Public Act 103-0439
 
HB2954 EnrolledLRB103 30878 LNS 57401 b


  
    AN ACT concerning civil law.
  
 
    Be it enacted by the People of the State of Illinois,
 
represented in the General Assembly:
  


 
 
    Section 1. Short title. This Act may be cited as the Civil 
Liability for Doxing Act.
 
    Section 5. Definitions. As used in this Act:
    "Course of conduct" means a pattern of conduct composed of 
2 or more acts, evidencing a continuity of purpose.
    "Electronic communication" means any transfer of signs, 
signals, writing, images, sounds, data, or intelligence of any 
nature transmitted in whole or in part by a wire, radio, 
electromagnetic, photoelectronic, or photo-optical system.
    "Emotional distress" means significant mental suffering, 
anxiety, or alarm. "Emotional distress" is limited to 
emotional suffering that is protracted and not merely trivial 
or transitory.
    "Family or household member" has the meaning given to the 
term "family or household members" in Section 103 of the 
Illinois Domestic Violence Act of 1986.
    "Personally identifiable information" means any 
information that can be used to distinguish or trace a 
person's identity, such as name, prior legal name, alias, 
mother's maiden name, and date or place of birth in 
combination with any other information that is linked or 
linkable to a person such as:
        (1) social security number, home address, phone 
    number, email address, social media accounts, or biometric 
    data;
        (2) medical, financial, education, consumer, or 
    employment information, data, or records;
        (3) any other sensitive or private information that is 
    linked or linkable to a specific identifiable person, such 
    as gender identity, sexual orientation, or any sexually 
    intimate visual depiction; or
        (4) any information that provides access to a person's 
    teleconferencing, video-teleconferencing, or other 
    digital meeting room.
    "Post" means to circulate, deliver, distribute, 
disseminate, transmit, or otherwise make available to 2 or 
more persons through electronic communication.
    "Publish" means to circulate, deliver, distribute, 
disseminate, post, transmit, or otherwise make available to 
another person. "Publish" does not include writing or 
electronically communicating to one other person in private 
communications for which an individual has a reasonable 
expectation of privacy.
    "Regularly resides" means residing in the household with 
some permanency or regular frequency in the person's living 
arrangement.
    "Stalk" or "stalking" has the meaning provided in Section 
12-7.3 of the Criminal Code of 2012, except that "stalking" 
does not include an activity that is part of a protest that is 
protected by the United States Constitution or the Illinois 
Constitution.
    "Substantial life disruption" means a material and 
significant alteration of an individual's livelihood. 
"Substantial life disruption" may include, but is not limited 
to, moving from an established residence, changing routes to 
and from work, changing employment or work schedule, or losing 
time at work or a job.
 
    Section 10. Doxing. 
    (a) An individual engages in the act of doxing when that 
individual intentionally publishes another person's personally 
identifiable information without the consent of the person 
whose information is published and:
        (1) the information is published with the intent that 
    it be used to harm or harass the person whose information 
    is published and with knowledge or reckless disregard that 
    the person whose information is published would be 
    reasonably likely to suffer death, bodily injury, or 
    stalking; and
        (2) the publishing of the information:
            (i) causes the person whose information is 
        published to suffer significant economic injury or 
        emotional distress or to fear serious bodily injury or 
        death of the person or a family or household member of 
        the person; or
            (ii) causes the person whose information is 
        published to suffer a substantial life disruption; and
        (3) the person whose  information is published is 
    identifiable from the published personally identifiable 
    information itself.
    (b) It is not an offense under this Act for an individual 
to:
        (1) provide another person's personally identifiable 
    information or sensitive personal information in 
    connection with the reporting of criminal activity to an 
    employee of a law enforcement agency or in connection with 
    any lawfully authorized investigative, protective, or 
    intelligence activity of any law enforcement agency or of 
    an intelligence agency of the United States and the person 
    making the report reasonably believes the alleged criminal 
    activity occurred or the existing investigative, 
    protective, or intelligence activity is legitimate;
        (2) disseminate the personally identifiable 
    information for the purpose of, or in connection with, the 
    reporting of conduct reasonably believed to be unlawful; 
    or
        (3) provide a person's personally identifiable 
    information in connection with activity protected under 
    the United States Constitution or the Illinois 
    Constitution pertaining to speech, press, assembly, 
    protest,  and petition, as well as the provision of 
    personally identifiable information to the press.
    (c) Nothing in this Act shall be construed in any manner 
to:
        (1) conflict with Section 230 of Title II of the 
    Communications Act of 1934 (47 U.S.C. 230);
        (2) conflict with 42 U.S.C. 1983; or
        (3) prohibit any activity protected under the 
    Constitution of the United States or the Illinois 
    Constitution.
 
    Section 15. Civil action. 
    (a) A person who is aggrieved by a violation of this Act 
may bring a civil action against (i) the individual who 
committed the offense of doxing or (ii) any individual or 
entity that directs one or more persons to violate this Act and 
that knowingly benefits, financially or by receiving anything 
of value, from participation in a venture that the individual 
or entity knew involved a violation of this Act.
    (b) A person who is aggrieved by a violation of this Act  
may recover damages and any other appropriate relief, 
including reasonable attorney's fees.
    (c) An individual who is found liable under this Act shall 
be jointly and severally liable with each other individual, if 
any, who is found liable under this Act for damages arising 
from the same violation of this Act.
    (d) When a judgment is entered in favor of an individual 
alleged to have committed the offense of doxing, the court may 
award reasonable costs and attorney's fees to the defendant 
for defending any claim that the court finds was brought by the 
plaintiff and that the court finds was frivolous, baseless, or 
brought in bad faith.
 
    Section 20. Injunctive relief. 
    (a) A court in which a suit is brought under this Act, on 
the motion of a party, may issue a temporary  restraining 
order, emergency order of protection, or preliminary or 
permanent injunction to restrain and prevent the disclosure or 
continued disclosure of a person's personally identifiable 
information or sensitive personal information. Upon a motion 
by a party in a civil action brought under this Act, and 
following a full evidentiary hearing, a court may issue an 
order pursuant to this Section to prevent the publishing of a 
person's personally identifiable information or sensitive 
personal information if the court finds by clear and 
convincing evidence each of the following:
        (1) the individual to be enjoined published personally 
    identifiable information or sensitive personal information 
    in violation of this Act;
        (2) continued or further publishing of the personally 
    identifiable information or sensitive personal information 
    poses a present and ongoing risk of death, bodily injury, 
    or stalking to another individual; and
        (3) the individual to be enjoined has no lawful or 
    constitutional purpose for continued or further publishing 
    of the personally identifiable information or sensitive 
    personal information.
    (b) Any injunctive relief granted under this Section shall 
state the following with sufficient particularity to allow 
appellate review:
        (1) the required findings in subsection (a) of Section 
    20 and the evidentiary basis and reasoning for the 
    findings;
        (2) the expiration date of the injunction, which shall 
    be no more than one year from the date of its entry;
        (3) that the enjoined individual may seek relief from 
    the injunction, if the court determines, after notice and 
    hearing, that one or more of the required findings in 
    subsection (a) of Section 20 no longer apply; and
        (4) that the person who sought the injunction may seek 
    an extension of the order of no more than one year if the 
    court determines, after notice and hearing, that the 
    required findings in subsection (a) of Section 20 continue 
    to apply.
    (c) If a person violates any order issued under this 
Section, the court, in its discretion, may grant any civil 
remedy under State law.
 
    Section 25. Venue. A civil action may be brought in any 
county in which an element of the offense occurred, or in which 
a person resides who is the subject of personally identifiable 
information published in violation of this Act.
 
    Section 30. Constitutionality. The General Assembly does 
not intend this Act to allow, and this Act shall not allow, 
actions to be brought against constitutionally protected 
activity.
  
 
    Section 97. Severability. The provisions of this Act are 
severable under Section 1.31 of the Statute on Statutes.