Illinois 2023-2024 Regular Session

Illinois House Bill HB5454 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5454 Introduced , by Rep. Carol Ammons SYNOPSIS AS INTRODUCED: 815 ILCS 530/5815 ILCS 530/10815 ILCS 530/60 new Amends the Personal Information Protection Act. Provides protections for social media users and creates a private cause of action for them if their accounts have been hacked and not restored by social media websites under certain circumstances. Defines a social media website as an Internet website or mobile application that enables users to communicate with each other by posting information, comments, messages, or images; is open to the public; has more than 75 million subscribers; and has never been specifically affiliated with any religion or political party. Provides that, if a court finds that a social media website has violated this Act, the court may award actual damages computed at a rate of $1,000 per violation per day and reasonable attorney's fees and costs incurred in maintaining that civil action. Requires the social media website to restore access to the user's online account within 24 hours of the discovery of the security breach; provide notice of the breach of security within seven days of the discovery; and provide instructions for restoring the integrity of the user's online account of a social media website in compliance with this Act. LRB103 36595 JRC 66704 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5454 Introduced , by Rep. Carol Ammons SYNOPSIS AS INTRODUCED: 815 ILCS 530/5815 ILCS 530/10815 ILCS 530/60 new 815 ILCS 530/5 815 ILCS 530/10 815 ILCS 530/60 new Amends the Personal Information Protection Act. Provides protections for social media users and creates a private cause of action for them if their accounts have been hacked and not restored by social media websites under certain circumstances. Defines a social media website as an Internet website or mobile application that enables users to communicate with each other by posting information, comments, messages, or images; is open to the public; has more than 75 million subscribers; and has never been specifically affiliated with any religion or political party. Provides that, if a court finds that a social media website has violated this Act, the court may award actual damages computed at a rate of $1,000 per violation per day and reasonable attorney's fees and costs incurred in maintaining that civil action. Requires the social media website to restore access to the user's online account within 24 hours of the discovery of the security breach; provide notice of the breach of security within seven days of the discovery; and provide instructions for restoring the integrity of the user's online account of a social media website in compliance with this Act. LRB103 36595 JRC 66704 b LRB103 36595 JRC 66704 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5454 Introduced , by Rep. Carol Ammons SYNOPSIS AS INTRODUCED:
3	3	815 ILCS 530/5815 ILCS 530/10815 ILCS 530/60 new 815 ILCS 530/5 815 ILCS 530/10 815 ILCS 530/60 new
4	4	815 ILCS 530/5
5	5	815 ILCS 530/10
6	6	815 ILCS 530/60 new
7	7	Amends the Personal Information Protection Act. Provides protections for social media users and creates a private cause of action for them if their accounts have been hacked and not restored by social media websites under certain circumstances. Defines a social media website as an Internet website or mobile application that enables users to communicate with each other by posting information, comments, messages, or images; is open to the public; has more than 75 million subscribers; and has never been specifically affiliated with any religion or political party. Provides that, if a court finds that a social media website has violated this Act, the court may award actual damages computed at a rate of $1,000 per violation per day and reasonable attorney's fees and costs incurred in maintaining that civil action. Requires the social media website to restore access to the user's online account within 24 hours of the discovery of the security breach; provide notice of the breach of security within seven days of the discovery; and provide instructions for restoring the integrity of the user's online account of a social media website in compliance with this Act.
8	8	LRB103 36595 JRC 66704 b LRB103 36595 JRC 66704 b
9	9	LRB103 36595 JRC 66704 b
10	10	A BILL FOR
11	11	HB5454LRB103 36595 JRC 66704 b HB5454 LRB103 36595 JRC 66704 b
12	12	HB5454 LRB103 36595 JRC 66704 b
13	13	1 AN ACT concerning civil actions.
14	14	2 Be it enacted by the People of the State of Illinois,
15	15	3 represented in the General Assembly:
16	16	4 Section 5. The Personal Information Protection Act is
17	17	5 amended by changing Sections 5 and 10 and by adding Section 60
18	18	6 as follows:
19	19	7 (815 ILCS 530/5)
20	20	8 Sec. 5. Definitions. In this Act:
21	21	9 "Data collector" may include, but is not limited to,
22	22	10 government agencies, public and private universities,
23	23	11 privately and publicly held corporations, financial
24	24	12 institutions, retail operators, and any other entity that, for
25	25	13 any purpose, handles, collects, disseminates, or otherwise
26	26	14 deals with nonpublic personal information.
27	27	15 "Breach of the security of the system data" or "breach"
28	28	16 means unauthorized acquisition of computerized data that
29	29	17 compromises the security, confidentiality, or integrity of
30	30	18 personal information maintained by the data collector. "Breach
31	31	19 of the security of the system data" does not include good faith
32	32	20 acquisition of personal information by an employee or agent of
33	33	21 the data collector for a legitimate purpose of the data
34	34	22 collector, provided that the personal information is not used
35	35	23 for a purpose unrelated to the data collector's business or
36	36
37	37
38	38
39	39	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5454 Introduced , by Rep. Carol Ammons SYNOPSIS AS INTRODUCED:
40	40	815 ILCS 530/5815 ILCS 530/10815 ILCS 530/60 new 815 ILCS 530/5 815 ILCS 530/10 815 ILCS 530/60 new
41	41	815 ILCS 530/5
42	42	815 ILCS 530/10
43	43	815 ILCS 530/60 new
44	44	Amends the Personal Information Protection Act. Provides protections for social media users and creates a private cause of action for them if their accounts have been hacked and not restored by social media websites under certain circumstances. Defines a social media website as an Internet website or mobile application that enables users to communicate with each other by posting information, comments, messages, or images; is open to the public; has more than 75 million subscribers; and has never been specifically affiliated with any religion or political party. Provides that, if a court finds that a social media website has violated this Act, the court may award actual damages computed at a rate of $1,000 per violation per day and reasonable attorney's fees and costs incurred in maintaining that civil action. Requires the social media website to restore access to the user's online account within 24 hours of the discovery of the security breach; provide notice of the breach of security within seven days of the discovery; and provide instructions for restoring the integrity of the user's online account of a social media website in compliance with this Act.
45	45	LRB103 36595 JRC 66704 b LRB103 36595 JRC 66704 b
46	46	LRB103 36595 JRC 66704 b
47	47	A BILL FOR
48	48
49	49
50	50
51	51
52	52
53	53	815 ILCS 530/5
54	54	815 ILCS 530/10
55	55	815 ILCS 530/60 new
56	56
57	57
58	58
59	59	LRB103 36595 JRC 66704 b
60	60
61	61
62	62
63	63
64	64
65	65
66	66
67	67
68	68
69	69	HB5454 LRB103 36595 JRC 66704 b
70	70
71	71
72	72	HB5454- 2 -LRB103 36595 JRC 66704 b HB5454 - 2 - LRB103 36595 JRC 66704 b
73	73	HB5454 - 2 - LRB103 36595 JRC 66704 b
74	74	1 subject to further unauthorized disclosure.
75	75	2 "Health insurance information" means an individual's
76	76	3 health insurance policy number or subscriber identification
77	77	4 number, any unique identifier used by a health insurer to
78	78	5 identify the individual, or any medical information in an
79	79	6 individual's health insurance application and claims history,
80	80	7 including any appeals records.
81	81	8 "Medical information" means any information regarding an
82	82	9 individual's medical history, mental or physical condition, or
83	83	10 medical treatment or diagnosis by a healthcare professional,
84	84	11 including such information provided to a website or mobile
85	85	12 application.
86	86	13 "Personal information" means either of the following:
87	87	14 (1) An individual's first name or first initial and
88	88	15 last name in combination with any one or more of the
89	89	16 following data elements, when either the name or the data
90	90	17 elements are not encrypted or redacted or are encrypted or
91	91	18 redacted but the keys to unencrypt or unredact or
92	92	19 otherwise read the name or data elements have been
93	93	20 acquired without authorization through the breach of
94	94	21 security:
95	95	22 (A) Social Security number.
96	96	23 (B) Driver's license number or State
97	97	24 identification card number.
98	98	25 (C) Account number or credit or debit card number,
99	99	26 or an account number or credit card number in
100	100
101	101
102	102
103	103
104	104
105	105	HB5454 - 2 - LRB103 36595 JRC 66704 b
106	106
107	107
108	108	HB5454- 3 -LRB103 36595 JRC 66704 b HB5454 - 3 - LRB103 36595 JRC 66704 b
109	109	HB5454 - 3 - LRB103 36595 JRC 66704 b
110	110	1 combination with any required security code, access
111	111	2 code, or password that would permit access to an
112	112	3 individual's financial account.
113	113	4 (D) Medical information.
114	114	5 (E) Health insurance information.
115	115	6 (F) Unique biometric data generated from
116	116	7 measurements or technical analysis of human body
117	117	8 characteristics used by the owner or licensee to
118	118	9 authenticate an individual, such as a fingerprint,
119	119	10 retina or iris image, or other unique physical
120	120	11 representation or digital representation of biometric
121	121	12 data.
122	122	13 (2) User name or email address, in combination with a
123	123	14 password or security question and answer that would permit
124	124	15 access to an online account, when either the user name or
125	125	16 email address or password or security question and answer
126	126	17 are not encrypted or redacted or are encrypted or redacted
127	127	18 but the keys to unencrypt or unredact or otherwise read
128	128	19 the data elements have been obtained through the breach of
129	129	20 security.
130	130	21 "Personal information" does not include publicly available
131	131	22 information that is lawfully made available to the general
132	132	23 public from federal, State, or local government records.
133	133	24 "Social media website" means an Internet website or mobile
134	134	25 application that enables users to communicate with each other
135	135	26 by posting information, comments, messages, or images, and
136	136
137	137
138	138
139	139
140	140
141	141	HB5454 - 3 - LRB103 36595 JRC 66704 b
142	142
143	143
144	144	HB5454- 4 -LRB103 36595 JRC 66704 b HB5454 - 4 - LRB103 36595 JRC 66704 b
145	145	HB5454 - 4 - LRB103 36595 JRC 66704 b
146	146	1 that meets the following criteria: is open to the public; has
147	147	2 more than 75,000,000 subscribers; and has never been
148	148	3 specifically affiliated with any religion or political party.
149	149	4 (Source: P.A. 99-503, eff. 1-1-17.)
150	150	5 (815 ILCS 530/10)
151	151	6 Sec. 10. Notice of breach; notice to Attorney General.
152	152	7 (a) Any data collector that owns or licenses personal
153	153	8 information concerning an Illinois resident shall notify the
154	154	9 resident at no charge that there has been a breach of the
155	155	10 security of the system data following discovery or
156	156	11 notification of the breach. The disclosure notification shall
157	157	12 be made in the most expedient time possible and without
158	158	13 unreasonable delay, consistent with any measures necessary to
159	159	14 determine the scope of the breach and restore the reasonable
160	160	15 integrity, security, and confidentiality of the data system.
161	161	16 The disclosure notification to an Illinois resident shall
162	162	17 include, but need not be limited to, information as follows:
163	163	18 (1) With respect to personal information as defined in
164	164	19 Section 5 in paragraph (1) of the definition of "personal
165	165	20 information":
166	166	21 (A) the toll-free numbers and addresses for
167	167	22 consumer reporting agencies;
168	168	23 (B) the toll-free number, address, and website
169	169	24 address for the Federal Trade Commission; and
170	170	25 (C) a statement that the individual can obtain
171	171
172	172
173	173
174	174
175	175
176	176	HB5454 - 4 - LRB103 36595 JRC 66704 b
177	177
178	178
179	179	HB5454- 5 -LRB103 36595 JRC 66704 b HB5454 - 5 - LRB103 36595 JRC 66704 b
180	180	HB5454 - 5 - LRB103 36595 JRC 66704 b
181	181	1 information from these sources about fraud alerts and
182	182	2 security freezes.
183	183	3 (2) With respect to personal information defined in
184	184	4 Section 5 in paragraph (2) of the definition of "personal
185	185	5 information", notice may be provided in electronic or
186	186	6 other form directing the Illinois resident whose personal
187	187	7 information has been breached to promptly change his or
188	188	8 her user name or password and security question or answer,
189	189	9 as applicable, or to take other steps appropriate to
190	190	10 protect all online accounts for which the resident uses
191	191	11 the same user name or email address and password or
192	192	12 security question and answer.
193	193	13 The notification shall not, however, include information
194	194	14 concerning the number of Illinois residents affected by the
195	195	15 breach.
196	196	16 (b) Any data collector that maintains or stores, but does
197	197	17 not own or license, computerized data that includes personal
198	198	18 information that the data collector does not own or license
199	199	19 shall notify the owner or licensee of the information of any
200	200	20 breach of the security of the data immediately following
201	201	21 discovery, if the personal information was, or is reasonably
202	202	22 believed to have been, acquired by an unauthorized person. In
203	203	23 addition to providing such notification to the owner or
204	204	24 licensee, the data collector shall cooperate with the owner or
205	205	25 licensee in matters relating to the breach. That cooperation
206	206	26 shall include, but need not be limited to, (i) informing the
207	207
208	208
209	209
210	210
211	211
212	212	HB5454 - 5 - LRB103 36595 JRC 66704 b
213	213
214	214
215	215	HB5454- 6 -LRB103 36595 JRC 66704 b HB5454 - 6 - LRB103 36595 JRC 66704 b
216	216	HB5454 - 6 - LRB103 36595 JRC 66704 b
217	217	1 owner or licensee of the breach, including giving notice of
218	218	2 the date or approximate date of the breach and the nature of
219	219	3 the breach, and (ii) informing the owner or licensee of any
220	220	4 steps the data collector has taken or plans to take relating to
221	221	5 the breach. The data collector's cooperation shall not,
222	222	6 however, be deemed to require either the disclosure of
223	223	7 confidential business information or trade secrets or the
224	224	8 notification of an Illinois resident who may have been
225	225	9 affected by the breach.
226	226	10 (b-5) The notification to an Illinois resident required by
227	227	11 subsection (a) of this Section may be delayed if an
228	228	12 appropriate law enforcement agency determines that
229	229	13 notification will interfere with a criminal investigation and
230	230	14 provides the data collector with a written request for the
231	231	15 delay. However, the data collector must notify the Illinois
232	232	16 resident as soon as notification will no longer interfere with
233	233	17 the investigation.
234	234	18 (c) For purposes of this Section, notice to consumers may
235	235	19 be provided by one of the following methods:
236	236	20 (1) written notice;
237	237	21 (2) electronic notice, if the notice provided is
238	238	22 consistent with the provisions regarding electronic
239	239	23 records and signatures for notices legally required to be
240	240	24 in writing as set forth in Section 7001 of Title 15 of the
241	241	25 United States Code; or
242	242	26 (3) substitute notice, if the data collector
243	243
244	244
245	245
246	246
247	247
248	248	HB5454 - 6 - LRB103 36595 JRC 66704 b
249	249
250	250
251	251	HB5454- 7 -LRB103 36595 JRC 66704 b HB5454 - 7 - LRB103 36595 JRC 66704 b
252	252	HB5454 - 7 - LRB103 36595 JRC 66704 b
253	253	1 demonstrates that the cost of providing notice would
254	254	2 exceed $250,000 or that the affected class of subject
255	255	3 persons to be notified exceeds 500,000, or the data
256	256	4 collector does not have sufficient contact information.
257	257	5 Substitute notice shall consist of all of the following:
258	258	6 (i) email notice if the data collector has an email
259	259	7 address for the subject persons; (ii) conspicuous posting
260	260	8 of the notice on the data collector's web site page if the
261	261	9 data collector maintains one; and (iii) notification to
262	262	10 major statewide media or, if the breach impacts residents
263	263	11 in one geographic area, to prominent local media in areas
264	264	12 where affected individuals are likely to reside if such
265	265	13 notice is reasonably calculated to give actual notice to
266	266	14 persons whom notice is required.
267	267	15 (d) Notwithstanding any other subsection in this Section,
268	268	16 a data collector that maintains its own notification
269	269	17 procedures as part of an information security policy for the
270	270	18 treatment of personal information and is otherwise consistent
271	271	19 with the timing requirements of this Act, shall be deemed in
272	272	20 compliance with the notification requirements of this Section
273	273	21 if the data collector notifies subject persons in accordance
274	274	22 with its policies in the event of a breach of the security of
275	275	23 the system data.
276	276	24 (e)(1) This subsection does not apply to data collectors
277	277	25 that are covered entities or business associates and are in
278	278	26 compliance with Section 50.
279	279
280	280
281	281
282	282
283	283
284	284	HB5454 - 7 - LRB103 36595 JRC 66704 b
285	285
286	286
287	287	HB5454- 8 -LRB103 36595 JRC 66704 b HB5454 - 8 - LRB103 36595 JRC 66704 b
288	288	HB5454 - 8 - LRB103 36595 JRC 66704 b
289	289	1 (2) Any data collector required to issue notice pursuant
290	290	2 to this Section to more than 500 Illinois residents as a result
291	291	3 of a single breach of the security system shall provide notice
292	292	4 to the Attorney General of the breach, including:
293	293	5 (A) A description of the nature of the breach of
294	294	6 security or unauthorized acquisition or use.
295	295	7 (B) The number of Illinois residents affected by such
296	296	8 incident at the time of notification.
297	297	9 (C) Any steps the data collector has taken or plans to
298	298	10 take relating to the incident.
299	299	11 Such notification must be made in the most expedient time
300	300	12 possible and without unreasonable delay but in no event later
301	301	13 than when the data collector provides notice to consumers
302	302	14 pursuant to this Section. If the date of the breach is unknown
303	303	15 at the time the notice is sent to the Attorney General, the
304	304	16 data collector shall send the Attorney General the date of the
305	305	17 breach as soon as possible.
306	306	18 Upon receiving notification from a data collector of a
307	307	19 breach of personal information, the Attorney General may
308	308	20 publish the name of the data collector that suffered the
309	309	21 breach, the types of personal information compromised in the
310	310	22 breach, and the date range of the breach.
311	311	23 (f) In accordance with federal law, any business that
312	312	24 operates a social media website shall, within 24 hours of
313	313	25 discovery of a breach of security to a user whose online
314	314	26 account or personal information was, or is reasonably believed
315	315
316	316
317	317
318	318
319	319
320	320	HB5454 - 8 - LRB103 36595 JRC 66704 b
321	321
322	322
323	323	HB5454- 9 -LRB103 36595 JRC 66704 b HB5454 - 9 - LRB103 36595 JRC 66704 b
324	324	HB5454 - 9 - LRB103 36595 JRC 66704 b
325	325	1 to have been, accessed by an unauthorized person, determine
326	326	2 the scope of the breach of security and restore the reasonable
327	327	3 integrity of, and access to, the online account to the user.
328	328	4 Any discovery of breach of security shall be documented in
329	329	5 writing by the business that operates the social media website
330	330	6 and retained for 5 years.
331	331	7 (g) Within 7 days of the discovery of the breach of
332	332	8 security to a user's account, the business that operates the
333	333	9 social media website shall provide clear and conspicuous
334	334	10 notice delivered to the user through the email and mobile
335	335	11 phone number that was associated with the online account prior
336	336	12 to the breach of security.
337	337	13 (h) The business that operates the social media website
338	338	14 shall include within the notification instructions that
339	339	15 directs the customer whose online account has been breached to
340	340	16 promptly change any password and security question or answer,
341	341	17 as applicable, and to take other appropriate steps to protect
342	342	18 and restore the integrity of the online account of the social
343	343	19 media website.
344	344	20 (i) The Department of Innovation and Technology may
345	345	21 promulgate rules and regulations necessary to effectuate this
346	346	22 subsection.
347	347	23 (Source: P.A. 100-201, eff. 8-18-17; 101-343, eff. 1-1-20.)
348	348	24 (815 ILCS 530/60 new)
349	349	25 Sec. 60. Private cause of action for violation of this Act
350	350
351	351
352	352
353	353
354	354
355	355	HB5454 - 9 - LRB103 36595 JRC 66704 b
356	356
357	357
358	358	HB5454- 10 -LRB103 36595 JRC 66704 b HB5454 - 10 - LRB103 36595 JRC 66704 b
359	359	HB5454 - 10 - LRB103 36595 JRC 66704 b
360	360	1 by a business operating a social media website.
361	361	2 (a) Any user of a social media website may bring an action
362	362	3 in any court of competent jurisdiction following the discovery
363	363	4 of a breach of security by the business that operates the
364	364	5 social media website, if the user:
365	365	6 (1) has not had access restored to the user's online
366	366	7 account within 24 hours of the discovery of the security
367	367	8 breach as required by this Act;
368	368	9 (2) has not been provided notice of the breach of
369	369	10 security within seven days of such discovery, as required
370	370	11 by this Act; or
371	371	12 (3) has not been provided instructions for restoring
372	372	13 the integrity of the user's online account of a social
373	373	14 media website in compliance with this Act.
374	374	15 (b) If a court of competent jurisdiction finds that a
375	375	16 social media website has violated this Section, the court may
376	376	17 award actual damages computed at a rate of $1,000 per
377	377	18 violation per day and reasonable attorney's fees and costs
378	378	19 incurred in maintaining that civil action.
379	379	20 (c) This private right of action authorized pursuant to
380	380	21 this Section does not supplant any other claim or cause of
381	381	22 action available to a customer under common law or by statute.
382	382	23 The provisions of this subsection are in addition to any other
383	383	24 common law and statutory remedies.
384	384	25 (d) Nothing in this Section may be construed as creating a
385	385	26 private right of action against the State or any political
386	386
387	387
388	388
389	389
390	390
391	391	HB5454 - 10 - LRB103 36595 JRC 66704 b
392	392
393	393
394	394	HB5454- 11 -LRB103 36595 JRC 66704 b HB5454 - 11 - LRB103 36595 JRC 66704 b
395	395	HB5454 - 11 - LRB103 36595 JRC 66704 b
396	396
397	397
398	398
399	399
400	400
401	401	HB5454 - 11 - LRB103 36595 JRC 66704 b