Illinois 2023-2024 Regular Session

Illinois House Bill HB4433 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED: New Act5 ILCS 140/7.5 Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025. LRB103 36043 RPS 66130 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED: New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5 Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025. LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED:
3	3	New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5
4	4	New Act
5	5	5 ILCS 140/7.5
6	6	Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025.
7	7	LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b
8	8	LRB103 36043 RPS 66130 b
9	9	A BILL FOR
10	10	HB4433LRB103 36043 RPS 66130 b HB4433 LRB103 36043 RPS 66130 b
11	11	HB4433 LRB103 36043 RPS 66130 b
12	12	1 AN ACT concerning regulation.
13	13	2 Be it enacted by the People of the State of Illinois,
14	14	3 represented in the General Assembly:
15	15	4 Section 1. Short title. This Act may be cited as the
16	16	5 Insurance Data Security Law.
17	17	6 Section 2. Purpose and intent.
18	18	7 (a) The purpose and intent of this Act is to establish
19	19	8 standards for data security and standards for the
20	20	9 investigation of and notification to the Director of a
21	21	10 cybersecurity event applicable to licensees.
22	22	11 (b) This Act shall not be construed to create or imply a
23	23	12 private cause of action for a violation of its provisions nor
24	24	13 shall it be construed to curtail a private cause of action
25	25	14 which would otherwise exist in the absence of this Act.
26	26	15 Section 5. Definitions. As used in this Act:
27	27	16 "Authorized individual" means an individual known to and
28	28	17 screened by the licensee and determined to be necessary and
29	29	18 appropriate to have access to the nonpublic information held
30	30	19 by the licensee and its information systems.
31	31	20 "Consumer" means an individual, including, but not limited
32	32	21 to, an applicant, policyholder, insured, beneficiary,
33	33	22 claimant, or certificate holder who is a resident of this
34	34
35	35
36	36
37	37	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED:
38	38	New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5
39	39	New Act
40	40	5 ILCS 140/7.5
41	41	Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025.
42	42	LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b
43	43	LRB103 36043 RPS 66130 b
44	44	A BILL FOR
45	45
46	46
47	47
48	48
49	49
50	50	New Act
51	51	5 ILCS 140/7.5
52	52
53	53
54	54
55	55	LRB103 36043 RPS 66130 b
56	56
57	57
58	58
59	59
60	60
61	61
62	62
63	63
64	64
65	65	HB4433 LRB103 36043 RPS 66130 b
66	66
67	67
68	68	HB4433- 2 -LRB103 36043 RPS 66130 b HB4433 - 2 - LRB103 36043 RPS 66130 b
69	69	HB4433 - 2 - LRB103 36043 RPS 66130 b
70	70	1 State and whose nonpublic information is in a licensee's
71	71	2 possession, custody, or control.
72	72	3 "Cybersecurity event" means an event resulting in
73	73	4 unauthorized access to, disruption, or misuse of an
74	74	5 information system or information stored on such information
75	75	6 system. "Cybersecurity event" does not include the
76	76	7 unauthorized acquisition of encrypted nonpublic information if
77	77	8 the encryption, process, or key is not also acquired,
78	78	9 released, or used without authorization. "Cybersecurity event"
79	79	10 does not include an event with regard to which the licensee has
80	80	11 determined that the nonpublic information accessed by an
81	81	12 unauthorized person has not been used or released and has been
82	82	13 returned or destroyed.
83	83	14 "Department" means the Department of Insurance.
84	84	15 "Director" means the Director of Insurance.
85	85	16 "Encrypted" means the transformation of data into a form
86	86	17 which results in a low probability of assigning meaning
87	87	18 without the use of a protective process or key.
88	88	19 "Information security program" means the administrative,
89	89	20 technical, and physical safeguards that a licensee uses to
90	90	21 access, collect, distribute, process, protect, store, use,
91	91	22 transmit, dispose of, or otherwise handle nonpublic
92	92	23 information.
93	93	24 "Information system" means a discrete set of electronic
94	94	25 information resources organized for the collection,
95	95	26 processing, maintenance, use, sharing, dissemination, or
96	96
97	97
98	98
99	99
100	100
101	101	HB4433 - 2 - LRB103 36043 RPS 66130 b
102	102
103	103
104	104	HB4433- 3 -LRB103 36043 RPS 66130 b HB4433 - 3 - LRB103 36043 RPS 66130 b
105	105	HB4433 - 3 - LRB103 36043 RPS 66130 b
106	106	1 disposition of electronic information, as well as any
107	107	2 specialized system such as industrial and process controls
108	108	3 systems, telephone switching and private branch exchange
109	109	4 systems, and environmental control systems.
110	110	5 "Licensee" means any person licensed, authorized to
111	111	6 operate, or registered, or required to be licensed,
112	112	7 authorized, or registered pursuant to the insurance laws of
113	113	8 this State. "Licensee" does not include a purchasing group or
114	114	9 a risk retention group chartered and licensed in a state other
115	115	10 than this State or a licensee that is acting as an assuming
116	116	11 insurer that is domiciled in another state or jurisdiction.
117	117	12 "Multi-factor authentication" means authentication
118	118	13 through verification of at least 2 of the following types of
119	119	14 authentication factors:
120	120	15 (1) knowledge factors, including a password;
121	121	16 (2) possession factors, including a token or text
122	122	17 message on a mobile phone; or
123	123	18 (3) inherence factors, including a biometric
124	124	19 characteristic.
125	125	20 "Nonpublic information" means information that is not
126	126	21 publicly available information and that is:
127	127	22 (1) business-related information of a licensee the
128	128	23 tampering with which, or unauthorized disclosure, access,
129	129	24 or use of which, would cause a material adverse impact to
130	130	25 the business, operations, or security of the licensee;
131	131	26 (2) any information concerning a consumer which
132	132
133	133
134	134
135	135
136	136
137	137	HB4433 - 3 - LRB103 36043 RPS 66130 b
138	138
139	139
140	140	HB4433- 4 -LRB103 36043 RPS 66130 b HB4433 - 4 - LRB103 36043 RPS 66130 b
141	141	HB4433 - 4 - LRB103 36043 RPS 66130 b
142	142	1 because of name, number, personal mark, or other
143	143	2 identifier can be used to identify such consumer, in
144	144	3 combination with any one or more of the following data
145	145	4 elements:
146	146	5 (A) social security number;
147	147	6 (B) driver's license number or nondriver
148	148	7 identification card number;
149	149	8 (C) account number, credit card number, or debit
150	150	9 card number;
151	151	10 (D) any security code, access code, or password
152	152	11 that would permit access to a consumer's financial
153	153	12 account; or
154	154	13 (E) biometric records; or
155	155	14 (3) any information or data, except age or gender, in
156	156	15 any form or medium created by or derived from a health care
157	157	16 provider or a consumer and that relates to:
158	158	17 (A) the past, present, or future physical, mental,
159	159	18 or behavioral health or condition of any consumer or a
160	160	19 member of the consumer's family;
161	161	20 (B) the provision of health care to any consumer;
162	162	21 or
163	163	22 (C) payment for the provision of health care to
164	164	23 any consumer.
165	165	24 "Person" means any individual or any nongovernmental
166	166	25 entity, including, but not limited to, any nongovernmental
167	167	26 partnership, corporation, branch, agency, or association.
168	168
169	169
170	170
171	171
172	172
173	173	HB4433 - 4 - LRB103 36043 RPS 66130 b
174	174
175	175
176	176	HB4433- 5 -LRB103 36043 RPS 66130 b HB4433 - 5 - LRB103 36043 RPS 66130 b
177	177	HB4433 - 5 - LRB103 36043 RPS 66130 b
178	178	1 "Publicly available information" means any information
179	179	2 that a licensee has a reasonable basis to believe is lawfully
180	180	3 made available to the general public from federal, State, or
181	181	4 local government records; widely distributed media; or
182	182	5 disclosures to the general public that are required to be made
183	183	6 by federal, State, or local law. "Publicly available
184	184	7 information" includes information that a consumer may direct
185	185	8 not to be made available to the general public, but that the
186	186	9 consumer has not directed not be made available.
187	187	10 "Risk assessment" means the risk assessment that each
188	188	11 licensee is required to conduct under subsection (c) of
189	189	12 Section 10.
190	190	13 "Third-party service provider" means a person, not
191	191	14 otherwise defined as a licensee, that contracts with a
192	192	15 licensee to maintain, process, store, or otherwise is
193	193	16 permitted access to nonpublic information through its
194	194	17 provision of services to the licensee.
195	195	18 Section 10. Information security program.
196	196	19 (a) Commensurate with the size and complexity of the
197	197	20 licensee, the nature and scope of the licensee's activities,
198	198	21 including its use of third-party service providers, and the
199	199	22 sensitivity of the nonpublic information used by the licensee
200	200	23 or in the licensee's possession, custody, or control, each
201	201	24 licensee shall develop, implement, and maintain a
202	202	25 comprehensive written information security program based on
203	203
204	204
205	205
206	206
207	207
208	208	HB4433 - 5 - LRB103 36043 RPS 66130 b
209	209
210	210
211	211	HB4433- 6 -LRB103 36043 RPS 66130 b HB4433 - 6 - LRB103 36043 RPS 66130 b
212	212	HB4433 - 6 - LRB103 36043 RPS 66130 b
213	213	1 the licensee's risk assessment and that contains
214	214	2 administrative, technical, and physical safeguards for the
215	215	3 protection of nonpublic information and the licensee's
216	216	4 information system.
217	217	5 (b) A licensee's information security program shall be
218	218	6 designed to:
219	219	7 (1) protect the security and confidentiality of
220	220	8 nonpublic information and the security of the information
221	221	9 system;
222	222	10 (2) protect against any threats or hazards to the
223	223	11 security or integrity of nonpublic information and the
224	224	12 information system;
225	225	13 (3) protect against unauthorized access to or use of
226	226	14 nonpublic information;
227	227	15 (4) minimize the likelihood of harm to any consumer;
228	228	16 and
229	229	17 (5) define and periodically reevaluate a schedule for
230	230	18 retention of nonpublic information and a mechanism for its
231	231	19 destruction when no longer needed.
232	232	20 (c) A licensee shall:
233	233	21 (1) designate one or more employees, an affiliate, or
234	234	22 an outside vendor designated to act on behalf of the
235	235	23 licensee who is responsible for the information security
236	236	24 program;
237	237	25 (2) identify reasonably foreseeable internal or
238	238	26 external threats that could result in unauthorized access,
239	239
240	240
241	241
242	242
243	243
244	244	HB4433 - 6 - LRB103 36043 RPS 66130 b
245	245
246	246
247	247	HB4433- 7 -LRB103 36043 RPS 66130 b HB4433 - 7 - LRB103 36043 RPS 66130 b
248	248	HB4433 - 7 - LRB103 36043 RPS 66130 b
249	249	1 transmission, disclosure, misuse, alteration, or
250	250	2 destruction of nonpublic information, including the
251	251	3 security of information systems and nonpublic information
252	252	4 that are accessible to or held by third-party service
253	253	5 providers;
254	254	6 (3) assess the likelihood and potential damage of
255	255	7 these threats, taking into consideration the sensitivity
256	256	8 of the nonpublic information;
257	257	9 (4) assess the sufficiency of policies, procedures,
258	258	10 information systems, and other safeguards in place to
259	259	11 manage these threats, including consideration of threats
260	260	12 in each relevant area of the licensee's operations,
261	261	13 including:
262	262	14 (A) employee training and management;
263	263	15 (B) information systems, including network and
264	264	16 software design, as well as information
265	265	17 classification, governance, processing, storage,
266	266	18 transmission, and disposal; and
267	267	19 (C) detecting, preventing, and responding to
268	268	20 attacks, intrusions, or other systems failures; and
269	269	21 (5) implement information safeguards to manage the
270	270	22 threats identified in its ongoing assessment, and, no less
271	271	23 than annually, assess the effectiveness of the safeguards'
272	272	24 key controls, systems, and procedures.
273	273	25 (d) Based on its risk assessment, the licensee shall:
274	274	26 (1) design its information security program to
275	275
276	276
277	277
278	278
279	279
280	280	HB4433 - 7 - LRB103 36043 RPS 66130 b
281	281
282	282
283	283	HB4433- 8 -LRB103 36043 RPS 66130 b HB4433 - 8 - LRB103 36043 RPS 66130 b
284	284	HB4433 - 8 - LRB103 36043 RPS 66130 b
285	285	1 mitigate the identified risks, commensurate with the size
286	286	2 and complexity of the licensee's activities, including its
287	287	3 use of third-party service providers, and the sensitivity
288	288	4 of the nonpublic information used by the licensee or in
289	289	5 the licensee's possession, custody, or control;
290	290	6 (2) select and implement appropriate security measures
291	291	7 from the following:
292	292	8 (A) place access controls on information systems,
293	293	9 including controls to authenticate and permit access
294	294	10 only to authorized individuals to protect against the
295	295	11 unauthorized acquisition of nonpublic information;
296	296	12 (B) identify and manage the data, personnel,
297	297	13 devices, systems, and facilities that enable the
298	298	14 organization to achieve business purposes in
299	299	15 accordance with their relative importance to business
300	300	16 objectives and the organization's risk strategy;
301	301	17 (C) restrict access at physical locations
302	302	18 containing nonpublic information only to authorized
303	303	19 individuals;
304	304	20 (D) protect, by encryption or other appropriate
305	305	21 means, all nonpublic information while being
306	306	22 transmitted over an external network and all nonpublic
307	307	23 information stored on a laptop computer or other
308	308	24 portable computing or storage device or media;
309	309	25 (E) adopt secure development practices for
310	310	26 in-house-developed applications utilized by the
311	311
312	312
313	313
314	314
315	315
316	316	HB4433 - 8 - LRB103 36043 RPS 66130 b
317	317
318	318
319	319	HB4433- 9 -LRB103 36043 RPS 66130 b HB4433 - 9 - LRB103 36043 RPS 66130 b
320	320	HB4433 - 9 - LRB103 36043 RPS 66130 b
321	321	1 licensee and procedures for evaluating, assessing, or
322	322	2 testing the security of externally developed
323	323	3 applications utilized by the licensee;
324	324	4 (F) modify the information system in accordance
325	325	5 with the licensee's information security program;
326	326	6 (G) utilize effective controls, including
327	327	7 multifactor authentication procedures for any
328	328	8 individual accessing nonpublic information;
329	329	9 (H) regularly test and monitor systems and
330	330	10 procedures to detect actual and attempted attacks on
331	331	11 or intrusions into information systems;
332	332	12 (I) include audit trails within the information
333	333	13 security program designed to detect and respond to
334	334	14 cybersecurity events and designed to reconstruct
335	335	15 material financial transactions sufficient to support
336	336	16 normal operations and obligations of the licensee;
337	337	17 (J) implement measures to protect against
338	338	18 destruction, loss, or damage of nonpublic information
339	339	19 due to environmental hazards, including fire and water
340	340	20 damage, other catastrophes, or technological failures;
341	341	21 and
342	342	22 (K) develop, implement, and maintain procedures
343	343	23 for the secure disposal of nonpublic information in
344	344	24 any format;
345	345	25 (3) include cybersecurity risks in the licensee's
346	346	26 enterprise risk management process;
347	347
348	348
349	349
350	350
351	351
352	352	HB4433 - 9 - LRB103 36043 RPS 66130 b
353	353
354	354
355	355	HB4433- 10 -LRB103 36043 RPS 66130 b HB4433 - 10 - LRB103 36043 RPS 66130 b
356	356	HB4433 - 10 - LRB103 36043 RPS 66130 b
357	357	1 (4) stay informed regarding emerging threats or
358	358	2 vulnerabilities and utilize reasonable security measures
359	359	3 when sharing information relative to the character of the
360	360	4 sharing and the type of information shared; and
361	361	5 (5) provide its personnel with cybersecurity awareness
362	362	6 training that is updated as necessary to reflect risks
363	363	7 identified by the licensee in the risk assessment.
364	364	8 (e) If the licensee has a board of directors, the board or
365	365	9 an appropriate committee of the board shall, at a minimum:
366	366	10 (1) require the licensee's executive management or its
367	367	11 delegates to develop, implement, and maintain the
368	368	12 licensee's information security program;
369	369	13 (2) require the licensee's executive management or its
370	370	14 delegates to report in writing, at least annually, the
371	371	15 following information:
372	372	16 (A) the overall status of the information security
373	373	17 program and the licensee's compliance with this Act;
374	374	18 and
375	375	19 (B) material matters related to the information
376	376	20 security program, addressing issues such as risk
377	377	21 assessment, risk management and control decisions,
378	378	22 third-party service provider arrangements, results of
379	379	23 testing, cybersecurity events or violations and
380	380	24 management's responses thereto, and recommendations
381	381	25 for changes in the information security program; and
382	382	26 (3) if executive management delegates any of its
383	383
384	384
385	385
386	386
387	387
388	388	HB4433 - 10 - LRB103 36043 RPS 66130 b
389	389
390	390
391	391	HB4433- 11 -LRB103 36043 RPS 66130 b HB4433 - 11 - LRB103 36043 RPS 66130 b
392	392	HB4433 - 11 - LRB103 36043 RPS 66130 b
393	393	1 responsibilities under this Section, it shall oversee the
394	394	2 development, implementation, and maintenance of the
395	395	3 licensee's information security program prepared by the
396	396	4 delegate and shall receive a report from the delegate
397	397	5 complying with the requirements of the report to the board
398	398	6 of directors.
399	399	7 (f) A licensee shall exercise due diligence in selecting
400	400	8 its third-party service provider and a licensee shall require
401	401	9 a third-party service provider to implement appropriate
402	402	10 administrative, technical, and physical measures to protect
403	403	11 and secure the information systems and nonpublic information
404	404	12 that are accessible to or held by the third-party service
405	405	13 provider.
406	406	14 (g) The licensee shall monitor, evaluate, and adjust, as
407	407	15 appropriate, the information security program consistent with
408	408	16 any relevant changes in technology, the sensitivity of its
409	409	17 nonpublic information, internal or external threats to
410	410	18 information, and the licensee's own changing business
411	411	19 arrangements, including mergers and acquisitions, alliances
412	412	20 and joint ventures, outsourcing arrangements, and changes to
413	413	21 information systems.
414	414	22 (h) As part of its information security program, a
415	415	23 licensee shall establish a written incident response plan
416	416	24 designed to promptly respond to and recover from any
417	417	25 cybersecurity event that compromises the confidentiality,
418	418	26 integrity, or availability of nonpublic information in its
419	419
420	420
421	421
422	422
423	423
424	424	HB4433 - 11 - LRB103 36043 RPS 66130 b
425	425
426	426
427	427	HB4433- 12 -LRB103 36043 RPS 66130 b HB4433 - 12 - LRB103 36043 RPS 66130 b
428	428	HB4433 - 12 - LRB103 36043 RPS 66130 b
429	429	1 possession, the licensee's information systems, or the
430	430	2 continuing functionality of any aspect of the licensee's
431	431	3 business or operations. The incident response plan shall
432	432	4 address the following areas:
433	433	5 (1) the internal process for responding to a
434	434	6 cybersecurity event;
435	435	7 (2) the goals of the incident response plan;
436	436	8 (3) the definition of clear roles, responsibilities,
437	437	9 and levels of decision-making authority;
438	438	10 (4) external and internal communications and
439	439	11 information sharing;
440	440	12 (5) identification of requirements for the remediation
441	441	13 of any identified weaknesses in information systems and
442	442	14 associated controls;
443	443	15 (6) documentation and reporting regarding
444	444	16 cybersecurity events and related incident response
445	445	17 activities; and
446	446	18 (7) the evaluation and revision of the incident
447	447	19 response plan following a cybersecurity event, as
448	448	20 necessary.
449	449	21 (i) Annually, an insurer domiciled in this State shall
450	450	22 submit to the Director a written statement by February 15
451	451	23 certifying that the insurer is in compliance with the
452	452	24 requirements set forth in this Section. Each insurer shall
453	453	25 maintain for examination by the Department all records,
454	454	26 schedules, and data supporting this certificate for a period
455	455
456	456
457	457
458	458
459	459
460	460	HB4433 - 12 - LRB103 36043 RPS 66130 b
461	461
462	462
463	463	HB4433- 13 -LRB103 36043 RPS 66130 b HB4433 - 13 - LRB103 36043 RPS 66130 b
464	464	HB4433 - 13 - LRB103 36043 RPS 66130 b
465	465	1 of 5 years. To the extent an insurer has identified areas,
466	466	2 systems, or processes that require material improvement,
467	467	3 updating, or redesign, the insurer shall document the
468	468	4 identification and the remedial efforts planned and underway
469	469	5 to address such areas, systems, or processes. The
470	470	6 documentation of identified areas, systems, or processes must
471	471	7 be available for inspection by the Director.
472	472	8 (j) Licensees shall comply with subsection (f) 2 years
473	473	9 after the effective date of this Act, and shall comply with all
474	474	10 other subsections of this Section one year after the effective
475	475	11 date of this Act.
476	476	12 Section 15. Investigation of a cybersecurity event.
477	477	13 (a) If the licensee learns that a cybersecurity event has
478	478	14 occurred or may have occurred, the licensee, or an outside
479	479	15 vendor or service provider designated to act on behalf of the
480	480	16 licensee, shall conduct a prompt investigation.
481	481	17 (b) During the investigation the licensee, or an outside
482	482	18 vendor or service provider designated to act on behalf of the
483	483	19 licensee, shall, at a minimum, comply with as many of the
484	484	20 following as possible:
485	485	21 (1) determine whether a cybersecurity event has
486	486	22 occurred;
487	487	23 (2) assess the nature and scope of the cybersecurity
488	488	24 event;
489	489	25 (3) identify any nonpublic information that may have
490	490
491	491
492	492
493	493
494	494
495	495	HB4433 - 13 - LRB103 36043 RPS 66130 b
496	496
497	497
498	498	HB4433- 14 -LRB103 36043 RPS 66130 b HB4433 - 14 - LRB103 36043 RPS 66130 b
499	499	HB4433 - 14 - LRB103 36043 RPS 66130 b
500	500	1 been involved in the cybersecurity event; and
501	501	2 (4) perform or oversee reasonable measures to restore
502	502	3 the security of the information systems compromised in the
503	503	4 cybersecurity event in order to prevent further
504	504	5 unauthorized acquisition, release, or use of nonpublic
505	505	6 information in the licensee's possession, custody, or
506	506	7 control.
507	507	8 (c) If the licensee learns that a cybersecurity event has
508	508	9 occurred or may have occurred in a system maintained by a
509	509	10 third-party service provider, the licensee will complete the
510	510	11 steps listed in subsection (b) or confirm and document that
511	511	12 the third-party service provider has completed those steps.
512	512	13 (d) The licensee shall maintain records concerning all
513	513	14 cybersecurity events for a period of at least 5 years from the
514	514	15 date of the cybersecurity event and shall produce those
515	515	16 records upon demand of the Director.
516	516	17 Section 20. Notification of a cybersecurity event.
517	517	18 (a) A licensee shall notify the Director as promptly as
518	518	19 possible but no later than 72 hours after a determination that
519	519	20 a cybersecurity event has occurred when either of the
520	520	21 following criteria has been met:
521	521	22 (1) this State is the licensee's state of domicile, in
522	522	23 the case of an insurer, or this State is the licensee's
523	523	24 home state, in the case of an insurance producer, as those
524	524	25 terms are defined in Article XXXI of the Illinois
525	525
526	526
527	527
528	528
529	529
530	530	HB4433 - 14 - LRB103 36043 RPS 66130 b
531	531
532	532
533	533	HB4433- 15 -LRB103 36043 RPS 66130 b HB4433 - 15 - LRB103 36043 RPS 66130 b
534	534	HB4433 - 15 - LRB103 36043 RPS 66130 b
535	535	1 Insurance Code; or
536	536	2 (2) the licensee reasonably believes that the
537	537	3 nonpublic information involved is of 250 or more consumers
538	538	4 residing in this State and that is either of the
539	539	5 following:
540	540	6 (A) a cybersecurity event impacting the licensee
541	541	7 of which notice is required to be provided to any
542	542	8 government body, self-regulatory agency, or any other
543	543	9 supervisory body pursuant to any State or federal law;
544	544	10 or
545	545	11 (B) a cybersecurity event that has a reasonable
546	546	12 likelihood of materially harming:
547	547	13 (i) any consumer residing in this State; or
548	548	14 (ii) any material part of the normal
549	549	15 operations of the licensee.
550	550	16 (b) A licensee shall provide as much of the following
551	551	17 information as possible:
552	552	18 (1) the date of the cybersecurity event;
553	553	19 (2) a description of how the information was exposed,
554	554	20 lost, stolen, or breached, including the specific roles
555	555	21 and responsibilities of third-party service providers, if
556	556	22 any;
557	557	23 (3) how the cybersecurity event was discovered;
558	558	24 (4) whether any lost, stolen, or breached information
559	559	25 has been recovered and if so, how it was recovered;
560	560	26 (5) the identity of the source of the cybersecurity
561	561
562	562
563	563
564	564
565	565
566	566	HB4433 - 15 - LRB103 36043 RPS 66130 b
567	567
568	568
569	569	HB4433- 16 -LRB103 36043 RPS 66130 b HB4433 - 16 - LRB103 36043 RPS 66130 b
570	570	HB4433 - 16 - LRB103 36043 RPS 66130 b
571	571	1 event;
572	572	2 (6) whether the licensee has filed a police report or
573	573	3 has notified any regulatory, government, or law
574	574	4 enforcement agencies and, if so, when such notification
575	575	5 was provided;
576	576	6 (7) a description of the specific types of information
577	577	7 acquired without authorization, including types of medical
578	578	8 information, types of financial information, or types of
579	579	9 information allowing identification of the consumer;
580	580	10 (8) the period during which the information system was
581	581	11 compromised by the cybersecurity event;
582	582	12 (9) the number of total consumers in this State
583	583	13 affected by the cybersecurity event; the licensee shall
584	584	14 provide the best estimate in the initial report to the
585	585	15 Director and update this estimate with each subsequent
586	586	16 report to the Director pursuant to this Section;
587	587	17 (10) the results of any internal review identifying a
588	588	18 lapse in either automated controls or internal procedures,
589	589	19 or confirming that all automated controls or internal
590	590	20 procedures were followed;
591	591	21 (11) a description of efforts being undertaken to
592	592	22 remediate the situation which permitted the cybersecurity
593	593	23 event to occur;
594	594	24 (12) a copy of the licensee's privacy policy and a
595	595	25 statement outlining the steps the licensee will take to
596	596	26 investigate and notify consumers affected by the
597	597
598	598
599	599
600	600
601	601
602	602	HB4433 - 16 - LRB103 36043 RPS 66130 b
603	603
604	604
605	605	HB4433- 17 -LRB103 36043 RPS 66130 b HB4433 - 17 - LRB103 36043 RPS 66130 b
606	606	HB4433 - 17 - LRB103 36043 RPS 66130 b
607	607	1 cybersecurity event; and
608	608	2 (13) the name of a contact person who is both familiar
609	609	3 with the cybersecurity event and authorized to act for the
610	610	4 licensee.
611	611	5 The licensee shall provide the information in electronic
612	612	6 form as directed by the Director. The licensee shall have a
613	613	7 continuing obligation to update and supplement initial and
614	614	8 subsequent notifications to the Director concerning the
615	615	9 cybersecurity event.
616	616	10 (c) Licensees shall comply with the Personal Information
617	617	11 Protection Act, as applicable, and provide a copy of the
618	618	12 notice sent to consumers under that statute to the Director
619	619	13 when a licensee is required to notify the Director under
620	620	14 subsection (a).
621	621	15 (d) If a licensee becomes aware of a cybersecurity event
622	622	16 in a system maintained by a third-party service provider, the
623	623	17 licensee shall treat the event as it would under subsection
624	624	18 (a). The computation of licensee's deadlines shall begin on
625	625	19 the day after the third-party service provider notifies the
626	626	20 licensee of the cybersecurity event or the licensee otherwise
627	627	21 has actual knowledge of the cybersecurity event, whichever is
628	628	22 sooner.
629	629	23 (e) Nothing in this Act shall prevent or abrogate an
630	630	24 agreement between a licensee and another licensee, a
631	631	25 third-party service provider, or any other party to fulfill
632	632	26 any of the investigation requirements imposed under Section 15
633	633
634	634
635	635
636	636
637	637
638	638	HB4433 - 17 - LRB103 36043 RPS 66130 b
639	639
640	640
641	641	HB4433- 18 -LRB103 36043 RPS 66130 b HB4433 - 18 - LRB103 36043 RPS 66130 b
642	642	HB4433 - 18 - LRB103 36043 RPS 66130 b
643	643	1 or notice requirements imposed under this Section.
644	644	2 (f) In the case of a cybersecurity event involving
645	645	3 nonpublic information that is used by the licensee that is
646	646	4 acting as an assuming insurer or in the possession, custody,
647	647	5 or control of a licensee that is acting as an assuming insurer
648	648	6 and that does not have a direct contractual relationship with
649	649	7 the affected consumers, the assuming insurer shall notify its
650	650	8 affected ceding insurers and the Director of its state of
651	651	9 domicile within 72 hours after making the determination that a
652	652	10 cybersecurity event has occurred.
653	653	11 In the case of a cybersecurity event involving nonpublic
654	654	12 information that is in the possession, custody, or control of
655	655	13 a third-party service provider of a licensee that is an
656	656	14 assuming insurer, the assuming insurer shall notify its
657	657	15 affected ceding insurers and the Director of its state of
658	658	16 domicile within 72 hours after receiving notice from its
659	659	17 third-party service provider that a cybersecurity event has
660	660	18 occurred.
661	661	19 The ceding insurers that have a direct contractual
662	662	20 relationship with affected consumers shall fulfill the
663	663	21 consumer notification requirements imposed under the Personal
664	664	22 Information Protection Act and any other notification
665	665	23 requirements relating to a cybersecurity event imposed under
666	666	24 this Section.
667	667	25 (g) In the case of a cybersecurity event involving
668	668	26 nonpublic information that is in the possession, custody, or
669	669
670	670
671	671
672	672
673	673
674	674	HB4433 - 18 - LRB103 36043 RPS 66130 b
675	675
676	676
677	677	HB4433- 19 -LRB103 36043 RPS 66130 b HB4433 - 19 - LRB103 36043 RPS 66130 b
678	678	HB4433 - 19 - LRB103 36043 RPS 66130 b
679	679	1 control of a licensee that is an insurer or its third-party
680	680	2 service provider and for which a consumer accessed the
681	681	3 insurer's services through an independent insurance producer,
682	682	4 the insurer shall notify the producers of record of all
683	683	5 affected consumers as soon as practicable as directed by the
684	684	6 Director. The insurer is excused from this obligation for
685	685	7 those instances in which it does not have the current producer
686	686	8 of record information for any individual consumer.
687	687	9 Section 25. Power of Director.
688	688	10 (a) The Director shall have power to examine and
689	689	11 investigate the affairs of any licensee to determine whether
690	690	12 the licensee has been or is engaged in any conduct in violation
691	691	13 of this Act. This power is in addition to the powers which the
692	692	14 Director has under the Illinois Insurance Code, including
693	693	15 Sections 132, 132.3, 132.4, 133, 401, 402, 403, and 425 of the
694	694	16 Illinois Insurance Code. Any investigation or examination
695	695	17 shall be conducted pursuant to the Illinois Insurance Code,
696	696	18 including Sections 132, 132.3, 132.4, 133, 401, 402, 403, and
697	697	19 425 of the Illinois Insurance Code.
698	698	20 (b) Whenever the Director has reason to believe that a
699	699	21 licensee has been or is engaged in conduct in this State which
700	700	22 violates this Act, the Director may take action that is
701	701	23 necessary or appropriate to enforce the provisions of this
702	702	24 Act.
703	703
704	704
705	705
706	706
707	707
708	708	HB4433 - 19 - LRB103 36043 RPS 66130 b
709	709
710	710
711	711	HB4433- 20 -LRB103 36043 RPS 66130 b HB4433 - 20 - LRB103 36043 RPS 66130 b
712	712	HB4433 - 20 - LRB103 36043 RPS 66130 b
713	713	1 Section 30. Confidentiality.
714	714	2 (a) Any documents, materials, or other information in the
715	715	3 control or possession of the Department that are furnished by
716	716	4 a licensee or an employee or agent thereof acting on behalf of
717	717	5 licensee pursuant to subsection (i) of Section 10, subsection
718	718	6 (b) of Section 20, or that are obtained by the Director in an
719	719	7 investigation or examination pursuant to Section 25 shall be
720	720	8 confidential by law and privileged, shall not be subject to
721	721	9 the Freedom of Information Act, shall not be subject to
722	722	10 subpoena, and shall not be subject to discovery or admissible
723	723	11 in evidence in any private civil action. However, the Director
724	724	12 is authorized to use the documents, materials, or other
725	725	13 information in the furtherance of any regulatory or legal
726	726	14 action brought as a part of the Director's duties.
727	727	15 (b) Neither the Director nor any person who received
728	728	16 documents, materials, or other information while acting under
729	729	17 the authority of the Director shall be permitted or required
730	730	18 to testify in any private civil action concerning any
731	731	19 confidential documents, materials, or information subject to
732	732	20 subsection (a).
733	733	21 (c) In order to assist in the performance of the
734	734	22 Director's duties under this Act, the Director:
735	735	23 (1) may share documents, materials, or other
736	736	24 information, including the confidential and privileged
737	737	25 documents, materials, or information subject to subsection
738	738	26 (a), with other State, federal, and international
739	739
740	740
741	741
742	742
743	743
744	744	HB4433 - 20 - LRB103 36043 RPS 66130 b
745	745
746	746
747	747	HB4433- 21 -LRB103 36043 RPS 66130 b HB4433 - 21 - LRB103 36043 RPS 66130 b
748	748	HB4433 - 21 - LRB103 36043 RPS 66130 b
749	749	1 regulatory agencies, with the National Association of
750	750	2 Insurance Commissioners and its affiliates or
751	751	3 subsidiaries, and with State, federal, and international
752	752	4 law enforcement authorities, if the recipient agrees in
753	753	5 writing to maintain the confidentiality and privileged
754	754	6 status of the document, material, or other information;
755	755	7 (2) may receive documents, materials, or information,
756	756	8 including otherwise confidential and privileged documents,
757	757	9 materials, or information, from the National Association
758	758	10 of Insurance Commissioners and its affiliates or
759	759	11 subsidiaries and from regulatory and law enforcement
760	760	12 officials of other foreign or domestic jurisdictions, and
761	761	13 shall maintain as confidential or privileged any document,
762	762	14 material, or information received with notice or the
763	763	15 understanding that it is confidential or privileged under
764	764	16 the laws of the jurisdiction that is the source of the
765	765	17 document, material, or information;
766	766	18 (3) may share documents, materials, or other
767	767	19 information subject to subsection (a), with a third-party
768	768	20 consultant or vendor if the consultant agrees in writing
769	769	21 to maintain the confidentiality and privileged status of
770	770	22 the document, material, or other information; and
771	771	23 (4) may enter into agreements governing sharing and
772	772	24 use of information consistent with this subsection.
773	773	25 (d) No waiver of any applicable privilege or claim of
774	774	26 confidentiality in the documents, materials, or information
775	775
776	776
777	777
778	778
779	779
780	780	HB4433 - 21 - LRB103 36043 RPS 66130 b
781	781
782	782
783	783	HB4433- 22 -LRB103 36043 RPS 66130 b HB4433 - 22 - LRB103 36043 RPS 66130 b
784	784	HB4433 - 22 - LRB103 36043 RPS 66130 b
785	785	1 shall occur as a result of disclosure to the Director under
786	786	2 this Section or as a result of sharing as authorized in
787	787	3 subsection (c).
788	788	4 (e) Nothing in this Act shall prohibit the Director from
789	789	5 releasing final, adjudicated actions that are open to public
790	790	6 inspection pursuant to the Illinois Insurance Code to a
791	791	7 database or other clearinghouse service maintained by the
792	792	8 National Association of Insurance Commissioners and its
793	793	9 affiliates or subsidiaries.
794	794	10 Section 35. Exceptions.
795	795	11 (a) The following exceptions shall apply to this Act:
796	796	12 (1) A licensee with fewer than 10 employees, including
797	797	13 any independent contractors, is exempt from Section 10.
798	798	14 (2) A licensee subject to the Health Insurance
799	799	15 Portability and Accountability Act that has established
800	800	16 and maintains an information security program pursuant to
801	801	17 such statutes, rules, regulations, procedures, or
802	802	18 guidelines established thereunder, shall be considered to
803	803	19 meet the requirements of Section 10 if the licensee is
804	804	20 compliant with the Health Insurance Portability and
805	805	21 Accountability Act and submits a written statement
806	806	22 certifying its compliance with the same.
807	807	23 (3) An employee, agent, representative, or designee of
808	808	24 a licensee that is also a licensee is exempt from Section
809	809	25 10 and need not develop its own information security
810	810
811	811
812	812
813	813
814	814
815	815	HB4433 - 22 - LRB103 36043 RPS 66130 b
816	816
817	817
818	818	HB4433- 23 -LRB103 36043 RPS 66130 b HB4433 - 23 - LRB103 36043 RPS 66130 b
819	819	HB4433 - 23 - LRB103 36043 RPS 66130 b
820	820	1 program to the extent that the employee, agent,
821	821	2 representative, or designee is covered by the information
822	822	3 security program of the other licensee.
823	823	4 (b) If a licensee ceases to qualify for an exception, the
824	824	5 licensee shall comply with this Act within 180 days.
825	825	6 Section 40. Penalties. In the case of a violation of this
826	826	7 Act, a licensee may be penalized in accordance with the
827	827	8 provisions of the Illinois Insurance Code, including Section
828	828	9 403A of the Illinois Insurance Code.
829	829	10 Section 45. Rules. The Department may, in accordance with
830	830	11 the Illinois Administrative Procedure Act and Section 401 of
831	831	12 the Illinois Insurance Code, adopt such rules as shall be
832	832	13 necessary to carry out the provisions of this Act.
833	833	14 Section 50. Severability. If any provision of this Act or
834	834	15 its application to any person or circumstance is held invalid,
835	835	16 the invalidity of that provision or application does not
836	836	17 affect other provisions or applications of this Act that can
837	837	18 be given effect without the invalid provision or application.
838	838	19 Section 105. The Freedom of Information Act is amended by
839	839	20 changing Section 7.5 as follows:
840	840	21 (5 ILCS 140/7.5)
841	841
842	842
843	843
844	844
845	845
846	846	HB4433 - 23 - LRB103 36043 RPS 66130 b
847	847
848	848
849	849	HB4433- 24 -LRB103 36043 RPS 66130 b HB4433 - 24 - LRB103 36043 RPS 66130 b
850	850	HB4433 - 24 - LRB103 36043 RPS 66130 b
851	851	1 (Text of Section before amendment by P.A. 103-472)
852	852	2 Sec. 7.5. Statutory exemptions. To the extent provided for
853	853	3 by the statutes referenced below, the following shall be
854	854	4 exempt from inspection and copying:
855	855	5 (a) All information determined to be confidential
856	856	6 under Section 4002 of the Technology Advancement and
857	857	7 Development Act.
858	858	8 (b) Library circulation and order records identifying
859	859	9 library users with specific materials under the Library
860	860	10 Records Confidentiality Act.
861	861	11 (c) Applications, related documents, and medical
862	862	12 records received by the Experimental Organ Transplantation
863	863	13 Procedures Board and any and all documents or other
864	864	14 records prepared by the Experimental Organ Transplantation
865	865	15 Procedures Board or its staff relating to applications it
866	866	16 has received.
867	867	17 (d) Information and records held by the Department of
868	868	18 Public Health and its authorized representatives relating
869	869	19 to known or suspected cases of sexually transmissible
870	870	20 disease or any information the disclosure of which is
871	871	21 restricted under the Illinois Sexually Transmissible
872	872	22 Disease Control Act.
873	873	23 (e) Information the disclosure of which is exempted
874	874	24 under Section 30 of the Radon Industry Licensing Act.
875	875	25 (f) Firm performance evaluations under Section 55 of
876	876	26 the Architectural, Engineering, and Land Surveying
877	877
878	878
879	879
880	880
881	881
882	882	HB4433 - 24 - LRB103 36043 RPS 66130 b
883	883
884	884
885	885	HB4433- 25 -LRB103 36043 RPS 66130 b HB4433 - 25 - LRB103 36043 RPS 66130 b
886	886	HB4433 - 25 - LRB103 36043 RPS 66130 b
887	887	1 Qualifications Based Selection Act.
888	888	2 (g) Information the disclosure of which is restricted
889	889	3 and exempted under Section 50 of the Illinois Prepaid
890	890	4 Tuition Act.
891	891	5 (h) Information the disclosure of which is exempted
892	892	6 under the State Officials and Employees Ethics Act, and
893	893	7 records of any lawfully created State or local inspector
894	894	8 general's office that would be exempt if created or
895	895	9 obtained by an Executive Inspector General's office under
896	896	10 that Act.
897	897	11 (i) Information contained in a local emergency energy
898	898	12 plan submitted to a municipality in accordance with a
899	899	13 local emergency energy plan ordinance that is adopted
900	900	14 under Section 11-21.5-5 of the Illinois Municipal Code.
901	901	15 (j) Information and data concerning the distribution
902	902	16 of surcharge moneys collected and remitted by carriers
903	903	17 under the Emergency Telephone System Act.
904	904	18 (k) Law enforcement officer identification information
905	905	19 or driver identification information compiled by a law
906	906	20 enforcement agency or the Department of Transportation
907	907	21 under Section 11-212 of the Illinois Vehicle Code.
908	908	22 (l) Records and information provided to a residential
909	909	23 health care facility resident sexual assault and death
910	910	24 review team or the Executive Council under the Abuse
911	911	25 Prevention Review Team Act.
912	912	26 (m) Information provided to the predatory lending
913	913
914	914
915	915
916	916
917	917
918	918	HB4433 - 25 - LRB103 36043 RPS 66130 b
919	919
920	920
921	921	HB4433- 26 -LRB103 36043 RPS 66130 b HB4433 - 26 - LRB103 36043 RPS 66130 b
922	922	HB4433 - 26 - LRB103 36043 RPS 66130 b
923	923	1 database created pursuant to Article 3 of the Residential
924	924	2 Real Property Disclosure Act, except to the extent
925	925	3 authorized under that Article.
926	926	4 (n) Defense budgets and petitions for certification of
927	927	5 compensation and expenses for court appointed trial
928	928	6 counsel as provided under Sections 10 and 15 of the
929	929	7 Capital Crimes Litigation Act (repealed). This subsection
930	930	8 (n) shall apply until the conclusion of the trial of the
931	931	9 case, even if the prosecution chooses not to pursue the
932	932	10 death penalty prior to trial or sentencing.
933	933	11 (o) Information that is prohibited from being
934	934	12 disclosed under Section 4 of the Illinois Health and
935	935	13 Hazardous Substances Registry Act.
936	936	14 (p) Security portions of system safety program plans,
937	937	15 investigation reports, surveys, schedules, lists, data, or
938	938	16 information compiled, collected, or prepared by or for the
939	939	17 Department of Transportation under Sections 2705-300 and
940	940	18 2705-616 of the Department of Transportation Law of the
941	941	19 Civil Administrative Code of Illinois, the Regional
942	942	20 Transportation Authority under Section 2.11 of the
943	943	21 Regional Transportation Authority Act, or the St. Clair
944	944	22 County Transit District under the Bi-State Transit Safety
945	945	23 Act (repealed).
946	946	24 (q) Information prohibited from being disclosed by the
947	947	25 Personnel Record Review Act.
948	948	26 (r) Information prohibited from being disclosed by the
949	949
950	950
951	951
952	952
953	953
954	954	HB4433 - 26 - LRB103 36043 RPS 66130 b
955	955
956	956
957	957	HB4433- 27 -LRB103 36043 RPS 66130 b HB4433 - 27 - LRB103 36043 RPS 66130 b
958	958	HB4433 - 27 - LRB103 36043 RPS 66130 b
959	959	1 Illinois School Student Records Act.
960	960	2 (s) Information the disclosure of which is restricted
961	961	3 under Section 5-108 of the Public Utilities Act.
962	962	4 (t) (Blank).
963	963	5 (u) Records and information provided to an independent
964	964	6 team of experts under the Developmental Disability and
965	965	7 Mental Health Safety Act (also known as Brian's Law).
966	966	8 (v) Names and information of people who have applied
967	967	9 for or received Firearm Owner's Identification Cards under
968	968	10 the Firearm Owners Identification Card Act or applied for
969	969	11 or received a concealed carry license under the Firearm
970	970	12 Concealed Carry Act, unless otherwise authorized by the
971	971	13 Firearm Concealed Carry Act; and databases under the
972	972	14 Firearm Concealed Carry Act, records of the Concealed
973	973	15 Carry Licensing Review Board under the Firearm Concealed
974	974	16 Carry Act, and law enforcement agency objections under the
975	975	17 Firearm Concealed Carry Act.
976	976	18 (v-5) Records of the Firearm Owner's Identification
977	977	19 Card Review Board that are exempted from disclosure under
978	978	20 Section 10 of the Firearm Owners Identification Card Act.
979	979	21 (w) Personally identifiable information which is
980	980	22 exempted from disclosure under subsection (g) of Section
981	981	23 19.1 of the Toll Highway Act.
982	982	24 (x) Information which is exempted from disclosure
983	983	25 under Section 5-1014.3 of the Counties Code or Section
984	984	26 8-11-21 of the Illinois Municipal Code.
985	985
986	986
987	987
988	988
989	989
990	990	HB4433 - 27 - LRB103 36043 RPS 66130 b
991	991
992	992
993	993	HB4433- 28 -LRB103 36043 RPS 66130 b HB4433 - 28 - LRB103 36043 RPS 66130 b
994	994	HB4433 - 28 - LRB103 36043 RPS 66130 b
995	995	1 (y) Confidential information under the Adult
996	996	2 Protective Services Act and its predecessor enabling
997	997	3 statute, the Elder Abuse and Neglect Act, including
998	998	4 information about the identity and administrative finding
999	999	5 against any caregiver of a verified and substantiated
1000	1000	6 decision of abuse, neglect, or financial exploitation of
1001	1001	7 an eligible adult maintained in the Registry established
1002	1002	8 under Section 7.5 of the Adult Protective Services Act.
1003	1003	9 (z) Records and information provided to a fatality
1004	1004	10 review team or the Illinois Fatality Review Team Advisory
1005	1005	11 Council under Section 15 of the Adult Protective Services
1006	1006	12 Act.
1007	1007	13 (aa) Information which is exempted from disclosure
1008	1008	14 under Section 2.37 of the Wildlife Code.
1009	1009	15 (bb) Information which is or was prohibited from
1010	1010	16 disclosure by the Juvenile Court Act of 1987.
1011	1011	17 (cc) Recordings made under the Law Enforcement
1012	1012	18 Officer-Worn Body Camera Act, except to the extent
1013	1013	19 authorized under that Act.
1014	1014	20 (dd) Information that is prohibited from being
1015	1015	21 disclosed under Section 45 of the Condominium and Common
1016	1016	22 Interest Community Ombudsperson Act.
1017	1017	23 (ee) Information that is exempted from disclosure
1018	1018	24 under Section 30.1 of the Pharmacy Practice Act.
1019	1019	25 (ff) Information that is exempted from disclosure
1020	1020	26 under the Revised Uniform Unclaimed Property Act.
1021	1021
1022	1022
1023	1023
1024	1024
1025	1025
1026	1026	HB4433 - 28 - LRB103 36043 RPS 66130 b
1027	1027
1028	1028
1029	1029	HB4433- 29 -LRB103 36043 RPS 66130 b HB4433 - 29 - LRB103 36043 RPS 66130 b
1030	1030	HB4433 - 29 - LRB103 36043 RPS 66130 b
1031	1031	1 (gg) Information that is prohibited from being
1032	1032	2 disclosed under Section 7-603.5 of the Illinois Vehicle
1033	1033	3 Code.
1034	1034	4 (hh) Records that are exempt from disclosure under
1035	1035	5 Section 1A-16.7 of the Election Code.
1036	1036	6 (ii) Information which is exempted from disclosure
1037	1037	7 under Section 2505-800 of the Department of Revenue Law of
1038	1038	8 the Civil Administrative Code of Illinois.
1039	1039	9 (jj) Information and reports that are required to be
1040	1040	10 submitted to the Department of Labor by registering day
1041	1041	11 and temporary labor service agencies but are exempt from
1042	1042	12 disclosure under subsection (a-1) of Section 45 of the Day
1043	1043	13 and Temporary Labor Services Act.
1044	1044	14 (kk) Information prohibited from disclosure under the
1045	1045	15 Seizure and Forfeiture Reporting Act.
1046	1046	16 (ll) Information the disclosure of which is restricted
1047	1047	17 and exempted under Section 5-30.8 of the Illinois Public
1048	1048	18 Aid Code.
1049	1049	19 (mm) Records that are exempt from disclosure under
1050	1050	20 Section 4.2 of the Crime Victims Compensation Act.
1051	1051	21 (nn) Information that is exempt from disclosure under
1052	1052	22 Section 70 of the Higher Education Student Assistance Act.
1053	1053	23 (oo) Communications, notes, records, and reports
1054	1054	24 arising out of a peer support counseling session
1055	1055	25 prohibited from disclosure under the First Responders
1056	1056	26 Suicide Prevention Act.
1057	1057
1058	1058
1059	1059
1060	1060
1061	1061
1062	1062	HB4433 - 29 - LRB103 36043 RPS 66130 b
1063	1063
1064	1064
1065	1065	HB4433- 30 -LRB103 36043 RPS 66130 b HB4433 - 30 - LRB103 36043 RPS 66130 b
1066	1066	HB4433 - 30 - LRB103 36043 RPS 66130 b
1067	1067	1 (pp) Names and all identifying information relating to
1068	1068	2 an employee of an emergency services provider or law
1069	1069	3 enforcement agency under the First Responders Suicide
1070	1070	4 Prevention Act.
1071	1071	5 (qq) Information and records held by the Department of
1072	1072	6 Public Health and its authorized representatives collected
1073	1073	7 under the Reproductive Health Act.
1074	1074	8 (rr) Information that is exempt from disclosure under
1075	1075	9 the Cannabis Regulation and Tax Act.
1076	1076	10 (ss) Data reported by an employer to the Department of
1077	1077	11 Human Rights pursuant to Section 2-108 of the Illinois
1078	1078	12 Human Rights Act.
1079	1079	13 (tt) Recordings made under the Children's Advocacy
1080	1080	14 Center Act, except to the extent authorized under that
1081	1081	15 Act.
1082	1082	16 (uu) Information that is exempt from disclosure under
1083	1083	17 Section 50 of the Sexual Assault Evidence Submission Act.
1084	1084	18 (vv) Information that is exempt from disclosure under
1085	1085	19 subsections (f) and (j) of Section 5-36 of the Illinois
1086	1086	20 Public Aid Code.
1087	1087	21 (ww) Information that is exempt from disclosure under
1088	1088	22 Section 16.8 of the State Treasurer Act.
1089	1089	23 (xx) Information that is exempt from disclosure or
1090	1090	24 information that shall not be made public under the
1091	1091	25 Illinois Insurance Code.
1092	1092	26 (yy) Information prohibited from being disclosed under
1093	1093
1094	1094
1095	1095
1096	1096
1097	1097
1098	1098	HB4433 - 30 - LRB103 36043 RPS 66130 b
1099	1099
1100	1100
1101	1101	HB4433- 31 -LRB103 36043 RPS 66130 b HB4433 - 31 - LRB103 36043 RPS 66130 b
1102	1102	HB4433 - 31 - LRB103 36043 RPS 66130 b
1103	1103	1 the Illinois Educational Labor Relations Act.
1104	1104	2 (zz) Information prohibited from being disclosed under
1105	1105	3 the Illinois Public Labor Relations Act.
1106	1106	4 (aaa) Information prohibited from being disclosed
1107	1107	5 under Section 1-167 of the Illinois Pension Code.
1108	1108	6 (bbb) Information that is prohibited from disclosure
1109	1109	7 by the Illinois Police Training Act and the Illinois State
1110	1110	8 Police Act.
1111	1111	9 (ccc) Records exempt from disclosure under Section
1112	1112	10 2605-304 of the Illinois State Police Law of the Civil
1113	1113	11 Administrative Code of Illinois.
1114	1114	12 (ddd) Information prohibited from being disclosed
1115	1115	13 under Section 35 of the Address Confidentiality for
1116	1116	14 Victims of Domestic Violence, Sexual Assault, Human
1117	1117	15 Trafficking, or Stalking Act.
1118	1118	16 (eee) Information prohibited from being disclosed
1119	1119	17 under subsection (b) of Section 75 of the Domestic
1120	1120	18 Violence Fatality Review Act.
1121	1121	19 (fff) Images from cameras under the Expressway Camera
1122	1122	20 Act. This subsection (fff) is inoperative on and after
1123	1123	21 July 1, 2025.
1124	1124	22 (ggg) Information prohibited from disclosure under
1125	1125	23 paragraph (3) of subsection (a) of Section 14 of the Nurse
1126	1126	24 Agency Licensing Act.
1127	1127	25 (hhh) Information submitted to the Illinois State
1128	1128	26 Police in an affidavit or application for an assault
1129	1129
1130	1130
1131	1131
1132	1132
1133	1133
1134	1134	HB4433 - 31 - LRB103 36043 RPS 66130 b
1135	1135
1136	1136
1137	1137	HB4433- 32 -LRB103 36043 RPS 66130 b HB4433 - 32 - LRB103 36043 RPS 66130 b
1138	1138	HB4433 - 32 - LRB103 36043 RPS 66130 b
1139	1139	1 weapon endorsement, assault weapon attachment endorsement,
1140	1140	2 .50 caliber rifle endorsement, or .50 caliber cartridge
1141	1141	3 endorsement under the Firearm Owners Identification Card
1142	1142	4 Act.
1143	1143	5 (iii) Data exempt from disclosure under Section 50 of
1144	1144	6 the School Safety Drill Act.
1145	1145	7 (jjj) (hhh) Information exempt from disclosure under
1146	1146	8 Section 30 of the Insurance Data Security Law.
1147	1147	9 (kkk) (iii) Confidential business information
1148	1148	10 prohibited from disclosure under Section 45 of the Paint
1149	1149	11 Stewardship Act.
1150	1150	12 (Source: P.A. 102-36, eff. 6-25-21; 102-237, eff. 1-1-22;
1151	1151	13 102-292, eff. 1-1-22; 102-520, eff. 8-20-21; 102-559, eff.
1152	1152	14 8-20-21; 102-813, eff. 5-13-22; 102-946, eff. 7-1-22;
1153	1153	15 102-1042, eff. 6-3-22; 102-1116, eff. 1-10-23; 103-8, eff.
1154	1154	16 6-7-23; 103-34, eff. 6-9-23; 103-142, eff. 1-1-24; 103-372,
1155	1155	17 eff. 1-1-24; 103-508, eff. 8-4-23; revised 9-5-23.)
1156	1156	18 (Text of Section after amendment by P.A. 103-472)
1157	1157	19 Sec. 7.5. Statutory exemptions. To the extent provided for
1158	1158	20 by the statutes referenced below, the following shall be
1159	1159	21 exempt from inspection and copying:
1160	1160	22 (a) All information determined to be confidential
1161	1161	23 under Section 4002 of the Technology Advancement and
1162	1162	24 Development Act.
1163	1163	25 (b) Library circulation and order records identifying
1164	1164
1165	1165
1166	1166
1167	1167
1168	1168
1169	1169	HB4433 - 32 - LRB103 36043 RPS 66130 b
1170	1170
1171	1171
1172	1172	HB4433- 33 -LRB103 36043 RPS 66130 b HB4433 - 33 - LRB103 36043 RPS 66130 b
1173	1173	HB4433 - 33 - LRB103 36043 RPS 66130 b
1174	1174	1 library users with specific materials under the Library
1175	1175	2 Records Confidentiality Act.
1176	1176	3 (c) Applications, related documents, and medical
1177	1177	4 records received by the Experimental Organ Transplantation
1178	1178	5 Procedures Board and any and all documents or other
1179	1179	6 records prepared by the Experimental Organ Transplantation
1180	1180	7 Procedures Board or its staff relating to applications it
1181	1181	8 has received.
1182	1182	9 (d) Information and records held by the Department of
1183	1183	10 Public Health and its authorized representatives relating
1184	1184	11 to known or suspected cases of sexually transmissible
1185	1185	12 disease or any information the disclosure of which is
1186	1186	13 restricted under the Illinois Sexually Transmissible
1187	1187	14 Disease Control Act.
1188	1188	15 (e) Information the disclosure of which is exempted
1189	1189	16 under Section 30 of the Radon Industry Licensing Act.
1190	1190	17 (f) Firm performance evaluations under Section 55 of
1191	1191	18 the Architectural, Engineering, and Land Surveying
1192	1192	19 Qualifications Based Selection Act.
1193	1193	20 (g) Information the disclosure of which is restricted
1194	1194	21 and exempted under Section 50 of the Illinois Prepaid
1195	1195	22 Tuition Act.
1196	1196	23 (h) Information the disclosure of which is exempted
1197	1197	24 under the State Officials and Employees Ethics Act, and
1198	1198	25 records of any lawfully created State or local inspector
1199	1199	26 general's office that would be exempt if created or
1200	1200
1201	1201
1202	1202
1203	1203
1204	1204
1205	1205	HB4433 - 33 - LRB103 36043 RPS 66130 b
1206	1206
1207	1207
1208	1208	HB4433- 34 -LRB103 36043 RPS 66130 b HB4433 - 34 - LRB103 36043 RPS 66130 b
1209	1209	HB4433 - 34 - LRB103 36043 RPS 66130 b
1210	1210	1 obtained by an Executive Inspector General's office under
1211	1211	2 that Act.
1212	1212	3 (i) Information contained in a local emergency energy
1213	1213	4 plan submitted to a municipality in accordance with a
1214	1214	5 local emergency energy plan ordinance that is adopted
1215	1215	6 under Section 11-21.5-5 of the Illinois Municipal Code.
1216	1216	7 (j) Information and data concerning the distribution
1217	1217	8 of surcharge moneys collected and remitted by carriers
1218	1218	9 under the Emergency Telephone System Act.
1219	1219	10 (k) Law enforcement officer identification information
1220	1220	11 or driver identification information compiled by a law
1221	1221	12 enforcement agency or the Department of Transportation
1222	1222	13 under Section 11-212 of the Illinois Vehicle Code.
1223	1223	14 (l) Records and information provided to a residential
1224	1224	15 health care facility resident sexual assault and death
1225	1225	16 review team or the Executive Council under the Abuse
1226	1226	17 Prevention Review Team Act.
1227	1227	18 (m) Information provided to the predatory lending
1228	1228	19 database created pursuant to Article 3 of the Residential
1229	1229	20 Real Property Disclosure Act, except to the extent
1230	1230	21 authorized under that Article.
1231	1231	22 (n) Defense budgets and petitions for certification of
1232	1232	23 compensation and expenses for court appointed trial
1233	1233	24 counsel as provided under Sections 10 and 15 of the
1234	1234	25 Capital Crimes Litigation Act (repealed). This subsection
1235	1235	26 (n) shall apply until the conclusion of the trial of the
1236	1236
1237	1237
1238	1238
1239	1239
1240	1240
1241	1241	HB4433 - 34 - LRB103 36043 RPS 66130 b
1242	1242
1243	1243
1244	1244	HB4433- 35 -LRB103 36043 RPS 66130 b HB4433 - 35 - LRB103 36043 RPS 66130 b
1245	1245	HB4433 - 35 - LRB103 36043 RPS 66130 b
1246	1246	1 case, even if the prosecution chooses not to pursue the
1247	1247	2 death penalty prior to trial or sentencing.
1248	1248	3 (o) Information that is prohibited from being
1249	1249	4 disclosed under Section 4 of the Illinois Health and
1250	1250	5 Hazardous Substances Registry Act.
1251	1251	6 (p) Security portions of system safety program plans,
1252	1252	7 investigation reports, surveys, schedules, lists, data, or
1253	1253	8 information compiled, collected, or prepared by or for the
1254	1254	9 Department of Transportation under Sections 2705-300 and
1255	1255	10 2705-616 of the Department of Transportation Law of the
1256	1256	11 Civil Administrative Code of Illinois, the Regional
1257	1257	12 Transportation Authority under Section 2.11 of the
1258	1258	13 Regional Transportation Authority Act, or the St. Clair
1259	1259	14 County Transit District under the Bi-State Transit Safety
1260	1260	15 Act (repealed).
1261	1261	16 (q) Information prohibited from being disclosed by the
1262	1262	17 Personnel Record Review Act.
1263	1263	18 (r) Information prohibited from being disclosed by the
1264	1264	19 Illinois School Student Records Act.
1265	1265	20 (s) Information the disclosure of which is restricted
1266	1266	21 under Section 5-108 of the Public Utilities Act.
1267	1267	22 (t) (Blank).
1268	1268	23 (u) Records and information provided to an independent
1269	1269	24 team of experts under the Developmental Disability and
1270	1270	25 Mental Health Safety Act (also known as Brian's Law).
1271	1271	26 (v) Names and information of people who have applied
1272	1272
1273	1273
1274	1274
1275	1275
1276	1276
1277	1277	HB4433 - 35 - LRB103 36043 RPS 66130 b
1278	1278
1279	1279
1280	1280	HB4433- 36 -LRB103 36043 RPS 66130 b HB4433 - 36 - LRB103 36043 RPS 66130 b
1281	1281	HB4433 - 36 - LRB103 36043 RPS 66130 b
1282	1282	1 for or received Firearm Owner's Identification Cards under
1283	1283	2 the Firearm Owners Identification Card Act or applied for
1284	1284	3 or received a concealed carry license under the Firearm
1285	1285	4 Concealed Carry Act, unless otherwise authorized by the
1286	1286	5 Firearm Concealed Carry Act; and databases under the
1287	1287	6 Firearm Concealed Carry Act, records of the Concealed
1288	1288	7 Carry Licensing Review Board under the Firearm Concealed
1289	1289	8 Carry Act, and law enforcement agency objections under the
1290	1290	9 Firearm Concealed Carry Act.
1291	1291	10 (v-5) Records of the Firearm Owner's Identification
1292	1292	11 Card Review Board that are exempted from disclosure under
1293	1293	12 Section 10 of the Firearm Owners Identification Card Act.
1294	1294	13 (w) Personally identifiable information which is
1295	1295	14 exempted from disclosure under subsection (g) of Section
1296	1296	15 19.1 of the Toll Highway Act.
1297	1297	16 (x) Information which is exempted from disclosure
1298	1298	17 under Section 5-1014.3 of the Counties Code or Section
1299	1299	18 8-11-21 of the Illinois Municipal Code.
1300	1300	19 (y) Confidential information under the Adult
1301	1301	20 Protective Services Act and its predecessor enabling
1302	1302	21 statute, the Elder Abuse and Neglect Act, including
1303	1303	22 information about the identity and administrative finding
1304	1304	23 against any caregiver of a verified and substantiated
1305	1305	24 decision of abuse, neglect, or financial exploitation of
1306	1306	25 an eligible adult maintained in the Registry established
1307	1307	26 under Section 7.5 of the Adult Protective Services Act.
1308	1308
1309	1309
1310	1310
1311	1311
1312	1312
1313	1313	HB4433 - 36 - LRB103 36043 RPS 66130 b
1314	1314
1315	1315
1316	1316	HB4433- 37 -LRB103 36043 RPS 66130 b HB4433 - 37 - LRB103 36043 RPS 66130 b
1317	1317	HB4433 - 37 - LRB103 36043 RPS 66130 b
1318	1318	1 (z) Records and information provided to a fatality
1319	1319	2 review team or the Illinois Fatality Review Team Advisory
1320	1320	3 Council under Section 15 of the Adult Protective Services
1321	1321	4 Act.
1322	1322	5 (aa) Information which is exempted from disclosure
1323	1323	6 under Section 2.37 of the Wildlife Code.
1324	1324	7 (bb) Information which is or was prohibited from
1325	1325	8 disclosure by the Juvenile Court Act of 1987.
1326	1326	9 (cc) Recordings made under the Law Enforcement
1327	1327	10 Officer-Worn Body Camera Act, except to the extent
1328	1328	11 authorized under that Act.
1329	1329	12 (dd) Information that is prohibited from being
1330	1330	13 disclosed under Section 45 of the Condominium and Common
1331	1331	14 Interest Community Ombudsperson Act.
1332	1332	15 (ee) Information that is exempted from disclosure
1333	1333	16 under Section 30.1 of the Pharmacy Practice Act.
1334	1334	17 (ff) Information that is exempted from disclosure
1335	1335	18 under the Revised Uniform Unclaimed Property Act.
1336	1336	19 (gg) Information that is prohibited from being
1337	1337	20 disclosed under Section 7-603.5 of the Illinois Vehicle
1338	1338	21 Code.
1339	1339	22 (hh) Records that are exempt from disclosure under
1340	1340	23 Section 1A-16.7 of the Election Code.
1341	1341	24 (ii) Information which is exempted from disclosure
1342	1342	25 under Section 2505-800 of the Department of Revenue Law of
1343	1343	26 the Civil Administrative Code of Illinois.
1344	1344
1345	1345
1346	1346
1347	1347
1348	1348
1349	1349	HB4433 - 37 - LRB103 36043 RPS 66130 b
1350	1350
1351	1351
1352	1352	HB4433- 38 -LRB103 36043 RPS 66130 b HB4433 - 38 - LRB103 36043 RPS 66130 b
1353	1353	HB4433 - 38 - LRB103 36043 RPS 66130 b
1354	1354	1 (jj) Information and reports that are required to be
1355	1355	2 submitted to the Department of Labor by registering day
1356	1356	3 and temporary labor service agencies but are exempt from
1357	1357	4 disclosure under subsection (a-1) of Section 45 of the Day
1358	1358	5 and Temporary Labor Services Act.
1359	1359	6 (kk) Information prohibited from disclosure under the
1360	1360	7 Seizure and Forfeiture Reporting Act.
1361	1361	8 (ll) Information the disclosure of which is restricted
1362	1362	9 and exempted under Section 5-30.8 of the Illinois Public
1363	1363	10 Aid Code.
1364	1364	11 (mm) Records that are exempt from disclosure under
1365	1365	12 Section 4.2 of the Crime Victims Compensation Act.
1366	1366	13 (nn) Information that is exempt from disclosure under
1367	1367	14 Section 70 of the Higher Education Student Assistance Act.
1368	1368	15 (oo) Communications, notes, records, and reports
1369	1369	16 arising out of a peer support counseling session
1370	1370	17 prohibited from disclosure under the First Responders
1371	1371	18 Suicide Prevention Act.
1372	1372	19 (pp) Names and all identifying information relating to
1373	1373	20 an employee of an emergency services provider or law
1374	1374	21 enforcement agency under the First Responders Suicide
1375	1375	22 Prevention Act.
1376	1376	23 (qq) Information and records held by the Department of
1377	1377	24 Public Health and its authorized representatives collected
1378	1378	25 under the Reproductive Health Act.
1379	1379	26 (rr) Information that is exempt from disclosure under
1380	1380
1381	1381
1382	1382
1383	1383
1384	1384
1385	1385	HB4433 - 38 - LRB103 36043 RPS 66130 b
1386	1386
1387	1387
1388	1388	HB4433- 39 -LRB103 36043 RPS 66130 b HB4433 - 39 - LRB103 36043 RPS 66130 b
1389	1389	HB4433 - 39 - LRB103 36043 RPS 66130 b
1390	1390	1 the Cannabis Regulation and Tax Act.
1391	1391	2 (ss) Data reported by an employer to the Department of
1392	1392	3 Human Rights pursuant to Section 2-108 of the Illinois
1393	1393	4 Human Rights Act.
1394	1394	5 (tt) Recordings made under the Children's Advocacy
1395	1395	6 Center Act, except to the extent authorized under that
1396	1396	7 Act.
1397	1397	8 (uu) Information that is exempt from disclosure under
1398	1398	9 Section 50 of the Sexual Assault Evidence Submission Act.
1399	1399	10 (vv) Information that is exempt from disclosure under
1400	1400	11 subsections (f) and (j) of Section 5-36 of the Illinois
1401	1401	12 Public Aid Code.
1402	1402	13 (ww) Information that is exempt from disclosure under
1403	1403	14 Section 16.8 of the State Treasurer Act.
1404	1404	15 (xx) Information that is exempt from disclosure or
1405	1405	16 information that shall not be made public under the
1406	1406	17 Illinois Insurance Code.
1407	1407	18 (yy) Information prohibited from being disclosed under
1408	1408	19 the Illinois Educational Labor Relations Act.
1409	1409	20 (zz) Information prohibited from being disclosed under
1410	1410	21 the Illinois Public Labor Relations Act.
1411	1411	22 (aaa) Information prohibited from being disclosed
1412	1412	23 under Section 1-167 of the Illinois Pension Code.
1413	1413	24 (bbb) Information that is prohibited from disclosure
1414	1414	25 by the Illinois Police Training Act and the Illinois State
1415	1415	26 Police Act.
1416	1416
1417	1417
1418	1418
1419	1419
1420	1420
1421	1421	HB4433 - 39 - LRB103 36043 RPS 66130 b
1422	1422
1423	1423
1424	1424	HB4433- 40 -LRB103 36043 RPS 66130 b HB4433 - 40 - LRB103 36043 RPS 66130 b
1425	1425	HB4433 - 40 - LRB103 36043 RPS 66130 b
1426	1426	1 (ccc) Records exempt from disclosure under Section
1427	1427	2 2605-304 of the Illinois State Police Law of the Civil
1428	1428	3 Administrative Code of Illinois.
1429	1429	4 (ddd) Information prohibited from being disclosed
1430	1430	5 under Section 35 of the Address Confidentiality for
1431	1431	6 Victims of Domestic Violence, Sexual Assault, Human
1432	1432	7 Trafficking, or Stalking Act.
1433	1433	8 (eee) Information prohibited from being disclosed
1434	1434	9 under subsection (b) of Section 75 of the Domestic
1435	1435	10 Violence Fatality Review Act.
1436	1436	11 (fff) Images from cameras under the Expressway Camera
1437	1437	12 Act. This subsection (fff) is inoperative on and after
1438	1438	13 July 1, 2025.
1439	1439	14 (ggg) Information prohibited from disclosure under
1440	1440	15 paragraph (3) of subsection (a) of Section 14 of the Nurse
1441	1441	16 Agency Licensing Act.
1442	1442	17 (hhh) Information submitted to the Illinois State
1443	1443	18 Police in an affidavit or application for an assault
1444	1444	19 weapon endorsement, assault weapon attachment endorsement,
1445	1445	20 .50 caliber rifle endorsement, or .50 caliber cartridge
1446	1446	21 endorsement under the Firearm Owners Identification Card
1447	1447	22 Act.
1448	1448	23 (iii) Data exempt from disclosure under Section 50 of
1449	1449	24 the School Safety Drill Act.
1450	1450	25 (jjj) (hhh) Information exempt from disclosure under
1451	1451	26 Section 30 of the Insurance Data Security Law.
1452	1452
1453	1453
1454	1454
1455	1455
1456	1456
1457	1457	HB4433 - 40 - LRB103 36043 RPS 66130 b
1458	1458
1459	1459
1460	1460	HB4433- 41 -LRB103 36043 RPS 66130 b HB4433 - 41 - LRB103 36043 RPS 66130 b
1461	1461	HB4433 - 41 - LRB103 36043 RPS 66130 b
1462	1462	1 (kkk) (iii) Confidential business information
1463	1463	2 prohibited from disclosure under Section 45 of the Paint
1464	1464	3 Stewardship Act.
1465	1465	4 (lll) (iii) Data exempt from disclosure under Section
1466	1466	5 2-3.196 of the School Code.
1467	1467	6 (mmm) Information exempt from disclosure under Section
1468	1468	7 30 of the Insurance Data Security Law.
1469	1469	8 (Source: P.A. 102-36, eff. 6-25-21; 102-237, eff. 1-1-22;
1470	1470	9 102-292, eff. 1-1-22; 102-520, eff. 8-20-21; 102-559, eff.
1471	1471	10 8-20-21; 102-813, eff. 5-13-22; 102-946, eff. 7-1-22;
1472	1472	11 102-1042, eff. 6-3-22; 102-1116, eff. 1-10-23; 103-8, eff.
1473	1473	12 6-7-23; 103-34, eff. 6-9-23; 103-142, eff. 1-1-24; 103-372,
1474	1474	13 eff. 1-1-24; 103-472, eff. 8-1-24; 103-508, eff. 8-4-23;
1475	1475	14 revised 9-5-23.)
1476	1476	15 Section 95. No acceleration or delay. Where this Act makes
1477	1477	16 changes in a statute that is represented in this Act by text
1478	1478	17 that is not yet or no longer in effect (for example, a Section
1479	1479	18 represented by multiple versions), the use of that text does
1480	1480	19 not accelerate or delay the taking effect of (i) the changes
1481	1481	20 made by this Act or (ii) provisions derived from any other
1482	1482	21 Public Act.
1483	1483
1484	1484
1485	1485
1486	1486
1487	1487
1488	1488	HB4433 - 41 - LRB103 36043 RPS 66130 b