Public Act 095-0350
 
SB0137 Enrolled LRB095 06387 WGH 26484 b

    AN ACT concerning the Internet.
 
    Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
 
    Section 1. Short title. This Act may be cited as the
Anti-Phishing Act.
 
    Section 5. Definitions. As used in this Act:
    "Electronic mail message" means a message sent to a unique
destination, commonly expressed as a string of characters,
consisting of a unique user name or mailbox (commonly referred
to as the "local part") and a reference to an Internet domain
(commonly referred to as the "domain part"), whether or not
displayed, to which an electronic message can be sent or
delivered.
    "Identifying information" means, with respect to an
individual, any of the following:
        (1) Social security number.
        (2) Driver's license number.
        (3) Bank account number.
        (4) Credit card or debit card number.
        (5) Personal identification number (PIN).
        (6) Automated or electronic signature.
        (7) Unique biometric data.
        (8) Account password.
        (9) Any other piece of information that can be used to
    access an individual's financial accounts or to obtain
    goods or services.
    "Internet" means the global information system that is
logically linked together by a globally unique address space
based on the Internet Protocol (IP), or its subsequent
extensions, and that is able to support communications using
the Transmission Control Protocol/Internet Protocol (TCP/IP)
suite, or its subsequent extensions, or other IP-compatible
protocols, and that provides, uses, or makes accessible, either
publicly or privately, high level services layered on the
communications and related infrastructure.
    "Web page" means a location that has a single uniform
resource locator or other single location with respect to the
Internet.
 
    Section 10. Prohibitions. It is unlawful for any person, by
means of a Web page, electronic mail message, or otherwise
through use of the Internet, to solicit, request, or take any
action to induce another person to provide identifying
information by representing himself, herself, or itself to be a
business without the authority or approval of the business.
 
    Section 15. Actions.
    (a) The following persons may bring an action against a
person who violates or is in violation of Section 10:
        (1) A person who (A) is engaged in the business of
    providing Internet access service to the public, owns a Web
    page, or owns a trademark, and (B) is adversely affected by
    a violation of Section 10.
        An action brought under this paragraph may seek to
    recover the greater of actual damages or $500,000.
        (2) An individual who is adversely affected by a
    violation of Section 10 may bring an action, but only
    against a person who has directly violated Section 10.
        An action brought under this paragraph may seek to
    enjoin further violations of Section 10 and to recover the
    greater of 3 times the amount of actual damages or $5,000
    per violation.
    (b) The Attorney General or a State's Attorney may bring an
action against a person who violates or is in violation of
Section 10 to enjoin further violations of Section 10 and to
recover a civil penalty of up to $2,500 per violation.
    (c) In an action pursuant to this Section, a court may, in
addition, do either or both of the following:
        (1) Increase the recoverable damages to an amount up to
    3 times the damages otherwise recoverable under subsection
    (a) in cases in which the defendant has engaged in a
    pattern and practice of violating Section 10.
        (2) Award costs of suit and reasonable attorney's fees
    to a prevailing plaintiff.
    (d) The remedies provided in this Section do not preclude
the seeking of remedies, including criminal remedies, under any
other applicable provision of law.
    (e) For purposes of paragraph (1) of subsection (a),
multiple violations of Section 10 resulting from any single
action or conduct shall constitute one violation.

Effective Date: 1/1/2008