HB3357ham001 101ST GENERAL ASSEMBLY

Rep. Arthur Turner

Filed: 3/25/2019

10100HB3357ham001 LRB101 11183 JLS 58340 a

AMENDMENT TO HOUSE BILL 3357

AMENDMENT NO. ______. Amend House Bill 3357 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Data Transparency and Privacy Act.

Section 5. Legislative findings. The General Assembly hereby finds and declares that:

(1) The right to privacy is a personal and fundamental right protected by the United States Constitution. As such, all individuals have a right to privacy in information pertaining to them. This State recognizes the importance of providing consumers with transparency about how their personal information, especially information relating to their children, is shared by businesses. This transparency is crucial for Illinois citizens to protect themselves and their families from cyber-crimes and identity thieves.

(2) Furthermore, for free market forces to have a role in shaping the privacy practices and for "opt-in" and "opt-out" remedies to be effective, consumers must be more than vaguely informed that a business might share personal information with third parties. Consumers must be better informed about what kinds of personal information is shared with other businesses. With these specifics, consumers can knowledgeably choose to opt in, opt out, or choose among businesses that disclose information to third parties on the basis of how protective the business is of consumers' privacy.

(3) Businesses are now collecting personal information and sharing and selling it in ways not contemplated or properly covered by the current law. Some websites are installing tracking tools that record when consumers visit web pages, and sending very personal information, such as age, gender, race, income, health concerns, religion, and recent purchases to third-party marketers and data brokers. Third-party data broker companies are buying, selling, and trading personal information obtained from mobile phones, financial institutions, social media sites, and other online and brick and mortar companies. Some mobile applications are sharing personal information, such as location information, unique phone identification numbers, and age, gender, and other personal details with third-party companies.

(4) As such, consumers need to know the ways that their personal information is being collected by companies and then shared or sold to third parties in order to properly protect their privacy, personal safety, and financial security.

Section 10. Definitions. As used in this Act:

"Consumer" means an individual residing in this State who provides, either knowingly or unknowingly, personal information to an operator, with or without an exchange of consideration, in the course of purchasing, viewing, accessing, renting, leasing, or otherwise using real or personal property, or any interest therein, or obtaining a product or service from the private entity, including advertising or any other content.

"Designated request address" means an electronic email address, online form, or toll-free telephone number that a consumer may use to request the information required to be provided pursuant to this Act.

"Disclose" means to disclose, release, transfer, share, disseminate, make available, sell, or otherwise communicate orally, in writing, or by electronic or any other means to any third party.

"Disclose" does not include the disclosure of personal information by a private entity to a third party under a written contract authorizing the third party to utilize the personal information for the limited purposes of performing services on behalf of the private entity, including maintaining or servicing accounts, disclosure of personal information by a private entity to a transportation network company driver providing consumer service, processing or fulfilling orders and transactions, verifying consumer information, processing payments, providing financing, or similar services, but only if:

(1) the contract prohibits the third party or transportation network company driver from using the personal information for any reason other than performing the specified service or services on behalf of the private entity and from disclosing any such personal information to additional third parties; and

(2) disclosure of personal information by a business to a third party based on a good-faith belief that disclosure is required to comply with applicable law, regulation, legal process, or court order.

"Disclose" does not include disclosure of personal information by a private entity to a third party that is reasonably necessary to address fraud, security, or technical issues; to protect the disclosing private entity's rights or property; or to protect consumers or the public from illegal activities as required or permitted by law.

"Operator" means any private entity that owns an Internet website or an online service that collects, maintains, or discloses personal information of a consumer residing in this State who uses or visits the website or online service if the website or online service is operated for commercial purposes. It does not include any third party that operates, hosts, or manages, but does not own, a website or online service on the owner's behalf or by processing information on behalf of the owner.

"Personal information" means any information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including, but not limited to identifiers such as a real name, alias, signature, physical characteristics or description, address, telephone number, passport number, driver's license or State identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, unique personal identifier, Internet Protocol address, geolocation, biometric information, audio, visual, thermal, olfactory, or similar information.

"Personal information" also means professional or employment-related information, education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. 1232g and 34 CFR 99) records of income, assets, liabilities, purchases, leases, products or services purchases, obtained, or considered, or other purchasing or consuming histories or tendencies, or real property.

"Private entity" means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that does business in the State of Illinois, and that satisfies one or more of the following thresholds:

(1) Has annual gross revenues in excess of $25,000,000, as adjusted in January of every odd-numbered year to reflect any increase in the Consumer Price Index.

(2) Annually buys, receives for the business' commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.

(3) Derives 50% or more of its annual revenues from selling consumers' personal information.

"Process" or "processes" means any collection, use, storage, disclosure, analysis, deletion, or modification of personal information.

"Third party" means:

(1) a private entity that is a separate legal entity from the private entity that has disclosed personal information;

(2) a private entity that does not share common ownership or common corporate control with the private entity that has disclosed personal information; or

(3) a private entity that does not share a brand name or common branding with the private entity that has disclosed personal information such that the affiliate relationship is clear to the consumer.

"Sell" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.

"Unique identifier" means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; consumer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device. For purposes of this definition, "family" means a custodial parent or guardian and any minor children over which the parent or guardian has custody.

"Verified request" means the process through which a consumer may submit a request to exercise a right or rights set forth in this Act and by which an operator can reasonably authenticate the request.

Section 15. Right to transparency. An operator that collects personal information through the Internet about individual consumers who use or visit its online service, in its consumer service agreement or incorporated addendum or any other similar and readily available mechanism accessible to the consumer, shall:

(1) identify all categories of personal information that the operator processes about individual consumers collected through its Internet website or online service;

(2) identify all categories of third parties with whom the operator may disclose that personal information;

(3) disclose whether a third party may collect personal information about an individual consumer's online activities over time and across different Internet websites or online services when the consumer uses the Internet website or online service of the operator;

(4) provide a description of the process, if any such process exists, for an individual consumer who uses or visits the Internet website or online service to review and request changes to inaccurate personal information that is collected by the operator as a result of the consumer's use or visits to the Internet website or online service;

(5) describe the process by which the operator notifies consumers who use or visit its Internet website or online service of material changes to the notice required to be made available under this Section;

(6) state the effective date of the notice;

(7) provide a description of a consumer's rights, as required by this Act, accompanied by one or more designated request addresses.

Section 20. Right to know.

(a) An operator that discloses personal information to a third party shall make the following information available to a consumer upon request free of charge:

(1) the categories of personal information that were disclosed about the consumer and the name or names of all third parties that received the consumer's personal information; or

(2) all categories of personal information about consumers that were disclosed and the name or names of all third parties that received any consumer's personal information.

(b) Notwithstanding the provisions of this Section, a parent or legal guardian of a consumer under the age of 18 may submit a verified request under this Section on behalf of that consumer.

(c) This Section applies only to personal information disclosed after the effective date of this Act.

Section 25. Right to opt out. An operator that sells the personal information of a consumer collected through the consumer's use of or visit to the operator's Internet website or online service shall clearly and conspicuously post, on its Internet website or online service or in another prominently and easily accessible location the operator maintains for consumer privacy settings, a link to an Internet web page maintained by the operator that enables a consumer, by verified request through a designated request address, to opt out of the sale of the consumer's personal information to third parties. The method by which a consumer may opt out shall be in a form and manner determined by the operator but should not be overly burdensome and shall require a consumer to establish an account with the operator in order to opt out of the sale of a consumer's personal information.

Section 30. Response to verified requests.

(a) An operator that receives a verified request from a consumer through a designated request address under this Act shall provide a response to the consumer within 45 days of the request.

(b) An operator shall not be required to respond to a request made by the same consumer or made by the same parent or legal guardian on behalf of a consumer under the age of 18 more than once in any 12-month period.

Section 35. Violations. The Attorney General or State's Attorney shall have exclusive authority to enforce this Act. It is a violation of the Consumer Fraud and Deceptive Business Practices Act for an operator to fail to comply with any requirements of this Act. Nothing in this Act shall be construed to modify, limit, or supersede the operation of any privacy or security provision in any other Illinois law, or from otherwise seeking relief under the Code of Civil Procedure.

Section 40. Waivers; contracts. Any waiver of the provisions of this Act is void and unenforceable. Any agreement that does not comply with the applicable provisions of this Act is void and unenforceable.

Section 45. Construction.

(a) The obligations imposed on operators by this Act shall not restrict an operator's ability to:

(1) Comply with federal, state, or local laws.

(2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.

(3) Cooperate with law enforcement agencies concerning conduct or activity that the business, service provider, or third party reasonably and in good faith believes may violate federal, state, or local law.

(4) Exercise or defend legal claims.

(b) Nothing in this Act shall be construed to conflict with the Federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated under that Act.

(c) Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the Federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated under that Act.

(d) Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.

(e) Nothing in this Act shall be construed to apply to: (i) Internet, wireless, or telecommunications service providers; or (ii) a public utility, an alternative retail electric supplier, or an alternative gas supplier, as those terms are defined in Sections 3-105, 16-102, and 19-105 of the Public Utilities Act, or an electric cooperative, as defined in Section 3.4 of the Electric Supplier Act.

(f) Nothing in this Act shall be construed to apply to: (i) a hospital operated under the Hospital Licensing Act; (ii) a hospital affiliate, as defined under the Hospital Licensing Act; or (iii) a hospital operated under the University of Illinois Hospital Act.

(g) Nothing in this Act shall restrict a business' ability to collect or disclose a consumer's personal information if a consumer's conduct takes place wholly outside of Illinois. For purposes of this Act, conduct takes place wholly outside of Illinois if the business collected that information while the consumer was outside of Illinois, no part of the sale of the consumer's personal information occurred in Illinois, and no personal information collected while the consumer was in Illinois is disclosed.

Section 91. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2Z as follows:

(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)

Sec. 2Z. Violations of other Acts. Any person who knowingly violates the Automotive Repair Act, the Automotive Collision Repair Act, the Home Repair and Remodeling Act, the Dance Studio Act, the Data Transparency and Privacy Act, the Physical Fitness Services Act, the Hearing Instrument Consumer Protection Act, the Illinois Union Label Act, the Installment Sales Contract Act, the Job Referral and Job Listing Services Consumer Protection Act, the Travel Promotion Consumer Protection Act, the Credit Services Organizations Act, the Automatic Telephone Dialers Act, the Pay-Per-Call Services Consumer Protection Act, the Telephone Solicitations Act, the Illinois Funeral or Burial Funds Act, the Cemetery Oversight Act, the Cemetery Care Act, the Safe and Hygienic Bed Act, the Illinois Pre-Need Cemetery Sales Act, the High Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the Internet Caller Identification Act, paragraph (6) of subsection (k) of Section 6-305 of the Illinois Vehicle Code, Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the Illinois Vehicle Code, Article 3 of the Residential Real Property Disclosure Act, the Automatic Contract Renewal Act, the Reverse Mortgage Act, Section 25 of the Youth Mental Health Protection Act, the Personal Information Protection Act, or the Student Online Personal Protection Act commits an unlawful practice within the meaning of this Act.

(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642, eff. 7-28-16; 100-315, eff. 8-24-17; 100-416, eff. 1-1-18; 100-863, eff. 8-14-18.)

Section 99. Effective date. This Act takes effect April 1, 2020.".