | license plate recognition system. | |||||||||||||||||||
15 | "Electronic communication service" means any service that | |||||||||||||||||||
16 | provides to its subscribers or users the ability to send or | |||||||||||||||||||
17 | receive electronic communications, including any service that | |||||||||||||||||||
18 | acts as an intermediary in the transmission of electronic | |||||||||||||||||||
19 | communications, or stores electronic communication | |||||||||||||||||||
20 | information. | |||||||||||||||||||
21 | "Government entity" means a State or local agency, | |||||||||||||||||||
22 | including, but not limited to, a law enforcement entity or any | |||||||||||||||||||
23 | other investigative entity, agency, department, division, |
| |||||||
| |||||||
1 | bureau, board, commission, or an individual acting or | ||||||
2 | purporting to act for or on behalf of a State or local agency | ||||||
3 | or any unit of local government or political subdivision of | ||||||
4 | this State. | ||||||
5 | "Location information" means information concerning the | ||||||
6 | location of an electronic device that, in whole or in part, is | ||||||
7 | generated or derived from or obtained by the operation of an | ||||||
8 | electronic device. | ||||||
9 | "Location information service" means the provision of a | ||||||
10 | global positioning service or other mapping, locational, or | ||||||
11 | directional information service. | ||||||
12 | "Operator" means the operator of an Internet website, | ||||||
13 | online service, online application, or mobile application with | ||||||
14 | actual knowledge that the site, service, or application is | ||||||
15 | used primarily for K–12 school purposes and was designed and | ||||||
16 | marketed for K–12 school purposes. | ||||||
17 | "Remote computing service" means the provision to the | ||||||
18 | public of computer storage or processing services by means of | ||||||
19 | an electronic communications system. | ||||||
20 | "Tracking warrant" means an order in writing, in the name | ||||||
21 | of the State, signed by a court other than a court exercising | ||||||
22 | probate jurisdiction, directed to a peace officer, granting | ||||||
23 | the officer access to location information of an electronic | ||||||
24 | device. | ||||||
25 | Section 10. Tracking warrant required for location |
| |||||||
| |||||||
1 | information. | ||||||
2 | (a) Except as provided in paragraph (2), a government | ||||||
3 | entity may not obtain the location information of an | ||||||
4 | electronic device without a tracking warrant. A warrant | ||||||
5 | granting access to location information must be issued only if | ||||||
6 | the government entity shows that there is probable cause the | ||||||
7 | person who possesses an electronic device is committing, has | ||||||
8 | committed, or is about to commit a crime. An application for a | ||||||
9 | warrant must be made in writing and include: | ||||||
10 | (1) the identity of the government entity's peace | ||||||
11 | officer making the application and the officer authorizing | ||||||
12 | the application; and | ||||||
13 | (2) a full and complete statement of the facts and | ||||||
14 | circumstances relied on by the applicant to justify the | ||||||
15 | applicant's belief that a warrant should be issued, | ||||||
16 | including (i) details as to the particular offense that | ||||||
17 | has been, is being, or is about to be committed, and (ii) | ||||||
18 | the identity of the person, if known, committing the | ||||||
19 | offense whose location information is to be obtained. | ||||||
20 | (b) A government entity may obtain location information | ||||||
21 | without a tracking warrant: | ||||||
22 | (1) when the electronic device is reported lost or | ||||||
23 | stolen by the owner; | ||||||
24 | (2) in order to respond to the user's call for | ||||||
25 | emergency services; | ||||||
26 | (3) with the informed, affirmative, documented consent |
| |||||||
| |||||||
1 | of the owner or user of the electronic device; | ||||||
2 | (4) with the informed, affirmative consent of the | ||||||
3 | legal guardian or next of kin of the owner or user if the | ||||||
4 | owner or user is believed to be deceased or reported | ||||||
5 | missing and unable to be contacted; or | ||||||
6 | (5) in an emergency situation that involves the risk | ||||||
7 | of death or serious physical harm to a person who | ||||||
8 | possesses an electronic communications device. | ||||||
9 | Section 15. Time period. A tracking warrant issued under | ||||||
10 | this Act must authorize the collection of location information | ||||||
11 | for a period not to exceed 60 days or the period of time | ||||||
12 | necessary to achieve the objective of the authorization, | ||||||
13 | whichever is less. | ||||||
14 | Extensions of a tracking warrant may be granted, but only | ||||||
15 | upon an application for an order and upon the judicial finding | ||||||
16 | required by paragraph (2) of subsection (a) of Section 10. The | ||||||
17 | period of extension must be for a period not to exceed 60 days | ||||||
18 | or the period of time necessary to achieve the objective for | ||||||
19 | which it is granted, whichever is less. | ||||||
20 | This Section applies only to tracking warrants issued for | ||||||
21 | the contemporaneous collection of electronic device location | ||||||
22 | information. | ||||||
23 | Section 20. Notice. | ||||||
24 | (a) Within a reasonable time, but not later than 90 days |
| |||||||
| |||||||
1 | after the court unseals the tracking warrant under this | ||||||
2 | Section, the issuing or denying judge shall cause to be served | ||||||
3 | on the persons named in the warrant and the application an | ||||||
4 | inventory which shall include notice of: | ||||||
5 | (1) the fact of the issuance of the warrant or the | ||||||
6 | application; | ||||||
7 | (2) the date of the issuance and the period of | ||||||
8 | authorized, approved, or disapproved collection of | ||||||
9 | location information or the denial of the application; and | ||||||
10 | (3) the fact that during the period location | ||||||
11 | information was or was not collected. | ||||||
12 | (b) A tracking warrant authorizing collection of location | ||||||
13 | information must direct: | ||||||
14 | (1) the warrant to be sealed for a period of 90 days or | ||||||
15 | until the objective of the warrant has been accomplished, | ||||||
16 | whichever is shorter; and | ||||||
17 | (2) the warrant to be filed with the court | ||||||
18 | administrator within 10 days of the expiration of the | ||||||
19 | warrant. | ||||||
20 | (c) The State's Attorney may request that the tracking | ||||||
21 | warrant, supporting affidavits, and any order granting the | ||||||
22 | request not be filed. An order must be issued granting the | ||||||
23 | request in whole or in part if, from affidavits, sworn | ||||||
24 | testimony, or other evidence, the court finds reasonable | ||||||
25 | grounds exist to believe that filing the warrant may cause the | ||||||
26 | search or a related search to be unsuccessful, create a |
| |||||||
| |||||||
1 | substantial risk of injury to an innocent person, or severely | ||||||
2 | hamper an ongoing investigation. | ||||||
3 | (d) The tracking warrant must direct that following the | ||||||
4 | commencement of any criminal proceeding utilizing evidence | ||||||
5 | obtained in or as a result of the search, the supporting | ||||||
6 | application or affidavit must be filed either immediately or | ||||||
7 | at any other time as the court directs. Until such filing, the | ||||||
8 | documents and materials ordered withheld from filing must be | ||||||
9 | retained by the judge or the judge's designee. | ||||||
10 | Section 25. Report on collection of location information. | ||||||
11 | (a) At the same time as notice is provided under paragraph | ||||||
12 | (4), the issuing or denying judge shall report to the State | ||||||
13 | court administrator: | ||||||
14 | (1) the fact that a tracking warrant or extension was | ||||||
15 | applied for; | ||||||
16 | (2) the fact that the warrant or extension was granted | ||||||
17 | as applied for, was modified, or was denied; | ||||||
18 | (3) the period of collection authorized by the warrant | ||||||
19 | and the number and duration of any extensions of the | ||||||
20 | warrant; | ||||||
21 | (4) the offense specified in the warrant or | ||||||
22 | application or an extension of a warrant; | ||||||
23 | (5) whether the collection required contemporaneous | ||||||
24 | monitoring of an electronic device's location; and | ||||||
25 | (6) the identity of the applying investigative or |
| |||||||
| |||||||
1 | peace officer and agency making the application and the | ||||||
2 | person authorizing the application. | ||||||
3 | (b) On or before November 15 of each even-numbered year, | ||||||
4 | the State court administrator shall transmit to the General | ||||||
5 | Assembly a report concerning: | ||||||
6 | (1) all tracking warrants authorizing the collection | ||||||
7 | of location information during the 2 previous calendar | ||||||
8 | years; and | ||||||
9 | (2) all applications that were denied during the 2 | ||||||
10 | previous calendar years. Each report shall include a | ||||||
11 | summary and analysis of the data required to be filed | ||||||
12 | under this Section. The report is public and must be | ||||||
13 | available for public inspection at the library of the | ||||||
14 | Legislative Reference Bureau and the State court | ||||||
15 | administrator's office and website. | ||||||
16 | Section 30. Prohibition on the use of evidence. | ||||||
17 | (a) Except as proof of a violation of this Section, no | ||||||
18 | evidence obtained in violation of this Section shall be | ||||||
19 | admissible in any criminal, civil, administrative, or other | ||||||
20 | proceeding. | ||||||
21 | (b) Any location information obtained pursuant to this Act | ||||||
22 | or evidence derived therefrom shall not be received in | ||||||
23 | evidence or otherwise disclosed in any trial, hearing, or | ||||||
24 | other proceeding in a federal or State court unless each | ||||||
25 | party, not less than 10 days before the trial, hearing, or |
| |||||||
| |||||||
1 | proceeding, has been furnished with a copy of the tracking | ||||||
2 | warrant and accompanying application under which the | ||||||
3 | information was obtained. This 10-day period may be waived by | ||||||
4 | the judge if the judge finds that it was not possible to | ||||||
5 | furnish a party with the required information 10 days before | ||||||
6 | the trial, hearing, or proceeding and that a party will not be | ||||||
7 | prejudiced by the delay in receiving the information. | ||||||
8 | Section 35. Limit on storage of license plate data. Any | ||||||
9 | captured plate data collected or retained by any governmental | ||||||
10 | or private entity or individual through the use of an | ||||||
11 | automated license plate recognition system may not be stored | ||||||
12 | for more than 180 days unless, in the case of a governmental | ||||||
13 | entity, the data is retained or stored as part of an ongoing | ||||||
14 | governmental investigation, and in that case, the data shall | ||||||
15 | be destroyed at the conclusion of either: | ||||||
16 | (1) an investigation that does not result in any | ||||||
17 | criminal charges being filed; or | ||||||
18 | (2) any criminal action undertaken in the matter | ||||||
19 | involving the captured plate data. | ||||||
20 | Section 40. Prohibition on transfer of license plate data. | ||||||
21 | No governmental entity shall transfer captured plate data | ||||||
22 | except for the purpose of conducting criminal investigations | ||||||
23 | and ensuring compliance with the law. | ||||||
24 | No governmental entity, private entity, or individual |
| |||||||
| |||||||
1 | shall sell captured plate data for any purpose. | ||||||
2 | Section 45. Student online personal information | ||||||
3 | protection. | ||||||
4 | (a) An operator shall not knowingly engage in any of the | ||||||
5 | following activities with respect to the operator's site, | ||||||
6 | service, or application: | ||||||
7 | (1) engage in targeted advertising on the operator's | ||||||
8 | site, service, or application or target advertising on any | ||||||
9 | other site, service, or application when the targeting of | ||||||
10 | the advertising is based upon any information, including | ||||||
11 | covered information and persistent unique identifiers that | ||||||
12 | the operator has acquired because of the use of that | ||||||
13 | operator's site, service, or application; | ||||||
14 | (2) use information, including persistent unique | ||||||
15 | identifiers, created or gathered by the operator's site, | ||||||
16 | service, or application to amass a profile about a K–12 | ||||||
17 | student except in furtherance of a K–12 school purpose; | ||||||
18 | (3) sell a student's information, including covered | ||||||
19 | information. This prohibition does not apply to the | ||||||
20 | purchase, merger, or other type of acquisition of an | ||||||
21 | operator by another entity, provided that the operator or | ||||||
22 | successor entity continues to be subject to the provisions | ||||||
23 | of this Section with respect to previously acquired | ||||||
24 | student information; and | ||||||
25 | (4) disclose covered information unless the disclosure |
| |||||||
| |||||||
1 | is made: | ||||||
2 | (A) in furtherance of the K–12 school purpose of | ||||||
3 | the site, service, or application, provided the | ||||||
4 | recipient of the covered information disclosed | ||||||
5 | pursuant to this subsection: | ||||||
6 | (i) shall not further disclose the information | ||||||
7 | unless done to allow or improve operability and | ||||||
8 | functionality within that student's classroom or | ||||||
9 | school; and | ||||||
10 | (ii) is legally required to comply with | ||||||
11 | subsection (c); | ||||||
12 | (B) to ensure legal and regulatory compliance; | ||||||
13 | (C) to respond to or participate in judicial | ||||||
14 | process; | ||||||
15 | (D) to protect the safety of users or others or | ||||||
16 | security of the site; or | ||||||
17 | (E) to a service provider, provided the operator | ||||||
18 | contractually: (i) prohibits the service provider from | ||||||
19 | using any covered information for any purpose other | ||||||
20 | than providing the contracted service to, or on behalf | ||||||
21 | of, the operator; (ii) prohibits the service provider | ||||||
22 | from disclosing any covered information provided by | ||||||
23 | the operator with subsequent third parties; and (iii) | ||||||
24 | requires the service provider to implement and | ||||||
25 | maintain reasonable security procedures and practices | ||||||
26 | as provided in subsection (c). |
| |||||||
| |||||||
1 | (b) Nothing in subsection (a) shall be construed to | ||||||
2 | prohibit the operator's use of information for maintaining, | ||||||
3 | developing, supporting, improving, or diagnosing the | ||||||
4 | operator's site, service, or application. | ||||||
5 | (c) An operator shall: | ||||||
6 | (1) implement and maintain reasonable security | ||||||
7 | procedures and practices appropriate to the nature of the | ||||||
8 | covered information and protect that information from | ||||||
9 | unauthorized access, destruction, use, modification, or | ||||||
10 | disclosure; and | ||||||
11 | (2) delete a student's covered information if the | ||||||
12 | school or district requests deletion of data under the | ||||||
13 | control of the school or district. | ||||||
14 | (d) Notwithstanding paragraph (4) of subsection (a), an | ||||||
15 | operator may disclose covered information of a student, as | ||||||
16 | long as paragraphs (1) through (3) of subsection (a) are not | ||||||
17 | violated, under the following circumstances: | ||||||
18 | (1) if other provisions of federal or State law | ||||||
19 | require the operator to disclose the information, and the | ||||||
20 | operator complies with the requirements of federal and | ||||||
21 | state law in protecting and disclosing that information; | ||||||
22 | (2) for legitimate research purposes: (i) as required | ||||||
23 | by State or federal law and subject to the restrictions | ||||||
24 | under applicable State and federal law; or (ii) as allowed | ||||||
25 | by State or federal law and under the direction of a | ||||||
26 | school, school district, or state department of education, |
| |||||||
| |||||||
1 | if no covered information is used for any purpose in | ||||||
2 | furtherance of advertising or to amass a profile on the | ||||||
3 | student for purposes other than K–12 school purposes; and | ||||||
4 | (3) to a State or local educational agency, including | ||||||
5 | schools and school districts for K–12 school purposes, as | ||||||
6 | permitted by State or federal law. | ||||||
7 | (e) Nothing in this Section prohibits an operator from | ||||||
8 | using deidentified student covered information as follows: | ||||||
9 | (1) within the operator's site, service, or | ||||||
10 | application or other sites, services, or applications | ||||||
11 | owned by the operator to improve educational products; and | ||||||
12 | (2) to demonstrate the effectiveness of the operator's | ||||||
13 | products or services, including in the operator's | ||||||
14 | marketing. | ||||||
15 | (f) Nothing in this Section prohibits an operator from | ||||||
16 | sharing aggregated deidentified student covered information | ||||||
17 | for the development and improvement of educational sites, | ||||||
18 | services, or applications. | ||||||
19 | (g) As used in this Section: | ||||||
20 | "Covered information" means personally identifiable | ||||||
21 | information or materials, in any media or format that meets | ||||||
22 | any of the following: | ||||||
23 | (1) is created or provided by a student, or the | ||||||
24 | student's parent or legal guardian, to an operator in the | ||||||
25 | course of the student's, parent's, or legal guardian's use | ||||||
26 | of the operator's site, service, or application for K–12 |
| |||||||
| |||||||
1 | school purposes; | ||||||
2 | (2) is created or provided by an employee or agent of | ||||||
3 | the K–12 school, school district, local education agency, | ||||||
4 | or county office of education, to an operator; or | ||||||
5 | (3) is gathered by an operator through the operation | ||||||
6 | of a site, service, or application and is descriptive of a | ||||||
7 | student or otherwise identifies a student, including, but | ||||||
8 | not limited to, information in the student's educational | ||||||
9 | record or email, first and last name, home address, | ||||||
10 | telephone number, email address, other information that | ||||||
11 | allows physical or online contact, discipline records, | ||||||
12 | test results, special education data, juvenile dependency | ||||||
13 | records, grades, evaluations, criminal records, medical | ||||||
14 | records, health records, social security number, biometric | ||||||
15 | information, disabilities, socioeconomic information, | ||||||
16 | food purchases, political affiliations, religious | ||||||
17 | information, text messages, documents, student | ||||||
18 | identifiers, search activity, photos, voice recordings, or | ||||||
19 | geolocation information. | ||||||
20 | "K–12 school purposes" means purposes that customarily | ||||||
21 | take place at the direction of the K–12 school, teacher, or | ||||||
22 | school district or aid in the administration of school | ||||||
23 | activities, including, but not limited to, instruction in the | ||||||
24 | classroom or at home, administrative activities, collaboration | ||||||
25 | between students, school personnel, or parents, or are for the | ||||||
26 | use and benefit of the school. |
| |||||||
| |||||||
1 | "Online service" means cloud computing services, which | ||||||
2 | must comply with this Section if the cloud computing services | ||||||
3 | otherwise meet the definition of an operator. | ||||||
4 | (h) This Section shall not be construed to limit the | ||||||
5 | authority of a law enforcement agency to obtain any content or | ||||||
6 | information from an operator as authorized by law or pursuant | ||||||
7 | to an order of a court of competent jurisdiction. | ||||||
8 | (i) This Section does not limit the ability of an operator | ||||||
9 | to use student data, including covered information, for | ||||||
10 | adaptive learning or customized student learning purposes. | ||||||
11 | (j) This Section does not apply to general audience | ||||||
12 | Internet websites, general audience online services, general | ||||||
13 | audience online applications, or general audience mobile | ||||||
14 | applications, even if login credentials created for an | ||||||
15 | operator's site, service, or application may be used to access | ||||||
16 | those general audience sites, services, or applications. | ||||||
17 | (k) This Section does not limit Internet service providers | ||||||
18 | from providing Internet connectivity to schools or students | ||||||
19 | and the students' families. | ||||||
20 | (l) This Section shall not be construed to prohibit an | ||||||
21 | operator of an Internet website, online service, online | ||||||
22 | application, or mobile application from marketing educational | ||||||
23 | products directly to parents so long as the marketing did not | ||||||
24 | result from the use of covered information obtained by the | ||||||
25 | operator through the provision of services covered under this | ||||||
26 | Section. |
| |||||||
| |||||||
1 | (m) This Section does not impose a duty upon a provider of | ||||||
2 | an electronic store, gateway, marketplace, or other means of | ||||||
3 | purchasing or downloading software or applications to review | ||||||
4 | or enforce compliance of this Section on those applications or | ||||||
5 | software. | ||||||
6 | (n) This Section does not impose a duty upon a provider of | ||||||
7 | an interactive computer service, as defined in 47 U.S.C. 230, | ||||||
8 | to review or enforce compliance with this Section by | ||||||
9 | third-party content providers. | ||||||
10 | (o) This Section does not impede the ability of students | ||||||
11 | to download, export, or otherwise save or maintain the | ||||||
12 | student's own student created data or documents.
| ||||||
13 | Section 97. Severability. The provisions of this Act are | ||||||
14 | severable under Section 1.31 of the Statute on Statutes.
|