103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED: New Act5 ILCS 140/7.5 Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025. LRB103 36043 RPS 66130 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED: New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5 Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025. LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b A BILL FOR
103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED:
New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5
New Act
5 ILCS 140/7.5
Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025.
LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b
LRB103 36043 RPS 66130 b
A BILL FOR
HB4433LRB103 36043 RPS 66130 b HB4433 LRB103 36043 RPS 66130 b
HB4433 LRB103 36043 RPS 66130 b
1 AN ACT concerning regulation.
2 Be it enacted by the People of the State of Illinois,
3 represented in the General Assembly:
4 Section 1. Short title. This Act may be cited as the
5 Insurance Data Security Law.
6 Section 2. Purpose and intent.
7 (a) The purpose and intent of this Act is to establish
8 standards for data security and standards for the
9 investigation of and notification to the Director of a
10 cybersecurity event applicable to licensees.
11 (b) This Act shall not be construed to create or imply a
12 private cause of action for a violation of its provisions nor
13 shall it be construed to curtail a private cause of action
14 which would otherwise exist in the absence of this Act.
15 Section 5. Definitions. As used in this Act:
16 "Authorized individual" means an individual known to and
17 screened by the licensee and determined to be necessary and
18 appropriate to have access to the nonpublic information held
19 by the licensee and its information systems.
20 "Consumer" means an individual, including, but not limited
21 to, an applicant, policyholder, insured, beneficiary,
22 claimant, or certificate holder who is a resident of this
103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB4433 Introduced , by Rep. Thaddeus Jones SYNOPSIS AS INTRODUCED:
New Act5 ILCS 140/7.5 New Act 5 ILCS 140/7.5
New Act
5 ILCS 140/7.5
Creates the Insurance Data Security Law. Sets forth provisions concerning an information security program, investigations of cybersecurity events, and notifications of cybersecurity events. Provides that the Director of Insurance shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of the Act. Provides that whenever the Director has reason to believe that a licensee has been or is engaged in conduct in the State which violates the Act, the Director may take action that is necessary or appropriate to enforce the provisions of the Act. Provides that any documents, materials, or other information in the control or possession of the Department of Insurance that are furnished by a licensee or an employee or agent acting on behalf of a licensee or that are obtained by the Director in an investigation or examination shall be confidential by law and privileged, shall not be subject to the Freedom of Information Act, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. Sets forth provisions concerning exceptions, penalties, and severability. Provides that the Department may adopt rules necessary to carry out the provisions of the Act. Defines terms. Makes a conforming change in the Freedom of Information Act. Effective January 1, 2025.
LRB103 36043 RPS 66130 b LRB103 36043 RPS 66130 b
LRB103 36043 RPS 66130 b
A BILL FOR
New Act
5 ILCS 140/7.5
LRB103 36043 RPS 66130 b
HB4433 LRB103 36043 RPS 66130 b
HB4433- 2 -LRB103 36043 RPS 66130 b HB4433 - 2 - LRB103 36043 RPS 66130 b
HB4433 - 2 - LRB103 36043 RPS 66130 b
1 State and whose nonpublic information is in a licensee's
2 possession, custody, or control.
3 "Cybersecurity event" means an event resulting in
4 unauthorized access to, disruption, or misuse of an
5 information system or information stored on such information
6 system. "Cybersecurity event" does not include the
7 unauthorized acquisition of encrypted nonpublic information if
8 the encryption, process, or key is not also acquired,
9 released, or used without authorization. "Cybersecurity event"
10 does not include an event with regard to which the licensee has
11 determined that the nonpublic information accessed by an
12 unauthorized person has not been used or released and has been
13 returned or destroyed.
14 "Department" means the Department of Insurance.
15 "Director" means the Director of Insurance.
16 "Encrypted" means the transformation of data into a form
17 which results in a low probability of assigning meaning
18 without the use of a protective process or key.
19 "Information security program" means the administrative,
20 technical, and physical safeguards that a licensee uses to
21 access, collect, distribute, process, protect, store, use,
22 transmit, dispose of, or otherwise handle nonpublic
23 information.
24 "Information system" means a discrete set of electronic
25 information resources organized for the collection,
26 processing, maintenance, use, sharing, dissemination, or
HB4433 - 2 - LRB103 36043 RPS 66130 b
HB4433- 3 -LRB103 36043 RPS 66130 b HB4433 - 3 - LRB103 36043 RPS 66130 b
HB4433 - 3 - LRB103 36043 RPS 66130 b
1 disposition of electronic information, as well as any
2 specialized system such as industrial and process controls
3 systems, telephone switching and private branch exchange
4 systems, and environmental control systems.
5 "Licensee" means any person licensed, authorized to
6 operate, or registered, or required to be licensed,
7 authorized, or registered pursuant to the insurance laws of
8 this State. "Licensee" does not include a purchasing group or
9 a risk retention group chartered and licensed in a state other
10 than this State or a licensee that is acting as an assuming
11 insurer that is domiciled in another state or jurisdiction.
12 "Multi-factor authentication" means authentication
13 through verification of at least 2 of the following types of
14 authentication factors:
15 (1) knowledge factors, including a password;
16 (2) possession factors, including a token or text
17 message on a mobile phone; or
18 (3) inherence factors, including a biometric
19 characteristic.
20 "Nonpublic information" means information that is not
21 publicly available information and that is:
22 (1) business-related information of a licensee the
23 tampering with which, or unauthorized disclosure, access,
24 or use of which, would cause a material adverse impact to
25 the business, operations, or security of the licensee;
26 (2) any information concerning a consumer which
HB4433 - 3 - LRB103 36043 RPS 66130 b
HB4433- 4 -LRB103 36043 RPS 66130 b HB4433 - 4 - LRB103 36043 RPS 66130 b
HB4433 - 4 - LRB103 36043 RPS 66130 b
1 because of name, number, personal mark, or other
2 identifier can be used to identify such consumer, in
3 combination with any one or more of the following data
4 elements:
5 (A) social security number;
6 (B) driver's license number or nondriver
7 identification card number;
8 (C) account number, credit card number, or debit
9 card number;
10 (D) any security code, access code, or password
11 that would permit access to a consumer's financial
12 account; or
13 (E) biometric records; or
14 (3) any information or data, except age or gender, in
15 any form or medium created by or derived from a health care
16 provider or a consumer and that relates to:
17 (A) the past, present, or future physical, mental,
18 or behavioral health or condition of any consumer or a
19 member of the consumer's family;
20 (B) the provision of health care to any consumer;
21 or
22 (C) payment for the provision of health care to
23 any consumer.
24 "Person" means any individual or any nongovernmental
25 entity, including, but not limited to, any nongovernmental
26 partnership, corporation, branch, agency, or association.
HB4433 - 4 - LRB103 36043 RPS 66130 b
HB4433- 5 -LRB103 36043 RPS 66130 b HB4433 - 5 - LRB103 36043 RPS 66130 b
HB4433 - 5 - LRB103 36043 RPS 66130 b
1 "Publicly available information" means any information
2 that a licensee has a reasonable basis to believe is lawfully
3 made available to the general public from federal, State, or
4 local government records; widely distributed media; or
5 disclosures to the general public that are required to be made
6 by federal, State, or local law. "Publicly available
7 information" includes information that a consumer may direct
8 not to be made available to the general public, but that the
9 consumer has not directed not be made available.
10 "Risk assessment" means the risk assessment that each
11 licensee is required to conduct under subsection (c) of
12 Section 10.
13 "Third-party service provider" means a person, not
14 otherwise defined as a licensee, that contracts with a
15 licensee to maintain, process, store, or otherwise is
16 permitted access to nonpublic information through its
17 provision of services to the licensee.
18 Section 10. Information security program.
19 (a) Commensurate with the size and complexity of the
20 licensee, the nature and scope of the licensee's activities,
21 including its use of third-party service providers, and the
22 sensitivity of the nonpublic information used by the licensee
23 or in the licensee's possession, custody, or control, each
24 licensee shall develop, implement, and maintain a
25 comprehensive written information security program based on
HB4433 - 5 - LRB103 36043 RPS 66130 b
HB4433- 6 -LRB103 36043 RPS 66130 b HB4433 - 6 - LRB103 36043 RPS 66130 b
HB4433 - 6 - LRB103 36043 RPS 66130 b
1 the licensee's risk assessment and that contains
2 administrative, technical, and physical safeguards for the
3 protection of nonpublic information and the licensee's
4 information system.
5 (b) A licensee's information security program shall be
6 designed to:
7 (1) protect the security and confidentiality of
8 nonpublic information and the security of the information
9 system;
10 (2) protect against any threats or hazards to the
11 security or integrity of nonpublic information and the
12 information system;
13 (3) protect against unauthorized access to or use of
14 nonpublic information;
15 (4) minimize the likelihood of harm to any consumer;
16 and
17 (5) define and periodically reevaluate a schedule for
18 retention of nonpublic information and a mechanism for its
19 destruction when no longer needed.
20 (c) A licensee shall:
21 (1) designate one or more employees, an affiliate, or
22 an outside vendor designated to act on behalf of the
23 licensee who is responsible for the information security
24 program;
25 (2) identify reasonably foreseeable internal or
26 external threats that could result in unauthorized access,
HB4433 - 6 - LRB103 36043 RPS 66130 b
HB4433- 7 -LRB103 36043 RPS 66130 b HB4433 - 7 - LRB103 36043 RPS 66130 b
HB4433 - 7 - LRB103 36043 RPS 66130 b
1 transmission, disclosure, misuse, alteration, or
2 destruction of nonpublic information, including the
3 security of information systems and nonpublic information
4 that are accessible to or held by third-party service
5 providers;
6 (3) assess the likelihood and potential damage of
7 these threats, taking into consideration the sensitivity
8 of the nonpublic information;
9 (4) assess the sufficiency of policies, procedures,
10 information systems, and other safeguards in place to
11 manage these threats, including consideration of threats
12 in each relevant area of the licensee's operations,
13 including:
14 (A) employee training and management;
15 (B) information systems, including network and
16 software design, as well as information
17 classification, governance, processing, storage,
18 transmission, and disposal; and
19 (C) detecting, preventing, and responding to
20 attacks, intrusions, or other systems failures; and
21 (5) implement information safeguards to manage the
22 threats identified in its ongoing assessment, and, no less
23 than annually, assess the effectiveness of the safeguards'
24 key controls, systems, and procedures.
25 (d) Based on its risk assessment, the licensee shall:
26 (1) design its information security program to
HB4433 - 7 - LRB103 36043 RPS 66130 b
HB4433- 8 -LRB103 36043 RPS 66130 b HB4433 - 8 - LRB103 36043 RPS 66130 b
HB4433 - 8 - LRB103 36043 RPS 66130 b
1 mitigate the identified risks, commensurate with the size
2 and complexity of the licensee's activities, including its
3 use of third-party service providers, and the sensitivity
4 of the nonpublic information used by the licensee or in
5 the licensee's possession, custody, or control;
6 (2) select and implement appropriate security measures
7 from the following:
8 (A) place access controls on information systems,
9 including controls to authenticate and permit access
10 only to authorized individuals to protect against the
11 unauthorized acquisition of nonpublic information;
12 (B) identify and manage the data, personnel,
13 devices, systems, and facilities that enable the
14 organization to achieve business purposes in
15 accordance with their relative importance to business
16 objectives and the organization's risk strategy;
17 (C) restrict access at physical locations
18 containing nonpublic information only to authorized
19 individuals;
20 (D) protect, by encryption or other appropriate
21 means, all nonpublic information while being
22 transmitted over an external network and all nonpublic
23 information stored on a laptop computer or other
24 portable computing or storage device or media;
25 (E) adopt secure development practices for
26 in-house-developed applications utilized by the
HB4433 - 8 - LRB103 36043 RPS 66130 b
HB4433- 9 -LRB103 36043 RPS 66130 b HB4433 - 9 - LRB103 36043 RPS 66130 b
HB4433 - 9 - LRB103 36043 RPS 66130 b
1 licensee and procedures for evaluating, assessing, or
2 testing the security of externally developed
3 applications utilized by the licensee;
4 (F) modify the information system in accordance
5 with the licensee's information security program;
6 (G) utilize effective controls, including
7 multifactor authentication procedures for any
8 individual accessing nonpublic information;
9 (H) regularly test and monitor systems and
10 procedures to detect actual and attempted attacks on
11 or intrusions into information systems;
12 (I) include audit trails within the information
13 security program designed to detect and respond to
14 cybersecurity events and designed to reconstruct
15 material financial transactions sufficient to support
16 normal operations and obligations of the licensee;
17 (J) implement measures to protect against
18 destruction, loss, or damage of nonpublic information
19 due to environmental hazards, including fire and water
20 damage, other catastrophes, or technological failures;
21 and
22 (K) develop, implement, and maintain procedures
23 for the secure disposal of nonpublic information in
24 any format;
25 (3) include cybersecurity risks in the licensee's
26 enterprise risk management process;
HB4433 - 9 - LRB103 36043 RPS 66130 b
HB4433- 10 -LRB103 36043 RPS 66130 b HB4433 - 10 - LRB103 36043 RPS 66130 b
HB4433 - 10 - LRB103 36043 RPS 66130 b
1 (4) stay informed regarding emerging threats or
2 vulnerabilities and utilize reasonable security measures
3 when sharing information relative to the character of the
4 sharing and the type of information shared; and
5 (5) provide its personnel with cybersecurity awareness
6 training that is updated as necessary to reflect risks
7 identified by the licensee in the risk assessment.
8 (e) If the licensee has a board of directors, the board or
9 an appropriate committee of the board shall, at a minimum:
10 (1) require the licensee's executive management or its
11 delegates to develop, implement, and maintain the
12 licensee's information security program;
13 (2) require the licensee's executive management or its
14 delegates to report in writing, at least annually, the
15 following information:
16 (A) the overall status of the information security
17 program and the licensee's compliance with this Act;
18 and
19 (B) material matters related to the information
20 security program, addressing issues such as risk
21 assessment, risk management and control decisions,
22 third-party service provider arrangements, results of
23 testing, cybersecurity events or violations and
24 management's responses thereto, and recommendations
25 for changes in the information security program; and
26 (3) if executive management delegates any of its
HB4433 - 10 - LRB103 36043 RPS 66130 b
HB4433- 11 -LRB103 36043 RPS 66130 b HB4433 - 11 - LRB103 36043 RPS 66130 b
HB4433 - 11 - LRB103 36043 RPS 66130 b
1 responsibilities under this Section, it shall oversee the
2 development, implementation, and maintenance of the
3 licensee's information security program prepared by the
4 delegate and shall receive a report from the delegate
5 complying with the requirements of the report to the board
6 of directors.
7 (f) A licensee shall exercise due diligence in selecting
8 its third-party service provider and a licensee shall require
9 a third-party service provider to implement appropriate
10 administrative, technical, and physical measures to protect
11 and secure the information systems and nonpublic information
12 that are accessible to or held by the third-party service
13 provider.
14 (g) The licensee shall monitor, evaluate, and adjust, as
15 appropriate, the information security program consistent with
16 any relevant changes in technology, the sensitivity of its
17 nonpublic information, internal or external threats to
18 information, and the licensee's own changing business
19 arrangements, including mergers and acquisitions, alliances
20 and joint ventures, outsourcing arrangements, and changes to
21 information systems.
22 (h) As part of its information security program, a
23 licensee shall establish a written incident response plan
24 designed to promptly respond to and recover from any
25 cybersecurity event that compromises the confidentiality,
26 integrity, or availability of nonpublic information in its
HB4433 - 11 - LRB103 36043 RPS 66130 b
HB4433- 12 -LRB103 36043 RPS 66130 b HB4433 - 12 - LRB103 36043 RPS 66130 b
HB4433 - 12 - LRB103 36043 RPS 66130 b
1 possession, the licensee's information systems, or the
2 continuing functionality of any aspect of the licensee's
3 business or operations. The incident response plan shall
4 address the following areas:
5 (1) the internal process for responding to a
6 cybersecurity event;
7 (2) the goals of the incident response plan;
8 (3) the definition of clear roles, responsibilities,
9 and levels of decision-making authority;
10 (4) external and internal communications and
11 information sharing;
12 (5) identification of requirements for the remediation
13 of any identified weaknesses in information systems and
14 associated controls;
15 (6) documentation and reporting regarding
16 cybersecurity events and related incident response
17 activities; and
18 (7) the evaluation and revision of the incident
19 response plan following a cybersecurity event, as
20 necessary.
21 (i) Annually, an insurer domiciled in this State shall
22 submit to the Director a written statement by February 15
23 certifying that the insurer is in compliance with the
24 requirements set forth in this Section. Each insurer shall
25 maintain for examination by the Department all records,
26 schedules, and data supporting this certificate for a period
HB4433 - 12 - LRB103 36043 RPS 66130 b
HB4433- 13 -LRB103 36043 RPS 66130 b HB4433 - 13 - LRB103 36043 RPS 66130 b
HB4433 - 13 - LRB103 36043 RPS 66130 b
1 of 5 years. To the extent an insurer has identified areas,
2 systems, or processes that require material improvement,
3 updating, or redesign, the insurer shall document the
4 identification and the remedial efforts planned and underway
5 to address such areas, systems, or processes. The
6 documentation of identified areas, systems, or processes must
7 be available for inspection by the Director.
8 (j) Licensees shall comply with subsection (f) 2 years
9 after the effective date of this Act, and shall comply with all
10 other subsections of this Section one year after the effective
11 date of this Act.
12 Section 15. Investigation of a cybersecurity event.
13 (a) If the licensee learns that a cybersecurity event has
14 occurred or may have occurred, the licensee, or an outside
15 vendor or service provider designated to act on behalf of the
16 licensee, shall conduct a prompt investigation.
17 (b) During the investigation the licensee, or an outside
18 vendor or service provider designated to act on behalf of the
19 licensee, shall, at a minimum, comply with as many of the
20 following as possible:
21 (1) determine whether a cybersecurity event has
22 occurred;
23 (2) assess the nature and scope of the cybersecurity
24 event;
25 (3) identify any nonpublic information that may have
HB4433 - 13 - LRB103 36043 RPS 66130 b
HB4433- 14 -LRB103 36043 RPS 66130 b HB4433 - 14 - LRB103 36043 RPS 66130 b
HB4433 - 14 - LRB103 36043 RPS 66130 b
1 been involved in the cybersecurity event; and
2 (4) perform or oversee reasonable measures to restore
3 the security of the information systems compromised in the
4 cybersecurity event in order to prevent further
5 unauthorized acquisition, release, or use of nonpublic
6 information in the licensee's possession, custody, or
7 control.
8 (c) If the licensee learns that a cybersecurity event has
9 occurred or may have occurred in a system maintained by a
10 third-party service provider, the licensee will complete the
11 steps listed in subsection (b) or confirm and document that
12 the third-party service provider has completed those steps.
13 (d) The licensee shall maintain records concerning all
14 cybersecurity events for a period of at least 5 years from the
15 date of the cybersecurity event and shall produce those
16 records upon demand of the Director.
17 Section 20. Notification of a cybersecurity event.
18 (a) A licensee shall notify the Director as promptly as
19 possible but no later than 72 hours after a determination that
20 a cybersecurity event has occurred when either of the
21 following criteria has been met:
22 (1) this State is the licensee's state of domicile, in
23 the case of an insurer, or this State is the licensee's
24 home state, in the case of an insurance producer, as those
25 terms are defined in Article XXXI of the Illinois
HB4433 - 14 - LRB103 36043 RPS 66130 b
HB4433- 15 -LRB103 36043 RPS 66130 b HB4433 - 15 - LRB103 36043 RPS 66130 b
HB4433 - 15 - LRB103 36043 RPS 66130 b
1 Insurance Code; or
2 (2) the licensee reasonably believes that the
3 nonpublic information involved is of 250 or more consumers
4 residing in this State and that is either of the
5 following:
6 (A) a cybersecurity event impacting the licensee
7 of which notice is required to be provided to any
8 government body, self-regulatory agency, or any other
9 supervisory body pursuant to any State or federal law;
10 or
11 (B) a cybersecurity event that has a reasonable
12 likelihood of materially harming:
13 (i) any consumer residing in this State; or
14 (ii) any material part of the normal
15 operations of the licensee.
16 (b) A licensee shall provide as much of the following
17 information as possible:
18 (1) the date of the cybersecurity event;
19 (2) a description of how the information was exposed,
20 lost, stolen, or breached, including the specific roles
21 and responsibilities of third-party service providers, if
22 any;
23 (3) how the cybersecurity event was discovered;
24 (4) whether any lost, stolen, or breached information
25 has been recovered and if so, how it was recovered;
26 (5) the identity of the source of the cybersecurity
HB4433 - 15 - LRB103 36043 RPS 66130 b
HB4433- 16 -LRB103 36043 RPS 66130 b HB4433 - 16 - LRB103 36043 RPS 66130 b
HB4433 - 16 - LRB103 36043 RPS 66130 b
1 event;
2 (6) whether the licensee has filed a police report or
3 has notified any regulatory, government, or law
4 enforcement agencies and, if so, when such notification
5 was provided;
6 (7) a description of the specific types of information
7 acquired without authorization, including types of medical
8 information, types of financial information, or types of
9 information allowing identification of the consumer;
10 (8) the period during which the information system was
11 compromised by the cybersecurity event;
12 (9) the number of total consumers in this State
13 affected by the cybersecurity event; the licensee shall
14 provide the best estimate in the initial report to the
15 Director and update this estimate with each subsequent
16 report to the Director pursuant to this Section;
17 (10) the results of any internal review identifying a
18 lapse in either automated controls or internal procedures,
19 or confirming that all automated controls or internal
20 procedures were followed;
21 (11) a description of efforts being undertaken to
22 remediate the situation which permitted the cybersecurity
23 event to occur;
24 (12) a copy of the licensee's privacy policy and a
25 statement outlining the steps the licensee will take to
26 investigate and notify consumers affected by the
HB4433 - 16 - LRB103 36043 RPS 66130 b
HB4433- 17 -LRB103 36043 RPS 66130 b HB4433 - 17 - LRB103 36043 RPS 66130 b
HB4433 - 17 - LRB103 36043 RPS 66130 b
1 cybersecurity event; and
2 (13) the name of a contact person who is both familiar
3 with the cybersecurity event and authorized to act for the
4 licensee.
5 The licensee shall provide the information in electronic
6 form as directed by the Director. The licensee shall have a
7 continuing obligation to update and supplement initial and
8 subsequent notifications to the Director concerning the
9 cybersecurity event.
10 (c) Licensees shall comply with the Personal Information
11 Protection Act, as applicable, and provide a copy of the
12 notice sent to consumers under that statute to the Director
13 when a licensee is required to notify the Director under
14 subsection (a).
15 (d) If a licensee becomes aware of a cybersecurity event
16 in a system maintained by a third-party service provider, the
17 licensee shall treat the event as it would under subsection
18 (a). The computation of licensee's deadlines shall begin on
19 the day after the third-party service provider notifies the
20 licensee of the cybersecurity event or the licensee otherwise
21 has actual knowledge of the cybersecurity event, whichever is
22 sooner.
23 (e) Nothing in this Act shall prevent or abrogate an
24 agreement between a licensee and another licensee, a
25 third-party service provider, or any other party to fulfill
26 any of the investigation requirements imposed under Section 15
HB4433 - 17 - LRB103 36043 RPS 66130 b
HB4433- 18 -LRB103 36043 RPS 66130 b HB4433 - 18 - LRB103 36043 RPS 66130 b
HB4433 - 18 - LRB103 36043 RPS 66130 b
1 or notice requirements imposed under this Section.
2 (f) In the case of a cybersecurity event involving
3 nonpublic information that is used by the licensee that is
4 acting as an assuming insurer or in the possession, custody,
5 or control of a licensee that is acting as an assuming insurer
6 and that does not have a direct contractual relationship with
7 the affected consumers, the assuming insurer shall notify its
8 affected ceding insurers and the Director of its state of
9 domicile within 72 hours after making the determination that a
10 cybersecurity event has occurred.
11 In the case of a cybersecurity event involving nonpublic
12 information that is in the possession, custody, or control of
13 a third-party service provider of a licensee that is an
14 assuming insurer, the assuming insurer shall notify its
15 affected ceding insurers and the Director of its state of
16 domicile within 72 hours after receiving notice from its
17 third-party service provider that a cybersecurity event has
18 occurred.
19 The ceding insurers that have a direct contractual
20 relationship with affected consumers shall fulfill the
21 consumer notification requirements imposed under the Personal
22 Information Protection Act and any other notification
23 requirements relating to a cybersecurity event imposed under
24 this Section.
25 (g) In the case of a cybersecurity event involving
26 nonpublic information that is in the possession, custody, or
HB4433 - 18 - LRB103 36043 RPS 66130 b
HB4433- 19 -LRB103 36043 RPS 66130 b HB4433 - 19 - LRB103 36043 RPS 66130 b
HB4433 - 19 - LRB103 36043 RPS 66130 b
1 control of a licensee that is an insurer or its third-party
2 service provider and for which a consumer accessed the
3 insurer's services through an independent insurance producer,
4 the insurer shall notify the producers of record of all
5 affected consumers as soon as practicable as directed by the
6 Director. The insurer is excused from this obligation for
7 those instances in which it does not have the current producer
8 of record information for any individual consumer.
9 Section 25. Power of Director.
10 (a) The Director shall have power to examine and
11 investigate the affairs of any licensee to determine whether
12 the licensee has been or is engaged in any conduct in violation
13 of this Act. This power is in addition to the powers which the
14 Director has under the Illinois Insurance Code, including
15 Sections 132, 132.3, 132.4, 133, 401, 402, 403, and 425 of the
16 Illinois Insurance Code. Any investigation or examination
17 shall be conducted pursuant to the Illinois Insurance Code,
18 including Sections 132, 132.3, 132.4, 133, 401, 402, 403, and
19 425 of the Illinois Insurance Code.
20 (b) Whenever the Director has reason to believe that a
21 licensee has been or is engaged in conduct in this State which
22 violates this Act, the Director may take action that is
23 necessary or appropriate to enforce the provisions of this
24 Act.
HB4433 - 19 - LRB103 36043 RPS 66130 b
HB4433- 20 -LRB103 36043 RPS 66130 b HB4433 - 20 - LRB103 36043 RPS 66130 b
HB4433 - 20 - LRB103 36043 RPS 66130 b
1 Section 30. Confidentiality.
2 (a) Any documents, materials, or other information in the
3 control or possession of the Department that are furnished by
4 a licensee or an employee or agent thereof acting on behalf of
5 licensee pursuant to subsection (i) of Section 10, subsection
6 (b) of Section 20, or that are obtained by the Director in an
7 investigation or examination pursuant to Section 25 shall be
8 confidential by law and privileged, shall not be subject to
9 the Freedom of Information Act, shall not be subject to
10 subpoena, and shall not be subject to discovery or admissible
11 in evidence in any private civil action. However, the Director
12 is authorized to use the documents, materials, or other
13 information in the furtherance of any regulatory or legal
14 action brought as a part of the Director's duties.
15 (b) Neither the Director nor any person who received
16 documents, materials, or other information while acting under
17 the authority of the Director shall be permitted or required
18 to testify in any private civil action concerning any
19 confidential documents, materials, or information subject to
20 subsection (a).
21 (c) In order to assist in the performance of the
22 Director's duties under this Act, the Director:
23 (1) may share documents, materials, or other
24 information, including the confidential and privileged
25 documents, materials, or information subject to subsection
26 (a), with other State, federal, and international
HB4433 - 20 - LRB103 36043 RPS 66130 b
HB4433- 21 -LRB103 36043 RPS 66130 b HB4433 - 21 - LRB103 36043 RPS 66130 b
HB4433 - 21 - LRB103 36043 RPS 66130 b
1 regulatory agencies, with the National Association of
2 Insurance Commissioners and its affiliates or
3 subsidiaries, and with State, federal, and international
4 law enforcement authorities, if the recipient agrees in
5 writing to maintain the confidentiality and privileged
6 status of the document, material, or other information;
7 (2) may receive documents, materials, or information,
8 including otherwise confidential and privileged documents,
9 materials, or information, from the National Association
10 of Insurance Commissioners and its affiliates or
11 subsidiaries and from regulatory and law enforcement
12 officials of other foreign or domestic jurisdictions, and
13 shall maintain as confidential or privileged any document,
14 material, or information received with notice or the
15 understanding that it is confidential or privileged under
16 the laws of the jurisdiction that is the source of the
17 document, material, or information;
18 (3) may share documents, materials, or other
19 information subject to subsection (a), with a third-party
20 consultant or vendor if the consultant agrees in writing
21 to maintain the confidentiality and privileged status of
22 the document, material, or other information; and
23 (4) may enter into agreements governing sharing and
24 use of information consistent with this subsection.
25 (d) No waiver of any applicable privilege or claim of
26 confidentiality in the documents, materials, or information
HB4433 - 21 - LRB103 36043 RPS 66130 b
HB4433- 22 -LRB103 36043 RPS 66130 b HB4433 - 22 - LRB103 36043 RPS 66130 b
HB4433 - 22 - LRB103 36043 RPS 66130 b
1 shall occur as a result of disclosure to the Director under
2 this Section or as a result of sharing as authorized in
3 subsection (c).
4 (e) Nothing in this Act shall prohibit the Director from
5 releasing final, adjudicated actions that are open to public
6 inspection pursuant to the Illinois Insurance Code to a
7 database or other clearinghouse service maintained by the
8 National Association of Insurance Commissioners and its
9 affiliates or subsidiaries.
10 Section 35. Exceptions.
11 (a) The following exceptions shall apply to this Act:
12 (1) A licensee with fewer than 10 employees, including
13 any independent contractors, is exempt from Section 10.
14 (2) A licensee subject to the Health Insurance
15 Portability and Accountability Act that has established
16 and maintains an information security program pursuant to
17 such statutes, rules, regulations, procedures, or
18 guidelines established thereunder, shall be considered to
19 meet the requirements of Section 10 if the licensee is
20 compliant with the Health Insurance Portability and
21 Accountability Act and submits a written statement
22 certifying its compliance with the same.
23 (3) An employee, agent, representative, or designee of
24 a licensee that is also a licensee is exempt from Section
25 10 and need not develop its own information security
HB4433 - 22 - LRB103 36043 RPS 66130 b
HB4433- 23 -LRB103 36043 RPS 66130 b HB4433 - 23 - LRB103 36043 RPS 66130 b
HB4433 - 23 - LRB103 36043 RPS 66130 b
1 program to the extent that the employee, agent,
2 representative, or designee is covered by the information
3 security program of the other licensee.
4 (b) If a licensee ceases to qualify for an exception, the
5 licensee shall comply with this Act within 180 days.
6 Section 40. Penalties. In the case of a violation of this
7 Act, a licensee may be penalized in accordance with the
8 provisions of the Illinois Insurance Code, including Section
9 403A of the Illinois Insurance Code.
10 Section 45. Rules. The Department may, in accordance with
11 the Illinois Administrative Procedure Act and Section 401 of
12 the Illinois Insurance Code, adopt such rules as shall be
13 necessary to carry out the provisions of this Act.
14 Section 50. Severability. If any provision of this Act or
15 its application to any person or circumstance is held invalid,
16 the invalidity of that provision or application does not
17 affect other provisions or applications of this Act that can
18 be given effect without the invalid provision or application.
19 Section 105. The Freedom of Information Act is amended by
20 changing Section 7.5 as follows:
21 (5 ILCS 140/7.5)
HB4433 - 23 - LRB103 36043 RPS 66130 b
HB4433- 24 -LRB103 36043 RPS 66130 b HB4433 - 24 - LRB103 36043 RPS 66130 b
HB4433 - 24 - LRB103 36043 RPS 66130 b
1 (Text of Section before amendment by P.A. 103-472)
2 Sec. 7.5. Statutory exemptions. To the extent provided for
3 by the statutes referenced below, the following shall be
4 exempt from inspection and copying:
5 (a) All information determined to be confidential
6 under Section 4002 of the Technology Advancement and
7 Development Act.
8 (b) Library circulation and order records identifying
9 library users with specific materials under the Library
10 Records Confidentiality Act.
11 (c) Applications, related documents, and medical
12 records received by the Experimental Organ Transplantation
13 Procedures Board and any and all documents or other
14 records prepared by the Experimental Organ Transplantation
15 Procedures Board or its staff relating to applications it
16 has received.
17 (d) Information and records held by the Department of
18 Public Health and its authorized representatives relating
19 to known or suspected cases of sexually transmissible
20 disease or any information the disclosure of which is
21 restricted under the Illinois Sexually Transmissible
22 Disease Control Act.
23 (e) Information the disclosure of which is exempted
24 under Section 30 of the Radon Industry Licensing Act.
25 (f) Firm performance evaluations under Section 55 of
26 the Architectural, Engineering, and Land Surveying
HB4433 - 24 - LRB103 36043 RPS 66130 b
HB4433- 25 -LRB103 36043 RPS 66130 b HB4433 - 25 - LRB103 36043 RPS 66130 b
HB4433 - 25 - LRB103 36043 RPS 66130 b
1 Qualifications Based Selection Act.
2 (g) Information the disclosure of which is restricted
3 and exempted under Section 50 of the Illinois Prepaid
4 Tuition Act.
5 (h) Information the disclosure of which is exempted
6 under the State Officials and Employees Ethics Act, and
7 records of any lawfully created State or local inspector
8 general's office that would be exempt if created or
9 obtained by an Executive Inspector General's office under
10 that Act.
11 (i) Information contained in a local emergency energy
12 plan submitted to a municipality in accordance with a
13 local emergency energy plan ordinance that is adopted
14 under Section 11-21.5-5 of the Illinois Municipal Code.
15 (j) Information and data concerning the distribution
16 of surcharge moneys collected and remitted by carriers
17 under the Emergency Telephone System Act.
18 (k) Law enforcement officer identification information
19 or driver identification information compiled by a law
20 enforcement agency or the Department of Transportation
21 under Section 11-212 of the Illinois Vehicle Code.
22 (l) Records and information provided to a residential
23 health care facility resident sexual assault and death
24 review team or the Executive Council under the Abuse
25 Prevention Review Team Act.
26 (m) Information provided to the predatory lending
HB4433 - 25 - LRB103 36043 RPS 66130 b
HB4433- 26 -LRB103 36043 RPS 66130 b HB4433 - 26 - LRB103 36043 RPS 66130 b
HB4433 - 26 - LRB103 36043 RPS 66130 b
1 database created pursuant to Article 3 of the Residential
2 Real Property Disclosure Act, except to the extent
3 authorized under that Article.
4 (n) Defense budgets and petitions for certification of
5 compensation and expenses for court appointed trial
6 counsel as provided under Sections 10 and 15 of the
7 Capital Crimes Litigation Act (repealed). This subsection
8 (n) shall apply until the conclusion of the trial of the
9 case, even if the prosecution chooses not to pursue the
10 death penalty prior to trial or sentencing.
11 (o) Information that is prohibited from being
12 disclosed under Section 4 of the Illinois Health and
13 Hazardous Substances Registry Act.
14 (p) Security portions of system safety program plans,
15 investigation reports, surveys, schedules, lists, data, or
16 information compiled, collected, or prepared by or for the
17 Department of Transportation under Sections 2705-300 and
18 2705-616 of the Department of Transportation Law of the
19 Civil Administrative Code of Illinois, the Regional
20 Transportation Authority under Section 2.11 of the
21 Regional Transportation Authority Act, or the St. Clair
22 County Transit District under the Bi-State Transit Safety
23 Act (repealed).
24 (q) Information prohibited from being disclosed by the
25 Personnel Record Review Act.
26 (r) Information prohibited from being disclosed by the
HB4433 - 26 - LRB103 36043 RPS 66130 b
HB4433- 27 -LRB103 36043 RPS 66130 b HB4433 - 27 - LRB103 36043 RPS 66130 b
HB4433 - 27 - LRB103 36043 RPS 66130 b
1 Illinois School Student Records Act.
2 (s) Information the disclosure of which is restricted
3 under Section 5-108 of the Public Utilities Act.
4 (t) (Blank).
5 (u) Records and information provided to an independent
6 team of experts under the Developmental Disability and
7 Mental Health Safety Act (also known as Brian's Law).
8 (v) Names and information of people who have applied
9 for or received Firearm Owner's Identification Cards under
10 the Firearm Owners Identification Card Act or applied for
11 or received a concealed carry license under the Firearm
12 Concealed Carry Act, unless otherwise authorized by the
13 Firearm Concealed Carry Act; and databases under the
14 Firearm Concealed Carry Act, records of the Concealed
15 Carry Licensing Review Board under the Firearm Concealed
16 Carry Act, and law enforcement agency objections under the
17 Firearm Concealed Carry Act.
18 (v-5) Records of the Firearm Owner's Identification
19 Card Review Board that are exempted from disclosure under
20 Section 10 of the Firearm Owners Identification Card Act.
21 (w) Personally identifiable information which is
22 exempted from disclosure under subsection (g) of Section
23 19.1 of the Toll Highway Act.
24 (x) Information which is exempted from disclosure
25 under Section 5-1014.3 of the Counties Code or Section
26 8-11-21 of the Illinois Municipal Code.
HB4433 - 27 - LRB103 36043 RPS 66130 b
HB4433- 28 -LRB103 36043 RPS 66130 b HB4433 - 28 - LRB103 36043 RPS 66130 b
HB4433 - 28 - LRB103 36043 RPS 66130 b
1 (y) Confidential information under the Adult
2 Protective Services Act and its predecessor enabling
3 statute, the Elder Abuse and Neglect Act, including
4 information about the identity and administrative finding
5 against any caregiver of a verified and substantiated
6 decision of abuse, neglect, or financial exploitation of
7 an eligible adult maintained in the Registry established
8 under Section 7.5 of the Adult Protective Services Act.
9 (z) Records and information provided to a fatality
10 review team or the Illinois Fatality Review Team Advisory
11 Council under Section 15 of the Adult Protective Services
12 Act.
13 (aa) Information which is exempted from disclosure
14 under Section 2.37 of the Wildlife Code.
15 (bb) Information which is or was prohibited from
16 disclosure by the Juvenile Court Act of 1987.
17 (cc) Recordings made under the Law Enforcement
18 Officer-Worn Body Camera Act, except to the extent
19 authorized under that Act.
20 (dd) Information that is prohibited from being
21 disclosed under Section 45 of the Condominium and Common
22 Interest Community Ombudsperson Act.
23 (ee) Information that is exempted from disclosure
24 under Section 30.1 of the Pharmacy Practice Act.
25 (ff) Information that is exempted from disclosure
26 under the Revised Uniform Unclaimed Property Act.
HB4433 - 28 - LRB103 36043 RPS 66130 b
HB4433- 29 -LRB103 36043 RPS 66130 b HB4433 - 29 - LRB103 36043 RPS 66130 b
HB4433 - 29 - LRB103 36043 RPS 66130 b
1 (gg) Information that is prohibited from being
2 disclosed under Section 7-603.5 of the Illinois Vehicle
3 Code.
4 (hh) Records that are exempt from disclosure under
5 Section 1A-16.7 of the Election Code.
6 (ii) Information which is exempted from disclosure
7 under Section 2505-800 of the Department of Revenue Law of
8 the Civil Administrative Code of Illinois.
9 (jj) Information and reports that are required to be
10 submitted to the Department of Labor by registering day
11 and temporary labor service agencies but are exempt from
12 disclosure under subsection (a-1) of Section 45 of the Day
13 and Temporary Labor Services Act.
14 (kk) Information prohibited from disclosure under the
15 Seizure and Forfeiture Reporting Act.
16 (ll) Information the disclosure of which is restricted
17 and exempted under Section 5-30.8 of the Illinois Public
18 Aid Code.
19 (mm) Records that are exempt from disclosure under
20 Section 4.2 of the Crime Victims Compensation Act.
21 (nn) Information that is exempt from disclosure under
22 Section 70 of the Higher Education Student Assistance Act.
23 (oo) Communications, notes, records, and reports
24 arising out of a peer support counseling session
25 prohibited from disclosure under the First Responders
26 Suicide Prevention Act.
HB4433 - 29 - LRB103 36043 RPS 66130 b
HB4433- 30 -LRB103 36043 RPS 66130 b HB4433 - 30 - LRB103 36043 RPS 66130 b
HB4433 - 30 - LRB103 36043 RPS 66130 b
1 (pp) Names and all identifying information relating to
2 an employee of an emergency services provider or law
3 enforcement agency under the First Responders Suicide
4 Prevention Act.
5 (qq) Information and records held by the Department of
6 Public Health and its authorized representatives collected
7 under the Reproductive Health Act.
8 (rr) Information that is exempt from disclosure under
9 the Cannabis Regulation and Tax Act.
10 (ss) Data reported by an employer to the Department of
11 Human Rights pursuant to Section 2-108 of the Illinois
12 Human Rights Act.
13 (tt) Recordings made under the Children's Advocacy
14 Center Act, except to the extent authorized under that
15 Act.
16 (uu) Information that is exempt from disclosure under
17 Section 50 of the Sexual Assault Evidence Submission Act.
18 (vv) Information that is exempt from disclosure under
19 subsections (f) and (j) of Section 5-36 of the Illinois
20 Public Aid Code.
21 (ww) Information that is exempt from disclosure under
22 Section 16.8 of the State Treasurer Act.
23 (xx) Information that is exempt from disclosure or
24 information that shall not be made public under the
25 Illinois Insurance Code.
26 (yy) Information prohibited from being disclosed under
HB4433 - 30 - LRB103 36043 RPS 66130 b
HB4433- 31 -LRB103 36043 RPS 66130 b HB4433 - 31 - LRB103 36043 RPS 66130 b
HB4433 - 31 - LRB103 36043 RPS 66130 b
1 the Illinois Educational Labor Relations Act.
2 (zz) Information prohibited from being disclosed under
3 the Illinois Public Labor Relations Act.
4 (aaa) Information prohibited from being disclosed
5 under Section 1-167 of the Illinois Pension Code.
6 (bbb) Information that is prohibited from disclosure
7 by the Illinois Police Training Act and the Illinois State
8 Police Act.
9 (ccc) Records exempt from disclosure under Section
10 2605-304 of the Illinois State Police Law of the Civil
11 Administrative Code of Illinois.
12 (ddd) Information prohibited from being disclosed
13 under Section 35 of the Address Confidentiality for
14 Victims of Domestic Violence, Sexual Assault, Human
15 Trafficking, or Stalking Act.
16 (eee) Information prohibited from being disclosed
17 under subsection (b) of Section 75 of the Domestic
18 Violence Fatality Review Act.
19 (fff) Images from cameras under the Expressway Camera
20 Act. This subsection (fff) is inoperative on and after
21 July 1, 2025.
22 (ggg) Information prohibited from disclosure under
23 paragraph (3) of subsection (a) of Section 14 of the Nurse
24 Agency Licensing Act.
25 (hhh) Information submitted to the Illinois State
26 Police in an affidavit or application for an assault
HB4433 - 31 - LRB103 36043 RPS 66130 b
HB4433- 32 -LRB103 36043 RPS 66130 b HB4433 - 32 - LRB103 36043 RPS 66130 b
HB4433 - 32 - LRB103 36043 RPS 66130 b
1 weapon endorsement, assault weapon attachment endorsement,
2 .50 caliber rifle endorsement, or .50 caliber cartridge
3 endorsement under the Firearm Owners Identification Card
4 Act.
5 (iii) Data exempt from disclosure under Section 50 of
6 the School Safety Drill Act.
7 (jjj) (hhh) Information exempt from disclosure under
8 Section 30 of the Insurance Data Security Law.
9 (kkk) (iii) Confidential business information
10 prohibited from disclosure under Section 45 of the Paint
11 Stewardship Act.
12 (Source: P.A. 102-36, eff. 6-25-21; 102-237, eff. 1-1-22;
13 102-292, eff. 1-1-22; 102-520, eff. 8-20-21; 102-559, eff.
14 8-20-21; 102-813, eff. 5-13-22; 102-946, eff. 7-1-22;
15 102-1042, eff. 6-3-22; 102-1116, eff. 1-10-23; 103-8, eff.
16 6-7-23; 103-34, eff. 6-9-23; 103-142, eff. 1-1-24; 103-372,
17 eff. 1-1-24; 103-508, eff. 8-4-23; revised 9-5-23.)
18 (Text of Section after amendment by P.A. 103-472)
19 Sec. 7.5. Statutory exemptions. To the extent provided for
20 by the statutes referenced below, the following shall be
21 exempt from inspection and copying:
22 (a) All information determined to be confidential
23 under Section 4002 of the Technology Advancement and
24 Development Act.
25 (b) Library circulation and order records identifying
HB4433 - 32 - LRB103 36043 RPS 66130 b
HB4433- 33 -LRB103 36043 RPS 66130 b HB4433 - 33 - LRB103 36043 RPS 66130 b
HB4433 - 33 - LRB103 36043 RPS 66130 b
1 library users with specific materials under the Library
2 Records Confidentiality Act.
3 (c) Applications, related documents, and medical
4 records received by the Experimental Organ Transplantation
5 Procedures Board and any and all documents or other
6 records prepared by the Experimental Organ Transplantation
7 Procedures Board or its staff relating to applications it
8 has received.
9 (d) Information and records held by the Department of
10 Public Health and its authorized representatives relating
11 to known or suspected cases of sexually transmissible
12 disease or any information the disclosure of which is
13 restricted under the Illinois Sexually Transmissible
14 Disease Control Act.
15 (e) Information the disclosure of which is exempted
16 under Section 30 of the Radon Industry Licensing Act.
17 (f) Firm performance evaluations under Section 55 of
18 the Architectural, Engineering, and Land Surveying
19 Qualifications Based Selection Act.
20 (g) Information the disclosure of which is restricted
21 and exempted under Section 50 of the Illinois Prepaid
22 Tuition Act.
23 (h) Information the disclosure of which is exempted
24 under the State Officials and Employees Ethics Act, and
25 records of any lawfully created State or local inspector
26 general's office that would be exempt if created or
HB4433 - 33 - LRB103 36043 RPS 66130 b
HB4433- 34 -LRB103 36043 RPS 66130 b HB4433 - 34 - LRB103 36043 RPS 66130 b
HB4433 - 34 - LRB103 36043 RPS 66130 b
1 obtained by an Executive Inspector General's office under
2 that Act.
3 (i) Information contained in a local emergency energy
4 plan submitted to a municipality in accordance with a
5 local emergency energy plan ordinance that is adopted
6 under Section 11-21.5-5 of the Illinois Municipal Code.
7 (j) Information and data concerning the distribution
8 of surcharge moneys collected and remitted by carriers
9 under the Emergency Telephone System Act.
10 (k) Law enforcement officer identification information
11 or driver identification information compiled by a law
12 enforcement agency or the Department of Transportation
13 under Section 11-212 of the Illinois Vehicle Code.
14 (l) Records and information provided to a residential
15 health care facility resident sexual assault and death
16 review team or the Executive Council under the Abuse
17 Prevention Review Team Act.
18 (m) Information provided to the predatory lending
19 database created pursuant to Article 3 of the Residential
20 Real Property Disclosure Act, except to the extent
21 authorized under that Article.
22 (n) Defense budgets and petitions for certification of
23 compensation and expenses for court appointed trial
24 counsel as provided under Sections 10 and 15 of the
25 Capital Crimes Litigation Act (repealed). This subsection
26 (n) shall apply until the conclusion of the trial of the
HB4433 - 34 - LRB103 36043 RPS 66130 b
HB4433- 35 -LRB103 36043 RPS 66130 b HB4433 - 35 - LRB103 36043 RPS 66130 b
HB4433 - 35 - LRB103 36043 RPS 66130 b
1 case, even if the prosecution chooses not to pursue the
2 death penalty prior to trial or sentencing.
3 (o) Information that is prohibited from being
4 disclosed under Section 4 of the Illinois Health and
5 Hazardous Substances Registry Act.
6 (p) Security portions of system safety program plans,
7 investigation reports, surveys, schedules, lists, data, or
8 information compiled, collected, or prepared by or for the
9 Department of Transportation under Sections 2705-300 and
10 2705-616 of the Department of Transportation Law of the
11 Civil Administrative Code of Illinois, the Regional
12 Transportation Authority under Section 2.11 of the
13 Regional Transportation Authority Act, or the St. Clair
14 County Transit District under the Bi-State Transit Safety
15 Act (repealed).
16 (q) Information prohibited from being disclosed by the
17 Personnel Record Review Act.
18 (r) Information prohibited from being disclosed by the
19 Illinois School Student Records Act.
20 (s) Information the disclosure of which is restricted
21 under Section 5-108 of the Public Utilities Act.
22 (t) (Blank).
23 (u) Records and information provided to an independent
24 team of experts under the Developmental Disability and
25 Mental Health Safety Act (also known as Brian's Law).
26 (v) Names and information of people who have applied
HB4433 - 35 - LRB103 36043 RPS 66130 b
HB4433- 36 -LRB103 36043 RPS 66130 b HB4433 - 36 - LRB103 36043 RPS 66130 b
HB4433 - 36 - LRB103 36043 RPS 66130 b
1 for or received Firearm Owner's Identification Cards under
2 the Firearm Owners Identification Card Act or applied for
3 or received a concealed carry license under the Firearm
4 Concealed Carry Act, unless otherwise authorized by the
5 Firearm Concealed Carry Act; and databases under the
6 Firearm Concealed Carry Act, records of the Concealed
7 Carry Licensing Review Board under the Firearm Concealed
8 Carry Act, and law enforcement agency objections under the
9 Firearm Concealed Carry Act.
10 (v-5) Records of the Firearm Owner's Identification
11 Card Review Board that are exempted from disclosure under
12 Section 10 of the Firearm Owners Identification Card Act.
13 (w) Personally identifiable information which is
14 exempted from disclosure under subsection (g) of Section
15 19.1 of the Toll Highway Act.
16 (x) Information which is exempted from disclosure
17 under Section 5-1014.3 of the Counties Code or Section
18 8-11-21 of the Illinois Municipal Code.
19 (y) Confidential information under the Adult
20 Protective Services Act and its predecessor enabling
21 statute, the Elder Abuse and Neglect Act, including
22 information about the identity and administrative finding
23 against any caregiver of a verified and substantiated
24 decision of abuse, neglect, or financial exploitation of
25 an eligible adult maintained in the Registry established
26 under Section 7.5 of the Adult Protective Services Act.
HB4433 - 36 - LRB103 36043 RPS 66130 b
HB4433- 37 -LRB103 36043 RPS 66130 b HB4433 - 37 - LRB103 36043 RPS 66130 b
HB4433 - 37 - LRB103 36043 RPS 66130 b
1 (z) Records and information provided to a fatality
2 review team or the Illinois Fatality Review Team Advisory
3 Council under Section 15 of the Adult Protective Services
4 Act.
5 (aa) Information which is exempted from disclosure
6 under Section 2.37 of the Wildlife Code.
7 (bb) Information which is or was prohibited from
8 disclosure by the Juvenile Court Act of 1987.
9 (cc) Recordings made under the Law Enforcement
10 Officer-Worn Body Camera Act, except to the extent
11 authorized under that Act.
12 (dd) Information that is prohibited from being
13 disclosed under Section 45 of the Condominium and Common
14 Interest Community Ombudsperson Act.
15 (ee) Information that is exempted from disclosure
16 under Section 30.1 of the Pharmacy Practice Act.
17 (ff) Information that is exempted from disclosure
18 under the Revised Uniform Unclaimed Property Act.
19 (gg) Information that is prohibited from being
20 disclosed under Section 7-603.5 of the Illinois Vehicle
21 Code.
22 (hh) Records that are exempt from disclosure under
23 Section 1A-16.7 of the Election Code.
24 (ii) Information which is exempted from disclosure
25 under Section 2505-800 of the Department of Revenue Law of
26 the Civil Administrative Code of Illinois.
HB4433 - 37 - LRB103 36043 RPS 66130 b
HB4433- 38 -LRB103 36043 RPS 66130 b HB4433 - 38 - LRB103 36043 RPS 66130 b
HB4433 - 38 - LRB103 36043 RPS 66130 b
1 (jj) Information and reports that are required to be
2 submitted to the Department of Labor by registering day
3 and temporary labor service agencies but are exempt from
4 disclosure under subsection (a-1) of Section 45 of the Day
5 and Temporary Labor Services Act.
6 (kk) Information prohibited from disclosure under the
7 Seizure and Forfeiture Reporting Act.
8 (ll) Information the disclosure of which is restricted
9 and exempted under Section 5-30.8 of the Illinois Public
10 Aid Code.
11 (mm) Records that are exempt from disclosure under
12 Section 4.2 of the Crime Victims Compensation Act.
13 (nn) Information that is exempt from disclosure under
14 Section 70 of the Higher Education Student Assistance Act.
15 (oo) Communications, notes, records, and reports
16 arising out of a peer support counseling session
17 prohibited from disclosure under the First Responders
18 Suicide Prevention Act.
19 (pp) Names and all identifying information relating to
20 an employee of an emergency services provider or law
21 enforcement agency under the First Responders Suicide
22 Prevention Act.
23 (qq) Information and records held by the Department of
24 Public Health and its authorized representatives collected
25 under the Reproductive Health Act.
26 (rr) Information that is exempt from disclosure under
HB4433 - 38 - LRB103 36043 RPS 66130 b
HB4433- 39 -LRB103 36043 RPS 66130 b HB4433 - 39 - LRB103 36043 RPS 66130 b
HB4433 - 39 - LRB103 36043 RPS 66130 b
1 the Cannabis Regulation and Tax Act.
2 (ss) Data reported by an employer to the Department of
3 Human Rights pursuant to Section 2-108 of the Illinois
4 Human Rights Act.
5 (tt) Recordings made under the Children's Advocacy
6 Center Act, except to the extent authorized under that
7 Act.
8 (uu) Information that is exempt from disclosure under
9 Section 50 of the Sexual Assault Evidence Submission Act.
10 (vv) Information that is exempt from disclosure under
11 subsections (f) and (j) of Section 5-36 of the Illinois
12 Public Aid Code.
13 (ww) Information that is exempt from disclosure under
14 Section 16.8 of the State Treasurer Act.
15 (xx) Information that is exempt from disclosure or
16 information that shall not be made public under the
17 Illinois Insurance Code.
18 (yy) Information prohibited from being disclosed under
19 the Illinois Educational Labor Relations Act.
20 (zz) Information prohibited from being disclosed under
21 the Illinois Public Labor Relations Act.
22 (aaa) Information prohibited from being disclosed
23 under Section 1-167 of the Illinois Pension Code.
24 (bbb) Information that is prohibited from disclosure
25 by the Illinois Police Training Act and the Illinois State
26 Police Act.
HB4433 - 39 - LRB103 36043 RPS 66130 b
HB4433- 40 -LRB103 36043 RPS 66130 b HB4433 - 40 - LRB103 36043 RPS 66130 b
HB4433 - 40 - LRB103 36043 RPS 66130 b
1 (ccc) Records exempt from disclosure under Section
2 2605-304 of the Illinois State Police Law of the Civil
3 Administrative Code of Illinois.
4 (ddd) Information prohibited from being disclosed
5 under Section 35 of the Address Confidentiality for
6 Victims of Domestic Violence, Sexual Assault, Human
7 Trafficking, or Stalking Act.
8 (eee) Information prohibited from being disclosed
9 under subsection (b) of Section 75 of the Domestic
10 Violence Fatality Review Act.
11 (fff) Images from cameras under the Expressway Camera
12 Act. This subsection (fff) is inoperative on and after
13 July 1, 2025.
14 (ggg) Information prohibited from disclosure under
15 paragraph (3) of subsection (a) of Section 14 of the Nurse
16 Agency Licensing Act.
17 (hhh) Information submitted to the Illinois State
18 Police in an affidavit or application for an assault
19 weapon endorsement, assault weapon attachment endorsement,
20 .50 caliber rifle endorsement, or .50 caliber cartridge
21 endorsement under the Firearm Owners Identification Card
22 Act.
23 (iii) Data exempt from disclosure under Section 50 of
24 the School Safety Drill Act.
25 (jjj) (hhh) Information exempt from disclosure under
26 Section 30 of the Insurance Data Security Law.
HB4433 - 40 - LRB103 36043 RPS 66130 b
HB4433- 41 -LRB103 36043 RPS 66130 b HB4433 - 41 - LRB103 36043 RPS 66130 b
HB4433 - 41 - LRB103 36043 RPS 66130 b
1 (kkk) (iii) Confidential business information
2 prohibited from disclosure under Section 45 of the Paint
3 Stewardship Act.
4 (lll) (iii) Data exempt from disclosure under Section
5 2-3.196 of the School Code.
6 (mmm) Information exempt from disclosure under Section
7 30 of the Insurance Data Security Law.
8 (Source: P.A. 102-36, eff. 6-25-21; 102-237, eff. 1-1-22;
9 102-292, eff. 1-1-22; 102-520, eff. 8-20-21; 102-559, eff.
10 8-20-21; 102-813, eff. 5-13-22; 102-946, eff. 7-1-22;
11 102-1042, eff. 6-3-22; 102-1116, eff. 1-10-23; 103-8, eff.
12 6-7-23; 103-34, eff. 6-9-23; 103-142, eff. 1-1-24; 103-372,
13 eff. 1-1-24; 103-472, eff. 8-1-24; 103-508, eff. 8-4-23;
14 revised 9-5-23.)
15 Section 95. No acceleration or delay. Where this Act makes
16 changes in a statute that is represented in this Act by text
17 that is not yet or no longer in effect (for example, a Section
18 represented by multiple versions), the use of that text does
19 not accelerate or delay the taking effect of (i) the changes
20 made by this Act or (ii) provisions derived from any other
21 Public Act.
HB4433 - 41 - LRB103 36043 RPS 66130 b