Full Text of SB1502 100th General Assembly
SB1502eng 100TH GENERAL ASSEMBLY |
| | SB1502 Engrossed | | LRB100 08019 RJF 18102 b |
|
| 1 | | AN ACT concerning regulation.
| 2 | | Be it enacted by the People of the State of Illinois,
| 3 | | represented in the General Assembly:
| 4 | | Section 1. Short title. This Act may be cited as the | 5 | | Illinois Right to Know Data Transparency and Privacy Protection | 6 | | Act. | 7 | | Section 5. Findings and purpose.
| 8 | | The General Assembly hereby finds and declares that the | 9 | | right to privacy is a personal and fundamental right protected | 10 | | by the United States Constitution. As such, all individuals | 11 | | have a right to privacy in information pertaining to them. This | 12 | | State recognizes the importance of providing consumers with | 13 | | transparency about how their personal information, especially | 14 | | information relating to their children, is shared by | 15 | | businesses. This transparency is crucial for Illinois citizens | 16 | | to protect themselves and their families from cyber-crimes and | 17 | | identity thieves. Furthermore, for free market forces to have a | 18 | | role in shaping the privacy practices and for "opt-in" and | 19 | | "opt-out" remedies to be effective, consumers must be more than | 20 | | vaguely informed that a business might share personal | 21 | | information with third parties. Consumers must be better | 22 | | informed about what kinds of personal information are shared | 23 | | with other businesses. With these specifics, consumers can |
| | | SB1502 Engrossed | - 2 - | LRB100 08019 RJF 18102 b |
|
| 1 | | knowledgeably choose to opt-in, opt-out, or choose among | 2 | | businesses that disclose information to third parties on the | 3 | | basis of how protective the business is of consumers' privacy. | 4 | | Businesses are now collecting personal information and | 5 | | sharing and selling it in ways not contemplated or properly | 6 | | covered by the current law. Some websites are installing | 7 | | tracking tools that record when consumers visit web pages, and | 8 | | sending very personal information, such as age, gender, race, | 9 | | income, health concerns, religion, and recent purchases to | 10 | | third party marketers and data brokers. Third party data broker | 11 | | companies are buying, selling, and trading personal | 12 | | information obtained from mobile phones, financial | 13 | | institutions, social media sites, and other online and brick | 14 | | and mortar companies. Some mobile applications are sharing | 15 | | personal information, such as location information, unique | 16 | | phone identification numbers, and age, gender, and other | 17 | | personal details with third party companies. As such, consumers | 18 | | need to know the ways that their personal information is being | 19 | | collected by companies and then shared or sold to third parties | 20 | | in order to properly protect their privacy, personal safety, | 21 | | and financial security.
| 22 | | Section 10. Definitions.
As used in this Act:
| 23 | | "Categories of personal information" includes, but is not | 24 | | limited to, the following:
| 25 | | (a) Identity information including, but not limited |
| | | SB1502 Engrossed | - 3 - | LRB100 08019 RJF 18102 b |
|
| 1 | | to, real name, alias, nickname, and user name.
| 2 | | (b) Address information, including, but not limited | 3 | | to, postal or e-mail.
| 4 | | (c) Telephone number.
| 5 | | (d) Account name.
| 6 | | (e) Social security number or other government-issued | 7 | | identification number, including, but not limited to, | 8 | | social security number, driver's license number, | 9 | | identification card number, and passport number.
| 10 | | (f) Birthdate or age.
| 11 | | (g) Physical characteristic information, including, | 12 | | but not limited to, height and weight.
| 13 | | (h) Sexual information, including, but not limited to, | 14 | | sexual orientation, sex, gender status, gender identity, | 15 | | and gender expression.
| 16 | | (i) Race or ethnicity.
| 17 | | (j) Religious affiliation or activity.
| 18 | | (k) Political affiliation or activity.
| 19 | | (l) Professional or employment-related information.
| 20 | | (m) Educational information.
| 21 | | (n) Medical information, including, but not limited | 22 | | to, medical conditions or drugs, therapies, mental health, | 23 | | or medical products or equipment used.
| 24 | | (o) Financial information, including, but not limited | 25 | | to, credit, debit, or account numbers, account balances, | 26 | | payment history, or information related to assets, |
| | | SB1502 Engrossed | - 4 - | LRB100 08019 RJF 18102 b |
|
| 1 | | liabilities, or general creditworthiness.
| 2 | | (p) Commercial information, including, but not limited | 3 | | to, records of property, products or services provided, | 4 | | obtained, or considered, or other purchasing or consumer | 5 | | histories or tendencies.
| 6 | | (q) Location information.
| 7 | | (r) Internet or mobile activity information, | 8 | | including, but not limited to, Internet protocol addresses | 9 | | or information concerning the access or use of any Internet | 10 | | or mobile-based site or service.
| 11 | | (s) Content, including text, photographs, audio or | 12 | | video recordings, or other material generated by or | 13 | | provided by the customer.
| 14 | | (t) Any of the above categories of information as they | 15 | | pertain to the children of the customer.
| 16 | | "Customer" means an individual residing in Illinois who | 17 | | provides, either knowingly or unknowingly, personal | 18 | | information to a private entity, with or without an exchange of | 19 | | consideration, in the course of purchasing, viewing, | 20 | | accessing, renting, leasing, or otherwise using real or | 21 | | personal property, or any interest therein, or obtaining a | 22 | | product or service from the private entity, including | 23 | | advertising or any other content.
| 24 | | "Designated request address" means an e-mail address or | 25 | | toll-free telephone number whereby customers may request or | 26 | | obtain the information required to be provided under Section 15 |
| | | SB1502 Engrossed | - 5 - | LRB100 08019 RJF 18102 b |
|
| 1 | | of this Act.
| 2 | | "Disclose" means to disclose, release, transfer, share, | 3 | | disseminate, make available, or otherwise communicate orally, | 4 | | in writing, or by electronic or any other means to any third | 5 | | party. "Disclose" does not include the following: | 6 | | (a) Disclosure of personal information by a private | 7 | | entity to a third party under a written contract | 8 | | authorizing the third party to utilize the personal | 9 | | information to perform services on behalf of the private | 10 | | entity, including maintaining or servicing accounts, | 11 | | providing customer service, processing or fulfilling | 12 | | orders and transactions, verifying customer information, | 13 | | processing payments, providing financing, or similar | 14 | | services, but only if (i) the contract prohibits the third | 15 | | party from using the personal information for any reason | 16 | | other than performing the specified service or services on | 17 | | behalf of the private entity and from disclosing any such | 18 | | personal information to additional third parties; and (ii) | 19 | | the private entity effectively enforces these | 20 | | prohibitions. | 21 | | (b) Disclosure of personal information by a business to | 22 | | a third party based on a good-faith belief that disclosure | 23 | | is required to comply with applicable law, regulation, | 24 | | legal process, or court order. | 25 | | (c) Disclosure of personal information by a private | 26 | | entity to a third party that is reasonably necessary to |
| | | SB1502 Engrossed | - 6 - | LRB100 08019 RJF 18102 b |
|
| 1 | | address fraud, security, or technical issues; to protect | 2 | | the disclosing private entity's rights or property; or to | 3 | | protect customers or the public from illegal activities as | 4 | | required or permitted by law.
| 5 | | "Operator" means any person or entity that owns a website | 6 | | located on the Internet or an online service that collects and | 7 | | maintains personal information from a customer residing in | 8 | | Illinois who uses or visits the website or online service if | 9 | | the website or online service is operated for commercial | 10 | | purposes. "Operator" does not include businesses having 10 or | 11 | | fewer employees or any third party that operates, hosts, or | 12 | | manages, but does not own, a website or online service on the | 13 | | owner's behalf or by processing information on behalf of the | 14 | | owner.
| 15 | | "Personal information" means any information that | 16 | | identifies, relates to, describes, or is capable of being | 17 | | associated with, a particular individual, including, but not | 18 | | limited to, his or her name, signature, physical | 19 | | characteristics or description, address, telephone number, | 20 | | passport number, driver's license or State identification card | 21 | | number, insurance policy number, education, employment, | 22 | | employment history, bank account number, credit card number, | 23 | | debit card number, or any other financial information. | 24 | | "Personal information" also means any data or information | 25 | | pertaining to an individual's income, assets, liabilities, | 26 | | purchases, leases, or rentals of goods, services, or real |
| | | SB1502 Engrossed | - 7 - | LRB100 08019 RJF 18102 b |
|
| 1 | | property, if that information is disclosed, or is intended to | 2 | | be disclosed, with any identifying information, such as the | 3 | | individual's name, address, telephone number, or social | 4 | | security number.
| 5 | | "Third party" or "third parties" means (i) a private entity | 6 | | that is a separate legal entity from the private entity that | 7 | | has disclosed personal information; (ii) a private entity that | 8 | | does not share common ownership or common corporate control | 9 | | with the private entity that has disclosed personal | 10 | | information; or (iii) a private entity that does not share a | 11 | | brand name or common branding with the private entity that has | 12 | | disclosed personal information such that the affiliate | 13 | | relationship is clear to the customer. | 14 | | Section 15. Notification of information sharing practices. | 15 | | An operator of a commercial website or online service that | 16 | | collects personal information through the Internet about | 17 | | individual customers residing in Illinois who use or visit its | 18 | | commercial website or online service shall, in its customer | 19 | | agreement or incorporated addendum or in another conspicuous | 20 | | location on its website or online service platform where | 21 | | similar notices are customarily posted: (i) identify all | 22 | | categories of personal information that the operator collects | 23 | | through the website or online service about individual | 24 | | customers who use or visit its commercial website or online | 25 | | service; and (ii) provide a description of a customer's rights, |
| | | SB1502 Engrossed | - 8 - | LRB100 08019 RJF 18102 b |
|
| 1 | | as required under Section 25 of this Act, accompanied by one or | 2 | | more designated request addresses. | 3 | | Section 20. Disclosure of a customer's personal | 4 | | information to a third party.
| 5 | | (a) An operator that discloses a customer's personal | 6 | | information to a third party shall make the following | 7 | | information available to the customer free of charge:
| 8 | | (1) all categories of personal information that were | 9 | | disclosed; and
| 10 | | (2) the names of all third parties that received the | 11 | | customer's personal information.
| 12 | | (b) This Section applies only to personal information | 13 | | disclosed after the effective date of this Act.
| 14 | | Section 25. Information availability service.
| 15 | | (a) An operator required to comply with Section 20 shall | 16 | | make the required information available by providing a | 17 | | designated request address in its customer agreement or | 18 | | incorporated addendum or in another conspicuous location on its | 19 | | website or online service platform where similar notices are | 20 | | customarily posted, and, upon receipt of a request under this | 21 | | Section, shall provide the customer with the information | 22 | | required under Section 20 for all disclosures occurring in the | 23 | | prior 12 months.
| 24 | | (b) An operator that receives a request from a customer |
| | | SB1502 Engrossed | - 9 - | LRB100 08019 RJF 18102 b |
|
| 1 | | under this Section at one of the designated addresses shall | 2 | | provide a response to the customer within 30 days.
| 3 | | (c) An operator shall not be required to respond to a | 4 | | request made by the same customer more than once in a given | 5 | | 12-month period. | 6 | | (d) Notwithstanding the provisions of this Section, a | 7 | | parent or legal guardian of a customer under the age of 18 may | 8 | | submit a request under this Section on behalf of that customer. | 9 | | An operator shall not be required to respond to a
request made | 10 | | by the same parent or legal guardian on behalf of a customer | 11 | | under the age of 18 more than once within a given
12-month | 12 | | period.
| 13 | | Section 30. Violation. A violation of this Act constitutes | 14 | | a violation of the Consumer Fraud and Deceptive Business | 15 | | Practices Act. The Office of the Attorney General or the | 16 | | appropriate State's Attorney's Office shall have sole | 17 | | enforcement authority of the provisions of this Act and may | 18 | | enforce a violation of this Act as an unlawful practice under | 19 | | the Consumer Fraud and Deceptive Business Practices Act. | 20 | | Nothing in this Section shall prevent a person from seeking a | 21 | | right of action for a violation of the Biometric Information | 22 | | Privacy Act or otherwise seeking relief under the Code of Civil | 23 | | Procedure. | 24 | | Section 35. Waivers; contracts. Any waiver of the |
| | | SB1502 Engrossed | - 10 - | LRB100 08019 RJF 18102 b |
|
| 1 | | provisions of this Act shall be void and unenforceable. Any | 2 | | agreement that does not comply with the applicable provisions | 3 | | of this Act shall be void and unenforceable. | 4 | | Section 40. Construction.
| 5 | | (a) Nothing in this Act shall be construed to conflict with | 6 | | the federal Health Insurance Portability and Accountability | 7 | | Act of 1996 and the rules promulgated under that Act.
| 8 | | (b) Nothing in this Act shall be deemed to apply in any | 9 | | manner to a financial institution or an affiliate of a | 10 | | financial institution that is subject to Title V of the federal | 11 | | Gramm-Leach-Bliley Act of 1999 and the rules promulgated under | 12 | | that Act.
| 13 | | (c) Nothing in this Act shall be construed to apply to any | 14 | | State agency, federal agency, unit of local government, or any | 15 | | contractor, subcontractor, or agent thereof, when working for | 16 | | that State agency, federal agency, or unit of local government.
| 17 | | (d) Nothing in this Act shall be construed to apply to any | 18 | | entity recognized as a tax-exempt organization under 501(c)(3) | 19 | | or 501(c)(4) of the Internal Revenue Code of 1986. | 20 | | (e) Nothing in this Act shall be construed to apply to a | 21 | | public utility, an alternative retail electric supplier, or an | 22 | | alternative gas supplier, as those terms are defined in | 23 | | Sections 3-105, 16-102, and 19-105 of the Public Utilities Act.
|
|