HB3358sam003 101ST GENERAL ASSEMBLY

Sen. Thomas Cullerton

Filed: 5/29/2019

10100HB3358sam003 LRB101 11180 HEP 61371 a

AMENDMENT TO HOUSE BILL 3358

AMENDMENT NO. ______. Amend House Bill 3358 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Data Transparency and Privacy Act.

Section 5. Findings. The General Assembly finds and declares that:

(1) The right to privacy is a personal and fundamental right protected by the United States Constitution. As such, all individuals have a right to privacy and a personal property interest in information pertaining to them and that information shall be adequately protected from unlawful invasions and takings. This State recognizes the importance of providing consumers with transparency about how their personal information, especially information relating to their children, is shared by businesses. This transparency is crucial for Illinois citizens to protect themselves and their families from cyber-crimes and identity thieves.

(2) Furthermore, for free market forces to have a role in shaping the privacy practices and for "opt-in" and "opt-out" remedies to be effective, consumers must be more than vaguely informed that a business might share personal information with third parties. Consumers must be better informed about what kinds of personal information is shared with other businesses. With these specifics, consumers can knowledgeably choose to opt in, opt out, or choose among businesses that disclose information to third parties on the basis of how protective the business is of consumers' privacy.

(3) Businesses are now collecting personal information and sharing and selling it in ways not contemplated or properly covered by the current law. Some websites are installing tracking tools that record when consumers visit web pages, and sending very personal information, such as age, gender, race, income, health concerns, religion, and recent purchases to third-party marketers and data brokers. Third-party data broker companies are buying, selling, and trading personal information obtained from mobile phones, financial institutions, social media sites, and other online and brick and mortar companies. Some mobile applications are sharing personal information, such as location information, unique phone identification numbers, and age, gender, and other personal details with third-party companies.

(4) As such, consumers need to know the ways that their personal information is being collected by companies and then shared or sold to third parties in order to properly protect their privacy, property, personal safety, and financial security.

Section 10. Definitions. As used in this Act:

"Affiliate" means a legal entity that controls, is controlled by, or is under common control with another legal entity.

"Consumer" means a natural person residing in this State. "Consumer" does not include a natural person acting in an employment context.

"Deidentified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer. An operator that uses deidentified information:

(1) must take reasonable measures to ensure that the data is deidentified; and

(2) must publicly commit to maintain and use the data in a deidentified fashion and not to attempt to reidentify the data.

If a company makes such deidentified data available to service providers or other third parties, then it must contractually prohibit such entities from attempting to reidentify the data.

"Designated request address" means an electronic mail address, online form, or toll-free telephone number that a consumer may use to request the information required to be provided pursuant to this Act.

"Disclose" means to disclose, release, transfer, share, disseminate, make available, sell, or otherwise communicate orally, in writing, or by electronic or any other means a consumer's personal information to any affiliate or third party.

"Disclose" does not include:

(1) Disclosure of personal information by an operator to a third party or service provider under a written contract authorizing the third party or service provider to utilize the personal information to perform services on behalf of the operator, including, but not limited to, maintaining or servicing accounts, disclosure of personal information by an operator to a service provider, processing or fulfilling orders and transactions, verifying consumer information, processing payments, providing financing, or similar services, but only if: the contract prohibits the third party or service provider from using the personal information for any reason other than performing the specified service on behalf of the operator and from disclosing any such personal information to additional third parties or service providers unless those additional third parties or service providers (i) are allowed by the contract to further the specified services and (ii) the additional third parties are subject to the same restrictions imposed by this subsection.

(2) Disclosure of personal information by an operator to a third party based on a good faith belief that disclosure is required to comply with applicable law, regulation, legal process, or court order.

(3) Disclosure of personal information by an operator to a third party that is reasonably necessary to address fraud, risk management, security, or technical issues; to protect the disclosing operator's rights or property; or to protect consumers or the public from illegal activities.

(4) Disclosure of personal information by an operator to a third party in connection with the proposed or actual sale, merger, or bankruptcy of the operator, to a third party.

"Operator" means any private entity that owns an Internet website or an online service that collects, maintains, or discloses personal information of a consumer residing in this State who uses or visits the website or online service if the website or online service is operated for commercial purposes. It does not include any third party that operates, hosts, or manages, but does not own, a website or online service on the owner's behalf or by processing information on behalf of the owner.

"Personal information" means any information that can reasonably be used to infer information about, or otherwise be linked to, a particular consumer, including, but not limited to, identifiers such as a real name, alias, signature, address, telephone number, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial account information, unique personal identifier, geolocation, or biometric information. Personal information does not include data that has been deidentified.

"Private entity" means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that does business in the State of Illinois, and that satisfies one or more of the following thresholds:

(1) Annually buys, receives for the business' commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.

(2) Derives 50% or more of its annual revenues from selling consumers' personal information.

"Process" or "processes" means any collection, use, storage, disclosure, analysis, deletion, or modification of personal information.

"Sale" or "sell" means the selling, renting, or licensing of a consumer's personal information by an operator to a third party in direct exchange for monetary consideration, whereby, as a result of such transaction, the third party may use the personal information for its own commercial purposes.

"Sale" or "sell" does not include circumstances in which:

(1) A consumer uses or directs the operator to intentionally disclose personal information or uses the operator to intentionally interact with a third party, provided the third party does not also sell the personal information, unless that disclosure would be consistent with the provisions of this Act. An intentional interaction occurs when the consumer intends to interact with the third party by one or more deliberate interactions. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer's intent to interact with a third party.

(2) The operator uses or shares an identifier for a consumer who has opted out of the sale of the consumer's personal information for the purposes of alerting third parties that the consumer has opted out of the sale of the consumer's personal information.

(3) The operator uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose or business purposes if the service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose or business purposes.

(4) The operator transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business provided that information is used or shared consistently with this Act. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with Section 25. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Consumer Fraud and Deceptive Business Practices Act.

(5) An operator uses a consumer's personal information to sell targeted advertising space to a third party as long as the personal information is not sold by the operator to the third party.

(6) The disclosure or transfer of personal information to an affiliate of the operator.

"Service provider" means the natural or legal person that processes personal information on behalf of the operator.

"Third party" means a private entity that is: (1) not an affiliate of the private entity that has disclosed personal information; or (2) a private entity that is an affiliate with the private entity that has disclosed personal information and the affiliate relationship is not clear to the consumer.

"Verified request" means the process through which a consumer may submit a request to exercise a right or rights set forth in this Act and by which an operator can reasonably authenticate the request. A consumer shall not be required to create an account with the operator in order to make a verified request, and the method for exercising the rights set forth in this Act shall be reasonably accessible and not be overly burdensome on the consumer.

Section 15. Right to transparency. An operator that collects personal information or deidentified information through the Internet about individual consumers who use or visit its Internet website or online service, in its consumer service agreement or incorporated addendum or any other similar and readily available mechanism accessible to the consumer, shall:

(1) identify all categories of personal information and deidentified information that the operator processes about individual consumers collected through its Internet website or online service;

(2) identify all categories of third parties with whom the operator may disclose that personal information or deidentified information;

(3) disclose whether a third party may collect personal information or deidentified information about an individual consumer's online activities over time and across different Internet websites or online services when the consumer uses the Internet website or online service of the operator;

(4) provide a description of the process, if any such process exists, for an individual consumer who uses or visits the Internet website or online service to review and request changes to inaccurate personal information that is collected by the operator as a result of the consumer's use or visits to the Internet website or online service;

(5) describe the process by which the operator notifies consumers who use or visit its Internet website or online service of material changes to the notice required to be made available under this Section;

(6) state the effective date of the notice;

(7) provide a description of a consumer's rights, as required by this Act, accompanied by one or more designated request addresses.

Section 20. Right to know.

(a) An operator that discloses personal information of a consumer collected through the consumer's use of or visit to the operator's website or online service to a third party shall make the following information available to a consumer, free of charge, upon receipt of a verified request:

(1) the categories of personal information that were disclosed about an individual consumer and the approximate number of all third parties that received the consumer's personal information; or

(2) all categories of personal information about consumers that were disclosed and the approximate number of all third parties that received any consumer's personal information.

(b) An operator may establish processes for reasonably authenticating consumers making the request if the operator seeks to provide the consumer with information about the individual consumer pursuant to item(1) of subsection (a).

(c) Notwithstanding the other provisions of this Section, a parent or legal guardian of a consumer under the age of 13 may submit a verified request under this Section on behalf of that consumer.

(d) This Section applies only to personal information disclosed after the effective date of this Act.

Section 25. Right to opt out. An operator that sells the personal information of a consumer collected through the consumer's use of or visit to the operator's Internet website or online service shall clearly and conspicuously post, on its Internet website or online service or in another prominently and easily accessible location the operator maintains for consumer privacy settings, a link to an Internet web page maintained by the operator that enables a consumer, by verified request through a designated request address, to opt out of such sale of the consumer's personal information to third parties. The method by which a consumer may opt out shall be done in a form and manner determined by the operator in a way and fashion that is not overly burdensome, shall not require a consumer to establish an account with the operator in order to opt out of the sale of a consumer's personal information, and shall be posted in a conspicuous place that is readily and easily accessible to a consumer. This Section applies only to operators that sell personal information. This Section only applies to personal information sold after the effective date of this Act.

Section 30. Response to verified requests.

(a) An operator that receives a verified request from a consumer through a designated request address under this Act shall provide a response to the consumer within 45 days of the request.

(b) An operator shall not be required to respond to a request made by the same consumer or made by the same parent or legal guardian on behalf of a consumer under the age of 13 more than once in any 12-month period.

Section 35. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. The Attorney General has exclusive authority to enforce this Act as a violation of the Consumer Fraud and Deceptive Business Practices Act, subject to the remedies available to the Attorney General pursuant to the Consumer Fraud and Deceptive Business Practices Act. There shall be no private right of action to enforce violations under this Act.

Section 40. Waivers; contracts. Any waiver of the provisions of this Act is void and unenforceable. If a party violates any provision of this Act, the non-violating party's obligations under any agreement between the parties are terminated.

Section 45. Construction.

(a) The obligations imposed on operators by this Act shall not restrict an operator's ability to:

(1) Comply with federal, state, or local laws, rules, regulations, or enforceable guidance.

(2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.

(3) Cooperate with law enforcement agencies concerning conduct or activity that the operator, service provider, or third party reasonably and in good faith believes may violate federal, state, or local law.

(4) Exercise or defend legal claims.

(5) Prevent, detect, or respond to identity theft, fraud, or other malicious or illegal activity.

(b) Nothing in this Act applies to a health care provider or other covered entity subject to the Federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated under that Act.

(c) Nothing in this Act applies in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the Federal Gramm-Leach-Bliley Act and the rules promulgated under that Act.

(d) Nothing in this Act applies to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.

(e) Nothing in this Act applies to a public utility, an alternative retail electric supplier, or an alternative gas supplier, as those terms are defined in Sections 3-105, 16-102, and 19-105 of the Public Utilities Act, or an electric cooperative, as defined in Section 3.4 of the Electric Supplier Act.

(f) Nothing in this Act applies to: (i) a hospital operated under the Hospital Licensing Act; (ii) a hospital affiliate, as defined under the Hospital Licensing Act; or (iii) a hospital operated under the University of Illinois Hospital Act.

(g) Nothing in this Act applies to personal information or deidentified information collected, processed, or disclosed by a retailer in connection with a prospective or complete sale, transaction, or communication conducted on, before, or after the effective date of this Act that is related to business services or delivering information, or selling, offering to sell, moving, or delivering tangible personal property. As used in this Section, "retailer" means an entity that holds itself out as being engaged, or habitually engages, in selling, moving, or delivering tangible personal property at retail and includes a retailer's affiliates, subsidiaries, and service providers collecting, processing, or disclosing personal information or deidentified information on behalf of the retailer to facilitate a prospective or complete sale, transaction, or communication related to business services or delivering information, or selling, offering to sell, moving, or delivering tangible personal property.

(h) Nothing in this Act applies to the following entities and affiliates, as defined in 17 CFR 230.405, of any such entities: telecommunications carriers as defined in Section 13-202 of the Public Utilities Act and wireless carriers as defined in Section 2 of the Emergency Telephone System Act.

(i) Nothing in this Act restricts an operator's ability to collect or disclose a consumer's personal information if a consumer's conduct takes place wholly outside of Illinois. For purposes of this Act, conduct takes place wholly outside of Illinois if the operator collected that information while the consumer was outside of Illinois, no part of the sale of the consumer's personal information occurred in Illinois, and no personal information collected while the consumer was in Illinois is disclosed.

(j) Nothing in this Act shall require an operator to (i) retain any personal information collected for a single, one-time transaction, if such information is not sold or retained by the business or to reidentify or otherwise link information that is not maintained in a manner that would be considered personal information; or (ii) reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information.

(k) Nothing in this Act shall be construed to modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure.

Section 50. Severability. If any provision of this Act or its application to any person or circumstance is held invalid, the invalidity of that provision or application does not affect other provisions or applications of this Act that can be given effect without the invalid provision or application.

Section 99. Effective date. This Act takes effect July 1, 2020.".