Illinois 2023-2024 Regular Session

Illinois House Bill HB5581 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5581 Introduced , by Rep. Hoan Huynh SYNOPSIS AS INTRODUCED: New Act Creates the Illinois Privacy Rights Act. Defines terms such as "biometric data", "consumer", "controller", "deidentified data", and "processor". Creates a consumer protection of privacy in which, with some exceptions, provides an individual with the right to: (i) confirm whether or not a controller is processing the consumer's personal data and access such personal data; (ii) correct inaccuracies in the consumer's personal data; (iii) delete personal data provided by or obtained about the consumer; (iv) obtain a copy of the consumer's personal data processed by the controller in a portable and, to the extent technically feasible, readily usable format; and, (v) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Defines a consumer as a resident of this State excluding an individual acting in commercial or employment context. Provides that this Act applies to persons that conduct business in this State or persons that produce products or services that are targeted to residents of this State that during a 1-year period: (i) controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of personal data. Provides that the Attorney General has the exclusive authority under this Act to enforce violations of it. Makes a violation of this Act an unfair method of competition or any unfair or deceptive act or practice under the Consumer Fraud and Deceptive Business Practices Act. Prohibits a private cause of action under this Act. Effective January 1, 2025. LRB103 38323 JRC 68458 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5581 Introduced , by Rep. Hoan Huynh SYNOPSIS AS INTRODUCED: New Act New Act Creates the Illinois Privacy Rights Act. Defines terms such as "biometric data", "consumer", "controller", "deidentified data", and "processor". Creates a consumer protection of privacy in which, with some exceptions, provides an individual with the right to: (i) confirm whether or not a controller is processing the consumer's personal data and access such personal data; (ii) correct inaccuracies in the consumer's personal data; (iii) delete personal data provided by or obtained about the consumer; (iv) obtain a copy of the consumer's personal data processed by the controller in a portable and, to the extent technically feasible, readily usable format; and, (v) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Defines a consumer as a resident of this State excluding an individual acting in commercial or employment context. Provides that this Act applies to persons that conduct business in this State or persons that produce products or services that are targeted to residents of this State that during a 1-year period: (i) controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of personal data. Provides that the Attorney General has the exclusive authority under this Act to enforce violations of it. Makes a violation of this Act an unfair method of competition or any unfair or deceptive act or practice under the Consumer Fraud and Deceptive Business Practices Act. Prohibits a private cause of action under this Act. Effective January 1, 2025. LRB103 38323 JRC 68458 b LRB103 38323 JRC 68458 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5581 Introduced , by Rep. Hoan Huynh SYNOPSIS AS INTRODUCED:
3	3	New Act New Act
4	4	New Act
5	5	Creates the Illinois Privacy Rights Act. Defines terms such as "biometric data", "consumer", "controller", "deidentified data", and "processor". Creates a consumer protection of privacy in which, with some exceptions, provides an individual with the right to: (i) confirm whether or not a controller is processing the consumer's personal data and access such personal data; (ii) correct inaccuracies in the consumer's personal data; (iii) delete personal data provided by or obtained about the consumer; (iv) obtain a copy of the consumer's personal data processed by the controller in a portable and, to the extent technically feasible, readily usable format; and, (v) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Defines a consumer as a resident of this State excluding an individual acting in commercial or employment context. Provides that this Act applies to persons that conduct business in this State or persons that produce products or services that are targeted to residents of this State that during a 1-year period: (i) controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of personal data. Provides that the Attorney General has the exclusive authority under this Act to enforce violations of it. Makes a violation of this Act an unfair method of competition or any unfair or deceptive act or practice under the Consumer Fraud and Deceptive Business Practices Act. Prohibits a private cause of action under this Act. Effective January 1, 2025.
6	6	LRB103 38323 JRC 68458 b LRB103 38323 JRC 68458 b
7	7	LRB103 38323 JRC 68458 b
8	8	A BILL FOR
9	9	HB5581LRB103 38323 JRC 68458 b HB5581 LRB103 38323 JRC 68458 b
10	10	HB5581 LRB103 38323 JRC 68458 b
11	11	1 AN ACT concerning civil law.
12	12	2 Be it enacted by the People of the State of Illinois,
13	13	3 represented in the General Assembly:
14	14	4 Section 1. Short title. This Act may be cited as the
15	15	5 Illinois Privacy Rights Act.
16	16	6 Section 5. Definitions. As used in this Act:
17	17	7 (a) "Affiliate" means a legal entity that shares common
18	18	8 branding with another legal entity, or is controlled by, or is
19	19	9 under common control with, another legal entity.
20	20	10 (b) "Control" or "controlled" means ownership of, or the
21	21	11 power to vote, more than 50 percent of the outstanding shares
22	22	12 of any class of voting security of a company; control in any
23	23	13 manner over the election of a majority of the directors or of
24	24	14 individuals exercising similar functions; or the power to
25	25	15 exercise controlling influence over the management of a
26	26	16 company.
27	27	17 (c) "Authenticate" means to use reasonable means to
28	28	18 determine that a request to exercise any of the rights
29	29	19 afforded under paragraphs (1) through (4) of subsection (a) of
30	30	20 Section 20 is being made by, or on behalf of, the consumer who
31	31	21 is entitled to exercise such consumer rights with respect to
32	32	22 the personal data at issue.
33	33	23 (d) "Biometric data" means data generated by automatic
34	34
35	35
36	36
37	37	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5581 Introduced , by Rep. Hoan Huynh SYNOPSIS AS INTRODUCED:
38	38	New Act New Act
39	39	New Act
40	40	Creates the Illinois Privacy Rights Act. Defines terms such as "biometric data", "consumer", "controller", "deidentified data", and "processor". Creates a consumer protection of privacy in which, with some exceptions, provides an individual with the right to: (i) confirm whether or not a controller is processing the consumer's personal data and access such personal data; (ii) correct inaccuracies in the consumer's personal data; (iii) delete personal data provided by or obtained about the consumer; (iv) obtain a copy of the consumer's personal data processed by the controller in a portable and, to the extent technically feasible, readily usable format; and, (v) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Defines a consumer as a resident of this State excluding an individual acting in commercial or employment context. Provides that this Act applies to persons that conduct business in this State or persons that produce products or services that are targeted to residents of this State that during a 1-year period: (i) controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of personal data. Provides that the Attorney General has the exclusive authority under this Act to enforce violations of it. Makes a violation of this Act an unfair method of competition or any unfair or deceptive act or practice under the Consumer Fraud and Deceptive Business Practices Act. Prohibits a private cause of action under this Act. Effective January 1, 2025.
41	41	LRB103 38323 JRC 68458 b LRB103 38323 JRC 68458 b
42	42	LRB103 38323 JRC 68458 b
43	43	A BILL FOR
44	44
45	45
46	46
47	47
48	48
49	49	New Act
50	50
51	51
52	52
53	53	LRB103 38323 JRC 68458 b
54	54
55	55
56	56
57	57
58	58
59	59
60	60
61	61
62	62
63	63	HB5581 LRB103 38323 JRC 68458 b
64	64
65	65
66	66	HB5581- 2 -LRB103 38323 JRC 68458 b HB5581 - 2 - LRB103 38323 JRC 68458 b
67	67	HB5581 - 2 - LRB103 38323 JRC 68458 b
68	68	1 measurements of an individual's biological characteristics,
69	69	2 such as a fingerprint, a voiceprint, eye retinas, irises or
70	70	3 other unique biological patterns, or characteristics that are
71	71	4 used to identify a specific individual. "Biometric data" does
72	72	5 not include a digital or physical photograph, an audio or
73	73	6 video recording, or any data generated from a digital or
74	74	7 physical photograph, or an audio or video recording, unless
75	75	8 such data is generated to identify a specific individual.
76	76	9 (e) "Business associate" has the same meaning as provided
77	77	10 in the Health Insurance Portability and Accountability Act
78	78	11 (HIPAA).
79	79	12 (f) "Child" has the same meaning as provided in the
80	80	13 Children's Online Privacy Protection Act (COPPA).
81	81	14 (g) "Consent" means a clear affirmative act signifying a
82	82	15 consumer's freely given, specific, informed and unambiguous
83	83	16 agreement to allow the processing of personal data relating to
84	84	17 the consumer. "Consent" may include a written statement,
85	85	18 including by electronic means, or any other unambiguous
86	86	19 affirmative action. "Consent" does not include acceptance of a
87	87	20 general or broad terms of use or similar document that
88	88	21 contains descriptions of personal data processing along with
89	89	22 other, unrelated information; hovering over, muting, pausing
90	90	23 or closing a given piece of content; or an agreement obtained
91	91	24 through the use of deceptive design patterns (also known as
92	92	25 "dark patterns").
93	93	26 (h) "Consumer" means an individual who is a resident of
94	94
95	95
96	96
97	97
98	98
99	99	HB5581 - 2 - LRB103 38323 JRC 68458 b
100	100
101	101
102	102	HB5581- 3 -LRB103 38323 JRC 68458 b HB5581 - 3 - LRB103 38323 JRC 68458 b
103	103	HB5581 - 3 - LRB103 38323 JRC 68458 b
104	104	1 this State. "Consumer" does not include an individual acting
105	105	2 in a commercial or employment context or as an employee,
106	106	3 owner, director, officer or contractor of a company,
107	107	4 partnership, sole proprietorship, nonprofit or government
108	108	5 agency whose communications or transactions with the
109	109	6 controller occur solely within the context of that
110	110	7 individual's role with the company, partnership, sole
111	111	8 proprietorship, nonprofit or government agency.
112	112	9 (i) "Controller" means an individual who, or legal entity
113	113	10 that, alone or jointly with others determines the purpose and
114	114	11 means of processing personal data.
115	115	12 (j) "COPPA" means the Children's Online Privacy Protection
116	116	13 Act of 1998, 15 U.S.C. 6501 et seq., and any amendments,
117	117	14 regulations, rules, guidance and exemptions adopted under that
118	118	15 act.
119	119	16 (k) "Covered entity" has the same meaning as provided in
120	120	17 HIPAA.
121	121	18 (l) "Dark pattern" or "deceptive design pattern" means a
122	122	19 user interface designed or manipulated with the substantial
123	123	20 effect of subverting or impairing user autonomy,
124	124	21 decision-making or choice, and includes, but is not limited
125	125	22 to, any practice the Federal Trade Commission refers to as a
126	126	23 "dark pattern".
127	127	24 (m) "Decisions that produce legal or similarly significant
128	128	25 effects concerning the consumer" means decisions made by the
129	129	26 controller that result in the provision or denial by the
130	130
131	131
132	132
133	133
134	134
135	135	HB5581 - 3 - LRB103 38323 JRC 68458 b
136	136
137	137
138	138	HB5581- 4 -LRB103 38323 JRC 68458 b HB5581 - 4 - LRB103 38323 JRC 68458 b
139	139	HB5581 - 4 - LRB103 38323 JRC 68458 b
140	140	1 controller of financial or lending services, housing,
141	141	2 insurance, education enrollment or opportunity, criminal
142	142	3 justice, employment opportunities, health care services or
143	143	4 access to essential goods or services.
144	144	5 (n) "Deidentified data" means data that cannot reasonably
145	145	6 be used to infer information about, or otherwise be linked to,
146	146	7 an identified or identifiable individual, or a device linked
147	147	8 to such individual, if the controller that possesses such data
148	148	9 takes reasonable measures to ensure that such data cannot be
149	149	10 associated with an individual; publicly commits to process
150	150	11 such data only in a deidentified way and not attempt to
151	151	12 reidentify such data; and contractually obligates any
152	152	13 recipients of such data to satisfy the criteria under this
153	153	14 paragraph.
154	154	15 (o) "HIPAA" means the Health Insurance Portability and
155	155	16 Accountability Act of 1996, 42 USC 1320d et seq., as amended.
156	156	17 (p) "Identified or identifiable individual" means an
157	157	18 individual who can be readily identified, directly or
158	158	19 indirectly.
159	159	20 (q) "Institution of higher education" means any individual
160	160	21 who, or school, board, association, limited liability company
161	161	22 or corporation that, is licensed or accredited to offer one or
162	162	23 more programs of higher learning leading to one or more
163	163	24 degrees.
164	164	25 (r) "Nonprofit organization" means any organization that
165	165	26 is exempt from taxation under Section 501(c)(3), 501(c)(4),
166	166
167	167
168	168
169	169
170	170
171	171	HB5581 - 4 - LRB103 38323 JRC 68458 b
172	172
173	173
174	174	HB5581- 5 -LRB103 38323 JRC 68458 b HB5581 - 5 - LRB103 38323 JRC 68458 b
175	175	HB5581 - 5 - LRB103 38323 JRC 68458 b
176	176	1 501(c)(6), or 501(c)(12) of the Internal Revenue Code of 1986,
177	177	2 or any subsequent corresponding internal revenue code of the
178	178	3 United States, as amended.
179	179	4 (s) "Personal data" means any information that is linked
180	180	5 or reasonably linkable to an identified or identifiable
181	181	6 individual. "Personal data" does not include deidentified data
182	182	7 or publicly available information.
183	183	8 (t) "Precise geolocation data" means information derived
184	184	9 from technology, including, but not limited to, global
185	185	10 positioning system level latitude and longitude coordinates or
186	186	11 other mechanisms, that directly identifies the specific
187	187	12 location of an individual with precision and accuracy within a
188	188	13 radius of 1,750 feet. "Precise geolocation data" does not
189	189	14 include the content of communications or any data generated by
190	190	15 or connected to advanced utility metering infrastructure
191	191	16 systems or equipment for use by a utility.
192	192	17 (u) "Process" or "processing" means any operation or set
193	193	18 of operations performed, whether by manual or automated means,
194	194	19 on personal data or on sets of personal data, such as the
195	195	20 collection, use, storage, disclosure, analysis, deletion or
196	196	21 modification of personal data.
197	197	22 (v) "Processor" means an individual who, or legal entity
198	198	23 that, processes personal data on behalf of a controller.
199	199	24 (w) "Profiling" means any form of automated processing
200	200	25 performed on personal data to evaluate, analyze, or predict
201	201	26 personal aspects related to an identified or identifiable
202	202
203	203
204	204
205	205
206	206
207	207	HB5581 - 5 - LRB103 38323 JRC 68458 b
208	208
209	209
210	210	HB5581- 6 -LRB103 38323 JRC 68458 b HB5581 - 6 - LRB103 38323 JRC 68458 b
211	211	HB5581 - 6 - LRB103 38323 JRC 68458 b
212	212	1 individual's economic situation, health, personal preferences,
213	213	2 interests, reliability, behavior, location, or movements.
214	214	3 (x) "Protected health information" has the same meaning as
215	215	4 provided in HIPAA.
216	216	5 (y) "Pseudonymous data" means personal data that cannot be
217	217	6 attributed to a specific individual without the use of
218	218	7 additional information, provided such additional information
219	219	8 is kept separately and is subject to appropriate technical and
220	220	9 organizational measures to ensure that the personal data is
221	221	10 not attributed to an identified or identifiable individual.
222	222	11 (z) "Publicly available information" means information
223	223	12 that is lawfully made available through federal, State,
224	224	13 municipal government records, or widely distributed media, and
225	225	14 a controller has a reasonable basis to believe a consumer has
226	226	15 lawfully made available to the general public.
227	227	16 (aa) "Sale of personal data" means the exchange of
228	228	17 personal data for monetary or other valuable consideration by
229	229	18 the controller to a third party. "Sale of personal data" does
230	230	19 not include:
231	231	20 (1) The disclosure of personal data to a processor
232	232	21 that processes the personal data on behalf of the
233	233	22 controller;
234	234	23 (2) The disclosure of personal data to a third party
235	235	24 for purposes of providing a product or service requested
236	236	25 by the consumer;
237	237	26 (3) The disclosure or transfer of personal data to an
238	238
239	239
240	240
241	241
242	242
243	243	HB5581 - 6 - LRB103 38323 JRC 68458 b
244	244
245	245
246	246	HB5581- 7 -LRB103 38323 JRC 68458 b HB5581 - 7 - LRB103 38323 JRC 68458 b
247	247	HB5581 - 7 - LRB103 38323 JRC 68458 b
248	248	1 affiliate of the controller;
249	249	2 (4) The disclosure of personal data where the consumer
250	250	3 directs the controller to disclose the personal data or
251	251	4 intentionally uses the controller to interact with a third
252	252	5 party;
253	253	6 (5) The disclosure of personal data that the consumer
254	254	7 intentionally made available to the general public via a
255	255	8 channel of mass media, and did not restrict to a specific
256	256	9 audience; or
257	257	10 (6) The disclosure or transfer of personal data to a
258	258	11 third party as an asset that is part of a merger,
259	259	12 acquisition, bankruptcy or other transaction, or a
260	260	13 proposed merger, acquisition, bankruptcy or other
261	261	14 transaction, in which the third party assumes control of
262	262	15 all or part of the controller's assets.
263	263	16 (bb) "Sensitive data" means personal data that includes
264	264	17 data revealing racial or ethnic origin, religious beliefs,
265	265	18 mental or physical health condition or diagnosis, sex life,
266	266	19 sexual orientation or citizenship or immigration status; the
267	267	20 processing of genetic or biometric data for the purpose of
268	268	21 uniquely identifying an individual; personal data collected
269	269	22 from a known child; or precise geolocation data.
270	270	23 (cc) "Targeted advertising" means displaying
271	271	24 advertisements to a consumer where the advertisement is
272	272	25 selected based on personal data obtained or inferred from that
273	273	26 consumer's activities over time and across nonaffiliated
274	274
275	275
276	276
277	277
278	278
279	279	HB5581 - 7 - LRB103 38323 JRC 68458 b
280	280
281	281
282	282	HB5581- 8 -LRB103 38323 JRC 68458 b HB5581 - 8 - LRB103 38323 JRC 68458 b
283	283	HB5581 - 8 - LRB103 38323 JRC 68458 b
284	284	1 Internet websites or online applications to predict such
285	285	2 consumer's preferences or interests. "Targeted advertising"
286	286	3 does not include:
287	287	4 (1) Advertisements based on activities within a
288	288	5 controller's own Internet websites or online applications;
289	289	6 (2) Advertisements based on the context of a
290	290	7 consumer's current search query, visit to an Internet
291	291	8 website, or online application;
292	292	9 (3) Advertisements directed to a consumer in response
293	293	10 to the consumer's request for information or feedback; or
294	294	11 (4) Processing personal data solely to measure or
295	295	12 report advertising frequency, performance, or reach.
296	296	13 (dd) "Third party" means an individual or legal entity,
297	297	14 such as a public authority, agency or body, other than the
298	298	15 consumer, controller or processor or an affiliate of the
299	299	16 processor or the controller.
300	300	17 Section 10. Application. This Act applies to persons that
301	301	18 conduct business in this State or persons that produce
302	302	19 products or services that are targeted to residents of this
303	303	20 State that during a one-year period:
304	304	21 (a) Controlled or processed the personal data of not
305	305	22 less than 35,000 unique consumers, excluding personal data
306	306	23 controlled or processed solely for the purpose of
307	307	24 completing a payment transaction; or
308	308	25 (b) Controlled or processed the personal data of not
309	309
310	310
311	311
312	312
313	313
314	314	HB5581 - 8 - LRB103 38323 JRC 68458 b
315	315
316	316
317	317	HB5581- 9 -LRB103 38323 JRC 68458 b HB5581 - 9 - LRB103 38323 JRC 68458 b
318	318	HB5581 - 9 - LRB103 38323 JRC 68458 b
319	319	1 less than 10,000 unique consumers and derived more than 25
320	320	2 percent of their gross revenue from the sale of personal
321	321	3 data.
322	322	4 Section 15. Exclusions.
323	323	5 (a) This Act does not apply to any:
324	324	6 (1) Body, authority, board, bureau, commission,
325	325	7 district or agency of this State or any political
326	326	8 subdivision of this State;
327	327	9 (2) Nonprofit organization;
328	328	10 (3) Institution of higher education;
329	329	11 (4) National securities association that is registered
330	330	12 under 15 U.S.C. 78o-3 of the Security Exchange Act of
331	331	13 1934, as amended;
332	332	14 (5) Financial institution or data subject to Title V
333	333	15 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.; or
334	334	16 (6) A covered entity or business associate, as defined
335	335	17 in 45 CFR 160.103(b).
336	336	18 (b) The following information and data shall be exempt
337	337	19 from this Act:
338	338	20 (1) Protected health information under HIPAA;
339	339	21 (2) Patient-identifying information for purposes of 42
340	340	22 U.S.C. 290dd-2;
341	341	23 (3) Identifiable private information for purposes of
342	342	24 the federal policy for the protection of human subjects
343	343	25 under 45 CFR 46;
344	344
345	345
346	346
347	347
348	348
349	349	HB5581 - 9 - LRB103 38323 JRC 68458 b
350	350
351	351
352	352	HB5581- 10 -LRB103 38323 JRC 68458 b HB5581 - 10 - LRB103 38323 JRC 68458 b
353	353	HB5581 - 10 - LRB103 38323 JRC 68458 b
354	354	1 (4) Identifiable private information that is otherwise
355	355	2 information collected as part of human subjects research
356	356	3 pursuant to the good clinical practice guidelines issued
357	357	4 by the International Council for Harmonization of
358	358	5 Technical Requirements for Pharmaceuticals for Human Use;
359	359	6 (5) The protection of human subjects under 21 CFR
360	360	7 Parts 6, 50, and 56, or personal data used or shared in
361	361	8 research, as defined in 45 CFR 164.501, that is conducted
362	362	9 in accordance with the standards set forth in this Act, or
363	363	10 other research conducted in accordance with applicable
364	364	11 law;
365	365	12 (6) Information and documents created for purposes of
366	366	13 the Health Care Quality Improvement Act of 1986, 42 U.S.C.
367	367	14 11101 et seq.;
368	368	15 (7) Patient safety work product for purposes of the
369	369	16 Patient Safety and Quality Improvement Act, 42 U.S.C.
370	370	17 299b-21 et seq., as amended;
371	371	18 (8) Information derived from any of the health care
372	372	19 related information listed in this subsection that is
373	373	20 deidentified in accordance with the requirements for
374	374	21 de-identification pursuant to HIPAA;
375	375	22 (9) Information originating from and intermingled to
376	376	23 be indistinguishable with, or information treated in the
377	377	24 same manner as, information exempt under this Section that
378	378	25 is maintained by a covered entity or business associate,
379	379	26 program or qualified service organization, as specified in
380	380
381	381
382	382
383	383
384	384
385	385	HB5581 - 10 - LRB103 38323 JRC 68458 b
386	386
387	387
388	388	HB5581- 11 -LRB103 38323 JRC 68458 b HB5581 - 11 - LRB103 38323 JRC 68458 b
389	389	HB5581 - 11 - LRB103 38323 JRC 68458 b
390	390	1 42 U.S.C. 290dd-2, as amended;
391	391	2 (10) Information used for public health activities and
392	392	3 purposes as authorized by HIPAA, community health
393	393	4 activities and population health activities;
394	394	5 (11) The collection, maintenance, disclosure, sale,
395	395	6 communication or use of any personal information bearing
396	396	7 on a consumer's credit worthiness, credit standing, credit
397	397	8 capacity, character, general reputation, personal
398	398	9 characteristics or mode of living by a consumer reporting
399	399	10 agency, furnisher or user that provides information for
400	400	11 use in a consumer report, and by a user of a consumer
401	401	12 report, but only to the extent that such activity is
402	402	13 regulated by and authorized under the Fair Credit
403	403	14 Reporting Act, 15 U.S.C. 1681 et seq.;
404	404	15 (12) Personal data collected, processed, sold or
405	405	16 disclosed in compliance with the Driver's Privacy
406	406	17 Protection Act of 1994, 18 U.S.C. 2721 et seq., as
407	407	18 amended;
408	408	19 (13) Personal data regulated by the Family Educational
409	409	20 Rights and Privacy Act, 20 U.S.C. 1232g et seq., as
410	410	21 amended;
411	411	22 (14) Personal data collected, processed, sold or
412	412	23 disclosed in compliance with the Farm Credit Act, 12
413	413	24 U.S.C. 2001 et seq., as amended;
414	414	25 (15) Data processed or maintained in the course of an
415	415	26 individual applying to, employed by or acting as an agent
416	416
417	417
418	418
419	419
420	420
421	421	HB5581 - 11 - LRB103 38323 JRC 68458 b
422	422
423	423
424	424	HB5581- 12 -LRB103 38323 JRC 68458 b HB5581 - 12 - LRB103 38323 JRC 68458 b
425	425	HB5581 - 12 - LRB103 38323 JRC 68458 b
426	426	1 or independent contractor of a controller, processor or
427	427	2 third party, to the extent that the data is collected and
428	428	3 used within the context of that role; as the emergency
429	429	4 contact information of an individual under this Act used
430	430	5 for emergency contact purposes; or that is necessary to
431	431	6 retain to administer benefits for another individual
432	432	7 relating to the individual who is the subject of the
433	433	8 information under HIPAA and used for the purposes of
434	434	9 administering such benefits;
435	435	10 (16) Personal data collected, processed, sold or
436	436	11 disclosed in relation to price, route or service, as such
437	437	12 terms are used in the Airline Deregulation Act, 49 U.S.C.
438	438	13 40101 et seq., as amended, by an air carrier subject to the
439	439	14 act, to the extent this Act is preempted by the Airline
440	440	15 Deregulation Act, 49 U.S.C. 41713, as amended;
441	441	16 (17) Personal information maintained or used for
442	442	17 purposes of compliance with the regulation of listed
443	443	18 chemicals under the federal Controlled Substances Act, 21
444	444	19 U.S.C. 830; and
445	445	20 (18) Information included in a limited data set as
446	446	21 described at 45 CFR 164.514(e), to the extent that the
447	447	22 information is used, disclosed, and maintained in the
448	448	23 manner specified at 45 CFR 164.514(e).
449	449	24 (c) Controllers and processors that comply with the
450	450	25 verifiable parental consent requirements of COPPA shall be
451	451	26 compliant with any obligation to obtain parental consent
452	452
453	453
454	454
455	455
456	456
457	457	HB5581 - 12 - LRB103 38323 JRC 68458 b
458	458
459	459
460	460	HB5581- 13 -LRB103 38323 JRC 68458 b HB5581 - 13 - LRB103 38323 JRC 68458 b
461	461	HB5581 - 13 - LRB103 38323 JRC 68458 b
462	462	1 pursuant to this Act.
463	463	2 Section 20. Consumer expectation of privacy.
464	464	3 (a) A consumer has the right to:
465	465	4 (1) Confirm whether or not a controller is processing
466	466	5 the consumer's personal data and access such personal
467	467	6 data, unless such confirmation or access would require the
468	468	7 controller to reveal a trade secret;
469	469	8 (2) Correct inaccuracies in the consumer's personal
470	470	9 data, taking into account the nature of the personal data
471	471	10 and the purposes of the processing of the consumer's
472	472	11 personal data;
473	473	12 (3) Delete personal data provided by, or obtained
474	474	13 about, the consumer;
475	475	14 (4) Obtain a copy of the consumer's personal data
476	476	15 processed by the controller, in a portable and, to the
477	477	16 extent technically feasible, readily usable format that
478	478	17 allows the consumer to transmit the data to another
479	479	18 controller without hindrance, where the processing is
480	480	19 carried out by automated means, provided such controller
481	481	20 shall not be required to reveal any trade secret; and
482	482	21 (5) Opt out of the processing of the personal data for
483	483	22 purposes of targeted advertising, the sale of personal
484	484	23 data, except as provided in Section 30, or profiling in
485	485	24 furtherance of solely automated decisions that produce
486	486	25 legal or similarly significant effects concerning the
487	487
488	488
489	489
490	490
491	491
492	492	HB5581 - 13 - LRB103 38323 JRC 68458 b
493	493
494	494
495	495	HB5581- 14 -LRB103 38323 JRC 68458 b HB5581 - 14 - LRB103 38323 JRC 68458 b
496	496	HB5581 - 14 - LRB103 38323 JRC 68458 b
497	497	1 consumer.
498	498	2 (b) A consumer may exercise rights under this Section by a
499	499	3 secure and reliable means established by the Secretary of
500	500	4 State and described to the consumer in the controller's
501	501	5 privacy notice. A consumer may designate an authorized agent
502	502	6 in accordance with Section 25 to exercise the rights of such
503	503	7 consumer to opt out of the processing of such consumer's
504	504	8 personal data for purposes of paragraph (5) of subsection (a)
505	505	9 on behalf of the consumer. In the case of processing personal
506	506	10 data of a known child, the parent or legal guardian may
507	507	11 exercise such consumer rights on the child's behalf. In the
508	508	12 case of processing personal data concerning a consumer subject
509	509	13 to a guardianship, conservatorship, or other protective
510	510	14 arrangement, the guardian or the conservator of the consumer
511	511	15 may exercise such rights on the consumer's behalf.
512	512	16 (c) Except as otherwise provided in this Act, a controller
513	513	17 shall comply with a request by a consumer to exercise the
514	514	18 consumer rights authorized pursuant to this Act as follows:
515	515	19 (1) A controller shall respond to the consumer without
516	516	20 undue delay, but not later than 45 days after receipt of
517	517	21 the request. The controller may extend the response period
518	518	22 by 45 additional days when reasonably necessary,
519	519	23 considering the complexity and number of the consumer's
520	520	24 requests, provided the controller informs the consumer of
521	521	25 any such extension within the initial 45-day response
522	522	26 period and of the reason for the extension.
523	523
524	524
525	525
526	526
527	527
528	528	HB5581 - 14 - LRB103 38323 JRC 68458 b
529	529
530	530
531	531	HB5581- 15 -LRB103 38323 JRC 68458 b HB5581 - 15 - LRB103 38323 JRC 68458 b
532	532	HB5581 - 15 - LRB103 38323 JRC 68458 b
533	533	1 (2) If a controller declines to take action regarding
534	534	2 the consumer's request, the controller shall inform the
535	535	3 consumer without undue delay, but not later than 45 days
536	536	4 after receipt of the request, of the justification for
537	537	5 declining to take action and instructions for how to
538	538	6 appeal the decision.
539	539	7 (3) Information provided in response to a consumer
540	540	8 request shall be provided by a controller, free of charge,
541	541	9 once per consumer during any 12-month period. If requests
542	542	10 from a consumer are manifestly unfounded, excessive or
543	543	11 repetitive, the controller may charge the consumer a
544	544	12 reasonable fee to cover the administrative costs of
545	545	13 complying with the request or decline to act on the
546	546	14 request. The controller bears the burden of demonstrating
547	547	15 the manifestly unfounded, excessive or repetitive nature
548	548	16 of the request.
549	549	17 (4) If a controller is unable to authenticate a
550	550	18 request to exercise any of the rights afforded under
551	551	19 paragraphs (1) through (4) of subsection (a) using
552	552	20 commercially reasonable efforts, the controller shall not
553	553	21 be required to comply with a request to initiate an action
554	554	22 pursuant to this Section and shall provide notice to the
555	555	23 consumer that the controller is unable to authenticate the
556	556	24 request to exercise such right or rights until such
557	557	25 consumer provides additional information reasonably
558	558	26 necessary to authenticate such consumer and such
559	559
560	560
561	561
562	562
563	563
564	564	HB5581 - 15 - LRB103 38323 JRC 68458 b
565	565
566	566
567	567	HB5581- 16 -LRB103 38323 JRC 68458 b HB5581 - 16 - LRB103 38323 JRC 68458 b
568	568	HB5581 - 16 - LRB103 38323 JRC 68458 b
569	569	1 consumer's request to exercise such right or rights. A
570	570	2 controller shall not be required to authenticate an
571	571	3 opt-out request, but a controller may deny an opt-out
572	572	4 request if the controller has a good faith, reasonable and
573	573	5 documented belief that such request is fraudulent. If a
574	574	6 controller denies an opt-out request because the
575	575	7 controller believes such request is fraudulent, the
576	576	8 controller shall send a notice to the person who made such
577	577	9 request disclosing that such controller believes such
578	578	10 request is fraudulent, why such controller believes such
579	579	11 request is fraudulent and that such controller shall not
580	580	12 comply with such request.
581	581	13 (5) A controller that has obtained personal data about
582	582	14 a consumer from a source other than the consumer shall be
583	583	15 deemed in compliance with a consumer's request to delete
584	584	16 such data pursuant to paragraph (3) of subsection (a) by
585	585	17 retaining a record of the deletion request and the minimum
586	586	18 data necessary for the purpose of ensuring the consumer's
587	587	19 personal data remains deleted from the controller's
588	588	20 records and not using such retained data for any other
589	589	21 purpose pursuant to this Act, or opting the consumer out
590	590	22 of the processing of such personal data for any purpose
591	591	23 except for those exempted pursuant this Act.
592	592	24 (d) A controller shall establish a process for a consumer
593	593	25 to appeal the controller's refusal to take action on a request
594	594	26 within a reasonable period of time after the consumer's
595	595
596	596
597	597
598	598
599	599
600	600	HB5581 - 16 - LRB103 38323 JRC 68458 b
601	601
602	602
603	603	HB5581- 17 -LRB103 38323 JRC 68458 b HB5581 - 17 - LRB103 38323 JRC 68458 b
604	604	HB5581 - 17 - LRB103 38323 JRC 68458 b
605	605	1 receipt of the decision. The appeal process shall be
606	606	2 conspicuously available and similar to the process for
607	607	3 submitting requests to initiate action pursuant to this
608	608	4 Section. Not later than 60 days after receipt of an appeal, a
609	609	5 controller shall inform the consumer in writing of any action
610	610	6 taken or not taken in response to the appeal, including a
611	611	7 written explanation of the reasons for the decisions. If the
612	612	8 appeal is denied, the controller shall also provide the
613	613	9 consumer with an online mechanism, if available, or other
614	614	10 method through which the consumer may contact the Attorney
615	615	11 General to submit a complaint.
616	616	12 Section 25. Consumer agents. A consumer may designate
617	617	13 another person to serve as the consumer's authorized agent,
618	618	14 and act on such consumer's behalf, to opt out of the processing
619	619	15 of such consumer's personal data for one or more of the
620	620	16 purposes specified in paragraph (5) of subsection (a) of
621	621	17 Section 20. The consumer may designate such authorized agent
622	622	18 by way of, among other things, a technology, including, but
623	623	19 not limited to, an Internet link or a browser setting, browser
624	624	20 extension or global device setting, indicating such consumer's
625	625	21 intent to opt out of such processing. A controller shall
626	626	22 comply with an opt-out request received from an authorized
627	627	23 agent if the controller is able to verify, with commercially
628	628	24 reasonable effort, the identity of the consumer and the
629	629	25 authorized agent's authority to act on such consumer's behalf.
630	630
631	631
632	632
633	633
634	634
635	635	HB5581 - 17 - LRB103 38323 JRC 68458 b
636	636
637	637
638	638	HB5581- 18 -LRB103 38323 JRC 68458 b HB5581 - 18 - LRB103 38323 JRC 68458 b
639	639	HB5581 - 18 - LRB103 38323 JRC 68458 b
640	640	1 Section 30. Controller responsibilities.
641	641	2 (a) A controller shall:
642	642	3 (1) Limit the collection of personal data to what is
643	643	4 adequate, relevant and reasonably necessary in relation to
644	644	5 the purposes for which such data is processed, as
645	645	6 disclosed to the consumer;
646	646	7 (2) Except as otherwise provided in this Act, not
647	647	8 process personal data for purposes that are neither
648	648	9 reasonably necessary to, nor compatible with, the
649	649	10 disclosed purposes for which such personal data is
650	650	11 processed, as disclosed to the consumer, unless the
651	651	12 controller obtains the consumer's consent;
652	652	13 (3) Establish, implement and maintain reasonable
653	653	14 administrative, technical and physical data security
654	654	15 practices to protect the confidentiality, integrity and
655	655	16 accessibility of personal data appropriate to the volume
656	656	17 and nature of the personal data at issue;
657	657	18 (4) Not process sensitive data concerning a consumer
658	658	19 without obtaining the consumer's consent, or, in the case
659	659	20 of the processing of sensitive data concerning a known
660	660	21 child, without processing such data in accordance with
661	661	22 COPPA;
662	662	23 (5) Not process personal data in violation of the laws
663	663	24 of this State and federal laws that prohibit unlawful
664	664	25 discrimination against consumers;
665	665
666	666
667	667
668	668
669	669
670	670	HB5581 - 18 - LRB103 38323 JRC 68458 b
671	671
672	672
673	673	HB5581- 19 -LRB103 38323 JRC 68458 b HB5581 - 19 - LRB103 38323 JRC 68458 b
674	674	HB5581 - 19 - LRB103 38323 JRC 68458 b
675	675	1 (6) Provide an effective mechanism for a consumer to
676	676	2 revoke the consumer's consent under this Section that is
677	677	3 at least as easy as the mechanism by which the consumer
678	678	4 provided the consumer's consent and, upon revocation of
679	679	5 such consent, cease to process the data as soon as
680	680	6 practicable, but not later than 15 days after the receipt
681	681	7 of such request; and
682	682	8 (7) Not process the personal data of a consumer for
683	683	9 purposes of targeted advertising, or sell the consumer's
684	684	10 personal data without the consumer's consent, under
685	685	11 circumstances where a controller has actual knowledge, and
686	686	12 willfully disregards, that the consumer is at least 13
687	687	13 years of age but younger than 16 years of age. A controller
688	688	14 shall not discriminate against a consumer for exercising
689	689	15 any of the consumer rights contained in this Act,
690	690	16 including denying goods or services, charging different
691	691	17 prices or rates for goods or services or providing a
692	692	18 different level of quality of goods or services to the
693	693	19 consumer.
694	694	20 (b) Nothing in this Section shall be construed to require
695	695	21 a controller to provide a product or service that requires the
696	696	22 personal data of a consumer which the controller does not
697	697	23 collect or maintain, or prohibit a controller from offering a
698	698	24 different price, rate, level, quality or selection of goods or
699	699	25 services to a consumer, including offering goods or services
700	700	26 for no fee, if the offering is in connection with a consumer's
701	701
702	702
703	703
704	704
705	705
706	706	HB5581 - 19 - LRB103 38323 JRC 68458 b
707	707
708	708
709	709	HB5581- 20 -LRB103 38323 JRC 68458 b HB5581 - 20 - LRB103 38323 JRC 68458 b
710	710	HB5581 - 20 - LRB103 38323 JRC 68458 b
711	711	1 voluntary participation in a bona fide loyalty, rewards,
712	712	2 premium features, discounts or club card program.
713	713	3 (c) A controller shall provide consumers with a reasonably
714	714	4 accessible, clear and meaningful privacy notice meeting
715	715	5 standards established by the Secretary of State that includes:
716	716	6 (1) The categories of personal data processed by the
717	717	7 controller;
718	718	8 (2) The purpose for processing personal data;
719	719	9 (3) How consumers may exercise their consumer rights,
720	720	10 including how a consumer may appeal a controller's
721	721	11 decision with regard to the consumer's request;
722	722	12 (4) The categories of personal data that the
723	723	13 controller shares with third parties, if any;
724	724	14 (5) The categories of third parties, if any, with
725	725	15 which the controller shares personal data; and
726	726	16 (6) An active electronic mail address or other online
727	727	17 mechanism that the consumer may use to contact the
728	728	18 controller.
729	729	19 (d) If a controller sells personal data to third parties
730	730	20 or processes personal data for targeted advertising, the
731	731	21 controller shall clearly and conspicuously disclose such
732	732	22 processing, as well as the manner in which a consumer may
733	733	23 exercise the right to opt out of such processing.
734	734	24 (e) A controller shall establish, and shall describe in a
735	735	25 privacy notice, consistent with the requirements of the
736	736	26 Secretary of State, one or more secure and reliable means for
737	737
738	738
739	739
740	740
741	741
742	742	HB5581 - 20 - LRB103 38323 JRC 68458 b
743	743
744	744
745	745	HB5581- 21 -LRB103 38323 JRC 68458 b HB5581 - 21 - LRB103 38323 JRC 68458 b
746	746	HB5581 - 21 - LRB103 38323 JRC 68458 b
747	747	1 consumers to submit a request to exercise their consumer
748	748	2 rights pursuant to this Act. Such means shall take into
749	749	3 account the ways in which consumers normally interact with the
750	750	4 controller, the need for secure and reliable communication of
751	751	5 such requests and the ability of the controller to verify the
752	752	6 identity of the consumer making the request. A controller
753	753	7 shall not require a consumer to create a new account in order
754	754	8 to exercise consumer rights, but may require a consumer to use
755	755	9 an existing account. Any such means shall include:
756	756	10 (1) Providing a clear and conspicuous link on the
757	757	11 controller's Internet website to an Internet web page that
758	758	12 enables a consumer, or an agent of the consumer, to opt out
759	759	13 of the targeted advertising or sale of the consumer's
760	760	14 personal data; and
761	761	15 (2) Not later than January 1, 2025, allowing a
762	762	16 consumer to opt out of any processing of the consumer's
763	763	17 personal data for the purposes of targeted advertising, or
764	764	18 any sale of such personal data, through an opt-out
765	765	19 preference signal sent, with such consumer's consent, by a
766	766	20 platform, technology or mechanism to the controller,
767	767	21 indicating such consumer's intent to opt out of any such
768	768	22 processing or sale. Such platform, technology or mechanism
769	769	23 shall:
770	770	24 (A) Not unfairly disadvantage another controller;
771	771	25 (B) Not make use of a default setting, but,
772	772	26 rather, require the consumer to make an affirmative,
773	773
774	774
775	775
776	776
777	777
778	778	HB5581 - 21 - LRB103 38323 JRC 68458 b
779	779
780	780
781	781	HB5581- 22 -LRB103 38323 JRC 68458 b HB5581 - 22 - LRB103 38323 JRC 68458 b
782	782	HB5581 - 22 - LRB103 38323 JRC 68458 b
783	783	1 freely given and unambiguous choice to opt out of any
784	784	2 processing of such consumer's personal data pursuant
785	785	3 to this Act;
786	786	4 (C) Be consumer-friendly and easy to use by the
787	787	5 average consumer;
788	788	6 (D) Be as consistent as possible with any other
789	789	7 similar platform, technology or mechanism required by
790	790	8 any federal or State law or regulation; and
791	791	9 (E) Enable the controller to accurately determine
792	792	10 whether the consumer is a resident of this State and
793	793	11 whether the consumer has made a legitimate request to
794	794	12 opt out of any sale of such consumer's personal data or
795	795	13 targeted advertising.
796	796	14 (3) If a consumer's decision to opt out of any
797	797	15 processing of the consumer's personal data for the
798	798	16 purposes of targeted advertising, or any sale of such
799	799	17 personal data, through an opt-out preference signal sent
800	800	18 in accordance with this subsection (e) conflicts with the
801	801	19 consumer's existing controller-specific privacy setting or
802	802	20 voluntary participation in a controller's bona fide
803	803	21 loyalty, rewards, premium features, discounts or club card
804	804	22 program, the controller shall comply with such consumer's
805	805	23 opt-out preference signal but may notify such consumer of
806	806	24 such conflict and provide to such consumer the choice to
807	807	25 confirm such controller-specific privacy setting or
808	808	26 participation in such program.
809	809
810	810
811	811
812	812
813	813
814	814	HB5581 - 22 - LRB103 38323 JRC 68458 b
815	815
816	816
817	817	HB5581- 23 -LRB103 38323 JRC 68458 b HB5581 - 23 - LRB103 38323 JRC 68458 b
818	818	HB5581 - 23 - LRB103 38323 JRC 68458 b
819	819	1 (e-5) If a controller responds to consumer opt-out
820	820	2 requests received pursuant to subsection (e) by informing the
821	821	3 consumer of a charge for the use of any product or service, the
822	822	4 controller shall present the terms of any financial incentive
823	823	5 offered pursuant to this Section for the retention, use, sale
824	824	6 or sharing of the consumer's personal data.
825	825	7 Section 35. Processor responsibilities.
826	826	8 (a) A processor shall adhere to the instructions of a
827	827	9 controller and shall assist the controller in meeting the
828	828	10 controller's obligations under this Act. Such assistance shall
829	829	11 include:
830	830	12 (1) Taking into account the nature of processing and
831	831	13 the information available to the processor, by appropriate
832	832	14 technical and organizational measures, insofar as is
833	833	15 reasonably practicable, to fulfill the controller's
834	834	16 obligation to respond to consumer rights requests;
835	835	17 (2) Taking into account the nature of processing and
836	836	18 the information available to the processor, by assisting
837	837	19 the controller in meeting the controller's obligations in
838	838	20 relation to the security of processing the personal data
839	839	21 and in relation to the notification of a breach of
840	840	22 security or of the system of the processor, in order to
841	841	23 meet the controller's obligations; and
842	842	24 (3) Providing necessary information to enable the
843	843	25 controller to conduct and document data protection
844	844
845	845
846	846
847	847
848	848
849	849	HB5581 - 23 - LRB103 38323 JRC 68458 b
850	850
851	851
852	852	HB5581- 24 -LRB103 38323 JRC 68458 b HB5581 - 24 - LRB103 38323 JRC 68458 b
853	853	HB5581 - 24 - LRB103 38323 JRC 68458 b
854	854	1 assessments.
855	855	2 (b) A contract between a controller and a processor shall
856	856	3 govern the processor's data processing procedures with respect
857	857	4 to processing performed on behalf of the controller. The
858	858	5 contract shall be binding and clearly set forth instructions
859	859	6 for processing data, the nature and purpose of processing, the
860	860	7 type of data subject to processing, the duration of processing
861	861	8 and the rights and obligations of both parties. The contract
862	862	9 shall also require that the processor:
863	863	10 (1) Ensure that each person processing personal data
864	864	11 is subject to a duty of confidentiality with respect to
865	865	12 the data;
866	866	13 (2) At the controller's direction, delete or return
867	867	14 all personal data to the controller as requested at the
868	868	15 end of the provision of services, unless retention of the
869	869	16 personal data is required by law;
870	870	17 (3) Upon the reasonable request of the controller,
871	871	18 make available to the controller all information in its
872	872	19 possession necessary to demonstrate the processor's
873	873	20 compliance with the obligations in this Act;
874	874	21 (4) After providing the controller an opportunity to
875	875	22 object, engage any subcontractor pursuant to a written
876	876	23 contract that requires the subcontractor to meet the
877	877	24 obligations of the processor with respect to the personal
878	878	25 data; and
879	879	26 (5) Allow, and cooperate with, reasonable assessments
880	880
881	881
882	882
883	883
884	884
885	885	HB5581 - 24 - LRB103 38323 JRC 68458 b
886	886
887	887
888	888	HB5581- 25 -LRB103 38323 JRC 68458 b HB5581 - 25 - LRB103 38323 JRC 68458 b
889	889	HB5581 - 25 - LRB103 38323 JRC 68458 b
890	890	1 by the controller or the controller's designated assessor,
891	891	2 or the processor may arrange for a qualified and
892	892	3 independent assessor to conduct an assessment of the
893	893	4 processor's policies and technical and organizational
894	894	5 measures in support of the obligations under this Act,
895	895	6 using an appropriate and accepted control standard or
896	896	7 framework and assessment procedure for such assessments.
897	897	8 The processor shall provide a report of such assessment to
898	898	9 the controller upon request.
899	899	10 (c) Nothing in this Section shall be construed to relieve
900	900	11 a controller or processor from the liabilities imposed on the
901	901	12 controller or processor by virtue of such controller's or
902	902	13 processor's role in the processing relationship, as described
903	903	14 in this Act.
904	904	15 (d) Determining whether a person is acting as a controller
905	905	16 or processor with respect to a specific processing of data is a
906	906	17 fact-based determination that depends upon the context in
907	907	18 which personal data is to be processed. A person who is not
908	908	19 limited in such person's processing of personal data pursuant
909	909	20 to a controller's instructions, or who fails to adhere to such
910	910	21 instructions, is a controller and not a processor with respect
911	911	22 to a specific processing of data. A processor that continues
912	912	23 to adhere to a controller's instructions with respect to a
913	913	24 specific processing of personal data remains a processor. If a
914	914	25 processor begins, alone or jointly with others, determining
915	915	26 the purposes and means of the processing of personal data, the
916	916
917	917
918	918
919	919
920	920
921	921	HB5581 - 25 - LRB103 38323 JRC 68458 b
922	922
923	923
924	924	HB5581- 26 -LRB103 38323 JRC 68458 b HB5581 - 26 - LRB103 38323 JRC 68458 b
925	925	HB5581 - 26 - LRB103 38323 JRC 68458 b
926	926	1 processor is a controller with respect to such processing and
927	927	2 may be subject to an enforcement action Section 55.
928	928	3 Section 40. Heightened risk of harm.
929	929	4 (a) A controller shall conduct and document a data
930	930	5 protection assessment for each of the controller's processing
931	931	6 activities that presents a heightened risk of harm to a
932	932	7 consumer. For the purposes of this Section, processing that
933	933	8 presents a heightened risk of harm to a consumer includes:
934	934	9 (1) The processing of personal data for the purposes
935	935	10 of targeted advertising;
936	936	11 (2) The sale of personal data;
937	937	12 (3) The processing of personal data for the purposes
938	938	13 of profiling, where such profiling presents a reasonably
939	939	14 foreseeable risk of unfair or deceptive treatment of, or
940	940	15 unlawful disparate impact on, consumers, financial,
941	941	16 physical or reputational injury to consumers, a physical
942	942	17 or other intrusion upon the solitude or seclusion, or the
943	943	18 private affairs or concerns, of consumers, where such
944	944	19 intrusion would be offensive to a reasonable person, or
945	945	20 other substantial injury to consumers; and
946	946	21 (4) The processing of sensitive data.
947	947	22 (b) Data protection assessments conducted pursuant to
948	948	23 subsection (a) shall identify and weigh the benefits that may
949	949	24 flow, directly and indirectly, from the processing to the
950	950	25 controller, the consumer, other stakeholders and the public
951	951
952	952
953	953
954	954
955	955
956	956	HB5581 - 26 - LRB103 38323 JRC 68458 b
957	957
958	958
959	959	HB5581- 27 -LRB103 38323 JRC 68458 b HB5581 - 27 - LRB103 38323 JRC 68458 b
960	960	HB5581 - 27 - LRB103 38323 JRC 68458 b
961	961	1 against the potential risks to the rights of the consumer
962	962	2 associated with such processing, as mitigated by safeguards
963	963	3 that can be employed by the controller to reduce such risks.
964	964	4 The controller shall factor into any such data protection
965	965	5 assessment the use of deidentified data and the reasonable
966	966	6 expectations of consumers, as well as the context of the
967	967	7 processing and the relationship between the controller and the
968	968	8 consumer whose personal data will be processed.
969	969	9 (c) The Attorney General may require that a controller
970	970	10 disclose any data protection assessment that is relevant to an
971	971	11 investigation conducted by the Attorney General, and the
972	972	12 controller shall make the data protection assessment available
973	973	13 to the Attorney General. The Attorney General may evaluate the
974	974	14 data protection assessment for compliance with the
975	975	15 responsibilities set forth in this Act. Data protection
976	976	16 assessments shall be confidential and shall be exempt from
977	977	17 disclosure under 5 ILCS 120. To the extent any information
978	978	18 contained in a data protection assessment disclosed to the
979	979	19 Attorney General includes information subject to
980	980	20 attorney-client privilege or work product protection, such
981	981	21 disclosure shall not constitute a waiver of such privilege or
982	982	22 protection.
983	983	23 (d) A single data protection assessment may address a
984	984	24 comparable set of processing operations that include similar
985	985	25 activities.
986	986	26 (e) If a controller conducts a data protection assessment
987	987
988	988
989	989
990	990
991	991
992	992	HB5581 - 27 - LRB103 38323 JRC 68458 b
993	993
994	994
995	995	HB5581- 28 -LRB103 38323 JRC 68458 b HB5581 - 28 - LRB103 38323 JRC 68458 b
996	996	HB5581 - 28 - LRB103 38323 JRC 68458 b
997	997	1 for the purpose of complying with another applicable law or
998	998	2 regulation, the data protection assessment shall be deemed to
999	999	3 satisfy the requirements established in this Section if such
1000	1000	4 data protection assessment is reasonably similar in scope and
1001	1001	5 effect to the data protection assessment that would otherwise
1002	1002	6 be conducted pursuant to this Section.
1003	1003	7 (f) Data protection assessment requirements shall apply to
1004	1004	8 processing activities created or generated after July 1, 2024,
1005	1005	9 and are not retroactive.
1006	1006	10 Section 45. Deidentified data.
1007	1007	11 (a) Any controller in possession of deidentified data
1008	1008	12 shall:
1009	1009	13 (1) Take reasonable measures to ensure that the data
1010	1010	14 cannot be associated with an individual;
1011	1011	15 (2) Publicly commit to maintaining and using
1012	1012	16 deidentified data without attempting to reidentify the
1013	1013	17 data; and
1014	1014	18 (3) Contractually obligate any recipients of the
1015	1015	19 deidentified data to comply with all provisions of this
1016	1016	20 Act.
1017	1017	21 (b) Nothing in this Act shall be construed to:
1018	1018	22 (1) Require a controller or processor to reidentify
1019	1019	23 deidentified data or pseudonymous data; or
1020	1020	24 (2) Maintain data in identifiable form, or collect,
1021	1021	25 obtain, retain, or access any data or technology, in order
1022	1022
1023	1023
1024	1024
1025	1025
1026	1026
1027	1027	HB5581 - 28 - LRB103 38323 JRC 68458 b
1028	1028
1029	1029
1030	1030	HB5581- 29 -LRB103 38323 JRC 68458 b HB5581 - 29 - LRB103 38323 JRC 68458 b
1031	1031	HB5581 - 29 - LRB103 38323 JRC 68458 b
1032	1032	1 to be capable of associating an authenticated consumer
1033	1033	2 request with personal data.
1034	1034	3 (c) Nothing in this Act shall be construed to require a
1035	1035	4 controller or processor to comply with an authenticated
1036	1036	5 consumer rights request if the controller:
1037	1037	6 (1) Is not reasonably capable of associating the
1038	1038	7 request with the personal data or it would be unreasonably
1039	1039	8 burdensome for the controller to associate the request
1040	1040	9 with the personal data;
1041	1041	10 (2) Does not use the personal data to recognize or
1042	1042	11 respond to the specific consumer who is the subject of the
1043	1043	12 personal data, or associate the personal data with other
1044	1044	13 personal data about the same specific consumer; and
1045	1045	14 (3) Does not sell the personal data to any third party
1046	1046	15 or otherwise voluntarily disclose the personal data to any
1047	1047	16 third party other than a processor, except as otherwise
1048	1048	17 permitted in this Section.
1049	1049	18 (d) The rights afforded under paragraphs (1) through (4)
1050	1050	19 of subsection (a) of Section 20 shall not apply to
1051	1051	20 pseudonymized data in cases where the controller is able to
1052	1052	21 demonstrate that any information necessary to identify the
1053	1053	22 consumer is kept separately and is subject to effective
1054	1054	23 technical and organizational controls that prevent the
1055	1055	24 controller from accessing such information.
1056	1056	25 (e) A controller that discloses pseudonymous data or
1057	1057	26 deidentified data shall exercise reasonable oversight to
1058	1058
1059	1059
1060	1060
1061	1061
1062	1062
1063	1063	HB5581 - 29 - LRB103 38323 JRC 68458 b
1064	1064
1065	1065
1066	1066	HB5581- 30 -LRB103 38323 JRC 68458 b HB5581 - 30 - LRB103 38323 JRC 68458 b
1067	1067	HB5581 - 30 - LRB103 38323 JRC 68458 b
1068	1068	1 monitor compliance with any contractual commitments to which
1069	1069	2 the pseudonymous data or deidentified data is subject and
1070	1070	3 shall take appropriate steps to address any breaches of those
1071	1071	4 contractual commitments.
1072	1072	5 Section 50. Controller responsibilities and obligations.
1073	1073	6 (a) Nothing in this Act shall be construed to restrict a
1074	1074	7 controller's or processor's ability to:
1075	1075	8 (1) Comply with federal, State or municipal ordinances
1076	1076	9 or regulations;
1077	1077	10 (2) Comply with a civil, criminal or regulatory
1078	1078	11 inquiry, investigation, subpoena or summons by federal,
1079	1079	12 State, municipal or other governmental authorities;
1080	1080	13 (3) Cooperate with law enforcement agencies concerning
1081	1081	14 conduct or activity that the controller or processor
1082	1082	15 reasonably and in good faith believes may violate federal,
1083	1083	16 State or municipal ordinances or regulations;
1084	1084	17 (4) Investigate, establish, exercise, prepare for or
1085	1085	18 defend legal claims;
1086	1086	19 (5) Provide a product or service specifically
1087	1087	20 requested by a consumer;
1088	1088	21 (6) Perform under a contract to which a consumer is a
1089	1089	22 party, including fulfilling the terms of a written
1090	1090	23 warranty;
1091	1091	24 (7) Take steps at the request of a consumer prior to
1092	1092	25 entering into a contract;
1093	1093
1094	1094
1095	1095
1096	1096
1097	1097
1098	1098	HB5581 - 30 - LRB103 38323 JRC 68458 b
1099	1099
1100	1100
1101	1101	HB5581- 31 -LRB103 38323 JRC 68458 b HB5581 - 31 - LRB103 38323 JRC 68458 b
1102	1102	HB5581 - 31 - LRB103 38323 JRC 68458 b
1103	1103	1 (8) Take immediate steps to protect an interest that
1104	1104	2 is essential for the life or physical safety of the
1105	1105	3 consumer or another individual, and where the processing
1106	1106	4 cannot be manifestly based on another legal basis;
1107	1107	5 (9) Prevent, detect, protect against or respond to
1108	1108	6 security incidents, identity theft, fraud, harassment,
1109	1109	7 malicious or deceptive activities or any illegal activity,
1110	1110	8 preserve the integrity or security of systems or
1111	1111	9 investigate, report or prosecute those responsible for any
1112	1112	10 such action;
1113	1113	11 (10) Engage in public or peer-reviewed scientific or
1114	1114	12 statistical research in the public interest that adheres
1115	1115	13 to all other applicable ethics and privacy laws and is
1116	1116	14 approved, monitored and governed by an institutional
1117	1117	15 review board that determines, or similar independent
1118	1118	16 oversight entities that determine:
1119	1119	17 (A) Whether the deletion of the information is
1120	1120	18 likely to provide substantial benefits that do not
1121	1121	19 exclusively accrue to the controller,
1122	1122	20 (B) The expected benefits of the research outweigh
1123	1123	21 the privacy risks, and
1124	1124	22 (C) Whether the controller has implemented
1125	1125	23 reasonable safeguards to mitigate privacy risks
1126	1126	24 associated with research, including any risks
1127	1127	25 associated with reidentification;
1128	1128	26 (11) Assist another controller, processor, or third
1129	1129
1130	1130
1131	1131
1132	1132
1133	1133
1134	1134	HB5581 - 31 - LRB103 38323 JRC 68458 b
1135	1135
1136	1136
1137	1137	HB5581- 32 -LRB103 38323 JRC 68458 b HB5581 - 32 - LRB103 38323 JRC 68458 b
1138	1138	HB5581 - 32 - LRB103 38323 JRC 68458 b
1139	1139	1 party with any of the obligations under this Act; or
1140	1140	2 (12) Process personal data for reasons of public
1141	1141	3 interest in the area of public health, community health or
1142	1142	4 population health, but solely to the extent that such
1143	1143	5 processing is:
1144	1144	6 (A) Subject to suitable and specific measures to
1145	1145	7 safeguard the rights of the consumer whose personal
1146	1146	8 data is being processed, and
1147	1147	9 (B) Under the responsibility of a professional
1148	1148	10 subject to confidentiality obligations under federal,
1149	1149	11 State or local law.
1150	1150	12 (b) The obligations imposed on controllers or processors
1151	1151	13 under this Act shall not restrict a controller's or
1152	1152	14 processor's ability to collect, use or retain data for
1153	1153	15 internal use to:
1154	1154	16 (1) Conduct internal research to develop, improve or
1155	1155	17 repair products, services or technology;
1156	1156	18 (2) Effectuate a product recall;
1157	1157	19 (3) Identify and repair technical errors that impair
1158	1158	20 existing or intended functionality; or
1159	1159	21 (4) Perform internal operations that are reasonably
1160	1160	22 aligned with the expectations of the consumer or
1161	1161	23 reasonably anticipated based on the consumer's existing
1162	1162	24 relationship with the controller, or are otherwise
1163	1163	25 compatible with processing data in furtherance of the
1164	1164	26 provision of a product or service specifically requested
1165	1165
1166	1166
1167	1167
1168	1168
1169	1169
1170	1170	HB5581 - 32 - LRB103 38323 JRC 68458 b
1171	1171
1172	1172
1173	1173	HB5581- 33 -LRB103 38323 JRC 68458 b HB5581 - 33 - LRB103 38323 JRC 68458 b
1174	1174	HB5581 - 33 - LRB103 38323 JRC 68458 b
1175	1175	1 by a consumer or the performance of a contract to which the
1176	1176	2 consumer is a party.
1177	1177	3 (c) The obligations imposed on controllers or processors
1178	1178	4 under this Act shall not apply where compliance by the
1179	1179	5 controller or processor with said Sections would violate an
1180	1180	6 evidentiary privilege under the laws of this State. Nothing in
1181	1181	7 this Act shall be construed to prevent a controller or
1182	1182	8 processor from providing personal data concerning a consumer
1183	1183	9 to a person covered by an evidentiary privilege under the laws
1184	1184	10 of the State as part of a privileged communication.
1185	1185	11 (d) A controller or processor that discloses personal data
1186	1186	12 to a processor or third-party controller in accordance with
1187	1187	13 this Act shall not be deemed to have violated said Sections if
1188	1188	14 the processor or third-party controller that receives and
1189	1189	15 processes such personal data violates said Sections, provided,
1190	1190	16 at the time the disclosing controller or processor disclosed
1191	1191	17 such personal data, the disclosing controller or processor did
1192	1192	18 not have actual knowledge that the receiving processor or
1193	1193	19 third-party controller would violate said Sections. A
1194	1194	20 third-party controller or processor receiving personal data
1195	1195	21 from a controller or processor in compliance with this Act is
1196	1196	22 likewise not in violation of said Sections for the
1197	1197	23 transgressions of the controller or processor from which such
1198	1198	24 third-party controller or processor receives such personal
1199	1199	25 data.
1200	1200	26 (e) Nothing in this Act shall be construed to:
1201	1201
1202	1202
1203	1203
1204	1204
1205	1205
1206	1206	HB5581 - 33 - LRB103 38323 JRC 68458 b
1207	1207
1208	1208
1209	1209	HB5581- 34 -LRB103 38323 JRC 68458 b HB5581 - 34 - LRB103 38323 JRC 68458 b
1210	1210	HB5581 - 34 - LRB103 38323 JRC 68458 b
1211	1211	1 (1) Impose any obligation on a controller or processor
1212	1212	2 that adversely affects the rights or freedoms of any
1213	1213	3 person, including, but not limited to, the rights of any
1214	1214	4 person to freedom of speech or freedom of the press
1215	1215	5 guaranteed in the First Amendment to the United States
1216	1216	6 Constitution; or
1217	1217	7 (2) Apply to any person's processing of personal data
1218	1218	8 in the course of such person's purely personal or
1219	1219	9 household activities.
1220	1220	10 (f) Personal data processed by a controller pursuant to
1221	1221	11 this Section may be processed to the extent that such
1222	1222	12 processing is:
1223	1223	13 (1) Reasonably necessary and proportionate to the
1224	1224	14 purposes listed in this Section; and
1225	1225	15 (2) Adequate, relevant and limited to what is
1226	1226	16 necessary in relation to the specific purposes listed in
1227	1227	17 this Section. Personal data collected, used or retained
1228	1228	18 under paragraph (2) of subsection (a), where applicable,
1229	1229	19 take into account the nature and purpose or purposes of
1230	1230	20 such collection, use or retention. Such data shall be
1231	1231	21 subject to reasonable administrative, technical and
1232	1232	22 physical measures to protect the confidentiality,
1233	1233	23 integrity and accessibility of the personal data and to
1234	1234	24 reduce reasonably foreseeable risks of harm to consumers
1235	1235	25 relating to such collection, use or retention of personal
1236	1236	26 data.
1237	1237
1238	1238
1239	1239
1240	1240
1241	1241
1242	1242	HB5581 - 34 - LRB103 38323 JRC 68458 b
1243	1243
1244	1244
1245	1245	HB5581- 35 -LRB103 38323 JRC 68458 b HB5581 - 35 - LRB103 38323 JRC 68458 b
1246	1246	HB5581 - 35 - LRB103 38323 JRC 68458 b
1247	1247	1 (g) If a controller processes personal data pursuant to an
1248	1248	2 exemption in this Section, the controller bears the burden of
1249	1249	3 demonstrating that such processing qualifies for the exemption
1250	1250	4 and complies with the requirements in subsection (f).
1251	1251	5 (h) Processing personal data for the purposes expressly
1252	1252	6 identified in this Section shall not solely make a legal
1253	1253	7 entity a controller with respect to such processing.
1254	1254	8 Section 55. Notice; enforcement.
1255	1255	9 (a) The Attorney General shall have exclusive authority to
1256	1256	10 enforce violations under this Act.
1257	1257	11 (b) During the period beginning January 1, 2025 and ending
1258	1258	12 December 31, 2025, the Attorney General shall, and following
1259	1259	13 said period the Attorney General may, prior to initiating any
1260	1260	14 action for a violation under this Act, issue a notice of
1261	1261	15 violation to the controller if the Attorney General determines
1262	1262	16 that a cure is possible. If the controller fails to cure such
1263	1263	17 violation within 60 days of receipt of the notice of
1264	1264	18 violation, the Attorney General may bring an action pursuant
1265	1265	19 to this Section.
1266	1266	20 (c) Beginning January 1, 2026, in determining whether to
1267	1267	21 grant a controller or processor the opportunity to cure an
1268	1268	22 alleged violation described under this Act, the Attorney
1269	1269	23 General may consider:
1270	1270	24 (1) The number of violations;
1271	1271	25 (2) The size and complexity of the controller or
1272	1272
1273	1273
1274	1274
1275	1275
1276	1276
1277	1277	HB5581 - 35 - LRB103 38323 JRC 68458 b
1278	1278
1279	1279
1280	1280	HB5581- 36 -LRB103 38323 JRC 68458 b HB5581 - 36 - LRB103 38323 JRC 68458 b
1281	1281	HB5581 - 36 - LRB103 38323 JRC 68458 b
1282	1282	1 processor;
1283	1283	2 (3) The nature and extent of the controller's or
1284	1284	3 processor's processing activities;
1285	1285	4 (4) The substantial likelihood of injury to the
1286	1286	5 public;
1287	1287	6 (5) The safety of persons or property; and
1288	1288	7 (6) Whether such alleged violation was likely caused
1289	1289	8 by human or technical error.
1290	1290	9 (d) Nothing in this Act shall be construed as providing
1291	1291	10 the basis for, or be subject to, a private right of action for
1292	1292	11 violations under this Act or any other law.
1293	1293	12 (e) A violation under this Act shall constitute an unfair
1294	1294	13 method of competition or any unfair or deceptive act or
1295	1295	14 practice in the conduct of any trade or commerce within this
1296	1296	15 State under the Consumer Fraud and Deceptive Business
1297	1297	16 Practices Act and shall be enforced by the Attorney General.
1298	1298	17 Section 60. Compliance with other law. An individual or
1299	1299	18 entity covered by this Act and other law regarding third-party
1300	1300	19 providers of information and services is required to comply
1301	1301	20 with both laws, provided, however, that to the extent there is
1302	1302	21 a direct conflict between the 2 laws which precludes
1303	1303	22 compliance with both statutes, the individual or entity shall
1304	1304	23 comply with the statute that provides the greater measure of
1305	1305	24 privacy protection to individuals. For purposes of this
1306	1306	25 Section, an "opt-in" procedure for an individual to grant
1307	1307
1308	1308
1309	1309
1310	1310
1311	1311
1312	1312	HB5581 - 36 - LRB103 38323 JRC 68458 b
1313	1313
1314	1314
1315	1315	HB5581- 37 -LRB103 38323 JRC 68458 b HB5581 - 37 - LRB103 38323 JRC 68458 b
1316	1316	HB5581 - 37 - LRB103 38323 JRC 68458 b
1317	1317	1 consent for the disclosure of personal information shall be
1318	1318	2 deemed to provide a greater measure of protection of privacy
1319	1319	3 than the "opt-out" procedure established under this Act.
1320	1320
1321	1321
1322	1322
1323	1323
1324	1324
1325	1325	HB5581 - 37 - LRB103 38323 JRC 68458 b