Illinois 2023-2024 Regular Session

Illinois Senate Bill SB3517 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3517 Introduced 2/9/2024, by Sen. Sue Rezin SYNOPSIS AS INTRODUCED: New Act30 ILCS 105/5.1015 new Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act. LRB103 35732 LNS 65813 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3517 Introduced 2/9/2024, by Sen. Sue Rezin SYNOPSIS AS INTRODUCED: New Act30 ILCS 105/5.1015 new New Act 30 ILCS 105/5.1015 new Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act. LRB103 35732 LNS 65813 b LRB103 35732 LNS 65813 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3517 Introduced 2/9/2024, by Sen. Sue Rezin SYNOPSIS AS INTRODUCED:
3	3	New Act30 ILCS 105/5.1015 new New Act 30 ILCS 105/5.1015 new
4	4	New Act
5	5	30 ILCS 105/5.1015 new
6	6	Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act.
7	7	LRB103 35732 LNS 65813 b LRB103 35732 LNS 65813 b
8	8	LRB103 35732 LNS 65813 b
9	9	A BILL FOR
10	10	SB3517LRB103 35732 LNS 65813 b SB3517 LRB103 35732 LNS 65813 b
11	11	SB3517 LRB103 35732 LNS 65813 b
12	12	1 AN ACT concerning civil law.
13	13	2 Be it enacted by the People of the State of Illinois,
14	14	3 represented in the General Assembly:
15	15	4 Article 5. General
16	16	5 Section 5-1. Short title. This Act may be cited as the
17	17	6 Privacy Rights Act.
18	18	7 Section 5-5. Purpose and intent. In enacting this Act, it
19	19	8 is the purpose and intent of the State to further protect
20	20	9 consumers' rights, including the constitutional right of
21	21	10 privacy. The implementation of this Act shall be guided by the
22	22	11 following principles:
23	23	12 (1) Consumers should know who is collecting their
24	24	13 personal information and that of their children, how it is
25	25	14 being used, and to whom it is disclosed so that they have
26	26	15 the information necessary to exercise meaningful control
27	27	16 over businesses' use of their personal information and
28	28	17 that of their children.
29	29	18 (2) Consumers should be able to control the use of
30	30	19 their personal information, including limiting the use of
31	31	20 their sensitive personal information, the unauthorized use
32	32	21 or disclosure of which creates a heightened risk of harm
33	33	22 to the consumer, and they should have meaningful options
34	34
35	35
36	36
37	37	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 SB3517 Introduced 2/9/2024, by Sen. Sue Rezin SYNOPSIS AS INTRODUCED:
38	38	New Act30 ILCS 105/5.1015 new New Act 30 ILCS 105/5.1015 new
39	39	New Act
40	40	30 ILCS 105/5.1015 new
41	41	Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act.
42	42	LRB103 35732 LNS 65813 b LRB103 35732 LNS 65813 b
43	43	LRB103 35732 LNS 65813 b
44	44	A BILL FOR
45	45
46	46
47	47
48	48
49	49
50	50	New Act
51	51	30 ILCS 105/5.1015 new
52	52
53	53
54	54
55	55	LRB103 35732 LNS 65813 b
56	56
57	57
58	58
59	59
60	60
61	61
62	62
63	63
64	64
65	65	SB3517 LRB103 35732 LNS 65813 b
66	66
67	67
68	68	SB3517- 2 -LRB103 35732 LNS 65813 b SB3517 - 2 - LRB103 35732 LNS 65813 b
69	69	SB3517 - 2 - LRB103 35732 LNS 65813 b
70	70	1 over how it is collected, used, and disclosed.
71	71	2 (3) Consumers should have access to their personal
72	72	3 information and should be able to correct it, delete it,
73	73	4 and take it with them from one business to another.
74	74	5 (4) Consumers or their authorized agents should be
75	75	6 able to exercise these options through easily accessible
76	76	7 self-serve tools.
77	77	8 (5) Consumers should be able to exercise these rights
78	78	9 without being penalized for doing so.
79	79	10 (6) Consumers should be able to hold businesses
80	80	11 accountable for failing to take reasonable precautions to
81	81	12 protect their most sensitive personal information from
82	82	13 hackers and security breaches.
83	83	14 (7) Consumers should benefit from businesses' use of
84	84	15 their personal information.
85	85	16 (8) The privacy interests of employees and independent
86	86	17 contractors should also be protected, taking into account
87	87	18 the differences in the relationship between employees or
88	88	19 independent contractors and businesses as compared to the
89	89	20 relationship between consumers and businesses. This Act is
90	90	21 not intended to interfere with the right to organize and
91	91	22 collective bargaining under the federal National Labor
92	92	23 Relations Act.
93	93	24 (9) Businesses should specifically and clearly inform
94	94	25 consumers about how they collect and use personal
95	95	26 information and how they can exercise their rights and
96	96
97	97
98	98
99	99
100	100
101	101	SB3517 - 2 - LRB103 35732 LNS 65813 b
102	102
103	103
104	104	SB3517- 3 -LRB103 35732 LNS 65813 b SB3517 - 3 - LRB103 35732 LNS 65813 b
105	105	SB3517 - 3 - LRB103 35732 LNS 65813 b
106	106	1 choice.
107	107	2 (10) Businesses should only collect consumers'
108	108	3 personal information for specific, explicit, and
109	109	4 legitimate disclosed purposes and should not further
110	110	5 collect, use, or disclose consumers' personal information
111	111	6 for reasons incompatible with those purposes.
112	112	7 (11) Businesses should collect consumers' personal
113	113	8 information only to the extent that it is relevant and
114	114	9 limited to what is necessary in relation to the purposes
115	115	10 for which it is being collected, used, and shared.
116	116	11 (12) Businesses should provide consumers or their
117	117	12 authorized agents with easily accessible means to allow
118	118	13 consumers and their children to obtain their personal
119	119	14 information, to delete it or correct it, to opt out of its
120	120	15 sale and sharing across business platforms, services,
121	121	16 businesses, and devices, and to limit the use of their
122	122	17 sensitive personal information.
123	123	18 (13) Businesses should not penalize consumers for
124	124	19 exercising these rights.
125	125	20 (14) Businesses should take reasonable precautions to
126	126	21 protect consumers' personal information from a security
127	127	22 breach.
128	128	23 (15) Businesses should be held accountable when they
129	129	24 violate consumers' privacy rights, and the penalties
130	130	25 should be higher when the violation affects children.
131	131	26 (16) The rights of consumers and the responsibilities
132	132
133	133
134	134
135	135
136	136
137	137	SB3517 - 3 - LRB103 35732 LNS 65813 b
138	138
139	139
140	140	SB3517- 4 -LRB103 35732 LNS 65813 b SB3517 - 4 - LRB103 35732 LNS 65813 b
141	141	SB3517 - 4 - LRB103 35732 LNS 65813 b
142	142	1 of businesses should be implemented with the goal of
143	143	2 strengthening consumer privacy while giving attention to
144	144	3 the impact on business and innovation. Consumer privacy
145	145	4 and the development of beneficial new products and
146	146	5 services are not necessarily incompatible goals. Strong
147	147	6 consumer privacy rights create incentives to innovate and
148	148	7 develop new products that are privacy protective.
149	149	8 (17) Businesses and consumers should be provided with
150	150	9 clear guidance about their responsibilities and rights.
151	151	10 (18) The law should place the consumer in a position
152	152	11 to knowingly and freely negotiate with a business over the
153	153	12 business' use of the personal information.
154	154	13 (19) The law should adjust to technological changes,
155	155	14 help consumers exercise their rights, and assist
156	156	15 businesses with compliance with the continuing goal of
157	157	16 strengthening consumer privacy.
158	158	17 (20) The law should enable proconsumer new products
159	159	18 and services and promote efficiency of implementation for
160	160	19 business as long as the law does not compromise or weaken
161	161	20 consumer privacy.
162	162	21 (21) The law should be amended, if necessary, to
163	163	22 improve its operation, as long as the amendments do not
164	164	23 compromise or weaken consumer privacy, while giving
165	165	24 attention to the impact on business and innovation.
166	166	25 (22) Businesses should be held accountable for
167	167	26 violating the law through vigorous administrative and
168	168
169	169
170	170
171	171
172	172
173	173	SB3517 - 4 - LRB103 35732 LNS 65813 b
174	174
175	175
176	176	SB3517- 5 -LRB103 35732 LNS 65813 b SB3517 - 5 - LRB103 35732 LNS 65813 b
177	177	SB3517 - 5 - LRB103 35732 LNS 65813 b
178	178	1 civil enforcement.
179	179	2 (23) To the extent it advances consumer privacy and
180	180	3 business compliance, the law should be compatible with
181	181	4 privacy laws in other jurisdictions.
182	182	5 Section 5-10. Definitions. As used in this Act:
183	183	6 "Advertising and marketing" means a communication by a
184	184	7 business or person acting on behalf of the business in any
185	185	8 medium intended to induce a consumer to obtain goods,
186	186	9 services, or employment.
187	187	10 "Agency" means the Privacy Protection Agency.
188	188	11 "Aggregate consumer information" means information that
189	189	12 relates to a group or category of consumers, from which
190	190	13 individual consumer identities have been removed, that is not
191	191	14 linked or reasonably linkable to any consumer or household,
192	192	15 including via a device. "Aggregate consumer information" does
193	193	16 not include one or more individual consumer records that have
194	194	17 been deidentified.
195	195	18 "Biometric information" means an individual's
196	196	19 physiological, biological, or behavioral characteristics,
197	197	20 including information pertaining to an individual's
198	198	21 deoxyribonucleic acid (DNA), that is used or is intended to be
199	199	22 used singly or in combination with each other or with other
200	200	23 identifying data, to establish individual identity. "Biometric
201	201	24 information" includes, but is not limited to, imagery of the
202	202	25 iris, retina, fingerprint, face, hand, palm, vein patterns,
203	203
204	204
205	205
206	206
207	207
208	208	SB3517 - 5 - LRB103 35732 LNS 65813 b
209	209
210	210
211	211	SB3517- 6 -LRB103 35732 LNS 65813 b SB3517 - 6 - LRB103 35732 LNS 65813 b
212	212	SB3517 - 6 - LRB103 35732 LNS 65813 b
213	213	1 and voice recordings, from which an identifier template, such
214	214	2 as a faceprint, a minutiae template, or a voiceprint, can be
215	215	3 extracted, and keystroke patterns or rhythms, gait patterns or
216	216	4 rhythms, and sleep, health, or exercise data that contain
217	217	5 identifying information.
218	218	6 "Business" means:
219	219	7 (1) a sole proprietorship, partnership, limited
220	220	8 liability company, corporation, association, or other
221	221	9 legal entity that is organized or operated for the profit
222	222	10 or financial benefit of its shareholders or other owners,
223	223	11 that collects consumers' personal information, or on the
224	224	12 behalf of which such information is collected and that
225	225	13 determines the purposes and means of the processing of
226	226	14 consumers' personal information, does business in this
227	227	15 State, and satisfies one or more of the following
228	228	16 thresholds:
229	229	17 (A) as of January 1 of the calendar year, had
230	230	18 annual gross revenues in excess of $25,000,000 in the
231	231	19 preceding calendar year;
232	232	20 (B) alone or in combination, annually, buys,
233	233	21 sells, or shares the personal information of 100,000
234	234	22 or more consumers or households; or
235	235	23 (C) derives 50% or more of its annual revenues
236	236	24 from selling or sharing consumers' personal
237	237	25 information;
238	238	26 (2) any entity that controls or is controlled by a
239	239
240	240
241	241
242	242
243	243
244	244	SB3517 - 6 - LRB103 35732 LNS 65813 b
245	245
246	246
247	247	SB3517- 7 -LRB103 35732 LNS 65813 b SB3517 - 7 - LRB103 35732 LNS 65813 b
248	248	SB3517 - 7 - LRB103 35732 LNS 65813 b
249	249	1 business and that shares common branding with the business
250	250	2 and with whom the business shares consumers' personal
251	251	3 information;
252	252	4 (3) a joint venture or partnership composed of
253	253	5 businesses in which each business has at least a 40%
254	254	6 interest; or
255	255	7 (4) a person that does business in this State, that is
256	256	8 not covered by paragraph (1), (2), or (3) of this
257	257	9 definition and that voluntarily certifies to this Act that
258	258	10 it is in compliance with, and agrees to be bound by, this
259	259	11 Act.
260	260	12 "Business associate" has the meaning given to that term in
261	261	13 Section 160.103 of Title 45 of the Code of Federal
262	262	14 Regulations.
263	263	15 "Business controller information" means the name or names
264	264	16 of the owner or owners, director, officer, or management
265	265	17 employee of a business and the contact information, including
266	266	18 a business title, for the owner or owners, director, officer,
267	267	19 or management employee.
268	268	20 "Business purpose" means the use of personal information
269	269	21 for the business's operational purposes, or other notified
270	270	22 purposes, or for the service provider's or contractor's
271	271	23 operational purposes, as long as the use of personal
272	272	24 information is reasonably necessary and proportionate to
273	273	25 achieve the purpose for which the personal information was
274	274	26 collected or processed or for another purpose that is
275	275
276	276
277	277
278	278
279	279
280	280	SB3517 - 7 - LRB103 35732 LNS 65813 b
281	281
282	282
283	283	SB3517- 8 -LRB103 35732 LNS 65813 b SB3517 - 8 - LRB103 35732 LNS 65813 b
284	284	SB3517 - 8 - LRB103 35732 LNS 65813 b
285	285	1 compatible with the context in which the personal information
286	286	2 was collected. "Business purposes" includes:
287	287	3 (1) auditing related to counting ad impressions to
288	288	4 unique visitors, verifying positioning and quality of ad
289	289	5 impressions, and auditing compliance with this
290	290	6 specification and other standards;
291	291	7 (2) helping to ensure security and integrity to the
292	292	8 extent the use of the personal information is reasonably
293	293	9 necessary and proportionate for these purposes;
294	294	10 (3) debugging to identify and repair errors that
295	295	11 impair existing intended functionality;
296	296	12 (4) short-term, transient use, including, but not
297	297	13 limited to, nonpersonalized advertising shown as part of a
298	298	14 consumer's current interaction with the business, as long
299	299	15 as the personal information is not disclosed to another
300	300	16 third party and is not used to build a profile about the
301	301	17 consumer or otherwise alter the consumer's experience
302	302	18 outside the current interaction with the business;
303	303	19 (5) performing services on behalf of the business,
304	304	20 including maintaining or servicing accounts, providing
305	305	21 customer service, processing or fulfilling orders and
306	306	22 transactions, verifying customer information, processing
307	307	23 payments, providing financing, providing analytic
308	308	24 services, providing storage, or providing similar services
309	309	25 on behalf of the business;
310	310	26 (6) providing advertising and marketing services,
311	311
312	312
313	313
314	314
315	315
316	316	SB3517 - 8 - LRB103 35732 LNS 65813 b
317	317
318	318
319	319	SB3517- 9 -LRB103 35732 LNS 65813 b SB3517 - 9 - LRB103 35732 LNS 65813 b
320	320	SB3517 - 9 - LRB103 35732 LNS 65813 b
321	321	1 except for cross-context behavioral advertising, to the
322	322	2 consumer, as long as a service provider or contractor does
323	323	3 not combine the personal information of consumers who
324	324	4 opted-out that the service provider or contractor receives
325	325	5 from, or on behalf of, the business with personal
326	326	6 information that the service provider or contractor
327	327	7 receives from, or on behalf of, another person or persons
328	328	8 or collects from its own interaction with consumers;
329	329	9 (7) undertaking internal research for technological
330	330	10 development and demonstration; and
331	331	11 (8) undertaking activities to verify or maintain the
332	332	12 quality or safety of a service or device that is owned,
333	333	13 manufactured, manufactured for, or controlled by the
334	334	14 business, and to improve, upgrade, or enhance the service
335	335	15 or device that is owned, manufactured, manufactured for,
336	336	16 or controlled by the business.
337	337	17 "Collects", "collected", or "collection" means buying,
338	338	18 renting, gathering, obtaining, receiving, or accessing any
339	339	19 personal information pertaining to the consumer by any means.
340	340	20 "Collects", "collected", or "collection" includes receiving
341	341	21 information from the consumer, either actively or passively,
342	342	22 or by observing the consumer's behavior.
343	343	23 "Commercial credit reporting agency" means any person who,
344	344	24 for monetary fees, dues, or on a cooperative nonprofit basis,
345	345	25 provides commercial credit reports to third parties.
346	346	26 "Commercial purposes" means to advance a person's
347	347
348	348
349	349
350	350
351	351
352	352	SB3517 - 9 - LRB103 35732 LNS 65813 b
353	353
354	354
355	355	SB3517- 10 -LRB103 35732 LNS 65813 b SB3517 - 10 - LRB103 35732 LNS 65813 b
356	356	SB3517 - 10 - LRB103 35732 LNS 65813 b
357	357	1 commercial or economic interests, such as by inducing another
358	358	2 person to buy, rent, lease, join, subscribe to, provide, or
359	359	3 exchange products, goods, property, information, or services,
360	360	4 or enabling or effecting, directly or indirectly, a commercial
361	361	5 transaction.
362	362	6 "Common branding" means a shared name, service mark, or
363	363	7 trademark that the average consumer would understand that 2 or
364	364	8 more entities are commonly owned.
365	365	9 "Consent" means any freely given, specific, informed, and
366	366	10 unambiguous indication of the consumer's wishes by which the
367	367	11 consumer, the consumer's legal guardian, or a person who has
368	368	12 power of attorney signifies agreement to the processing of
369	369	13 personal information relating to the consumer for a narrowly
370	370	14 defined particular purpose. "Consent" does not include
371	371	15 acceptance of a general or broad terms of use, or similar
372	372	16 document, that contains descriptions of personal information
373	373	17 processing along with other, unrelated information, hovering
374	374	18 over, muting, pausing, or closing a given piece of content, or
375	375	19 an agreement obtained through use of dark patterns.
376	376	20 "Consumer" means a natural person who is a State resident,
377	377	21 however identified, including by any unique identifier.
378	378	22 "Contractor" means a person to whom the business makes
379	379	23 available personal information for a business purpose, under
380	380	24 the written contract with the business, if the contract:
381	381	25 (1) prohibits the contractor from:
382	382	26 (A) selling or sharing the personal information;
383	383
384	384
385	385
386	386
387	387
388	388	SB3517 - 10 - LRB103 35732 LNS 65813 b
389	389
390	390
391	391	SB3517- 11 -LRB103 35732 LNS 65813 b SB3517 - 11 - LRB103 35732 LNS 65813 b
392	392	SB3517 - 11 - LRB103 35732 LNS 65813 b
393	393	1 (B) retaining, using, or disclosing the personal
394	394	2 information for any purpose other than for the
395	395	3 business purpose specified in the contract, including
396	396	4 retaining, using, or disclosing the personal
397	397	5 information for a commercial purpose other than the
398	398	6 business purposes specified in the contract, or as
399	399	7 otherwise permitted by this Act;
400	400	8 (C) retaining, using, or disclosing the personal
401	401	9 information outside of the direct business
402	402	10 relationship between the contractor and the business;
403	403	11 and
404	404	12 (D) combining the personal information that the
405	405	13 contractor receives under a written contract with the
406	406	14 business with personal information that it receives on
407	407	15 behalf of another person or persons, or collects from
408	408	16 its own interaction with the consumer;
409	409	17 (2) includes a certification made by the contractor
410	410	18 that the contractor understands the restrictions in
411	411	19 paragraph (1) and will comply with them; and
412	412	20 (3) permits, subject to agreement with the contractor,
413	413	21 the business to monitor the contractor's compliance with
414	414	22 the contract through measures, including, but not limited
415	415	23 to, ongoing manual reviews and automated scans and regular
416	416	24 assessments, audits, or other technical and operational
417	417	25 testing at least once every 12 months.
418	418	26 "Control" or "controlled" means ownership of, or the power
419	419
420	420
421	421
422	422
423	423
424	424	SB3517 - 11 - LRB103 35732 LNS 65813 b
425	425
426	426
427	427	SB3517- 12 -LRB103 35732 LNS 65813 b SB3517 - 12 - LRB103 35732 LNS 65813 b
428	428	SB3517 - 12 - LRB103 35732 LNS 65813 b
429	429	1 to vote, more than 50% of the outstanding shares, control in
430	430	2 any manner over the election of a majority of directors, or of
431	431	3 individuals exercising similar functions, or the power to
432	432	4 exercise a controlling influence over the management of the
433	433	5 company.
434	434	6 "Covered entity" has the meaning given to that term in
435	435	7 Section 160.103 of Title 45 of the Code of Federal
436	436	8 Regulations.
437	437	9 "Cross-context behavioral advertising" means the targeting
438	438	10 of advertising to a consumer based on the personal information
439	439	11 obtained from the consumer's activity across businesses,
440	440	12 distinctly branded websites, applications, or services, other
441	441	13 than the business, distinctly branded website, application, or
442	442	14 service with which the consumer intentionally interacts.
443	443	15 "Dark pattern" means a user interface designed or
444	444	16 manipulated with the substantial effect of subverting or
445	445	17 impairing user autonomy, decision-making, or choice.
446	446	18 "Deidentified" means information that cannot be reasonably
447	447	19 used to infer information about, or otherwise be linked to, a
448	448	20 particular consumer if the business that possesses the
449	449	21 information:
450	450	22 (1) takes reasonable measures to ensure that the
451	451	23 information cannot be associated with a consumer or
452	452	24 household;
453	453	25 (2) publicly commits to maintain and use the
454	454	26 information in deidentified form and not to attempt to
455	455
456	456
457	457
458	458
459	459
460	460	SB3517 - 12 - LRB103 35732 LNS 65813 b
461	461
462	462
463	463	SB3517- 13 -LRB103 35732 LNS 65813 b SB3517 - 13 - LRB103 35732 LNS 65813 b
464	464	SB3517 - 13 - LRB103 35732 LNS 65813 b
465	465	1 reidentify the information; and
466	466	2 (3) contractually obligates any recipients of the
467	467	3 information to comply with all provisions of this
468	468	4 definition.
469	469	5 "Designated methods for submitting requests" means a
470	470	6 mailing address, email address, Internet webpage, Internet web
471	471	7 portal, toll-free telephone number, or other applicable
472	472	8 contact information, whereby consumers may submit a request or
473	473	9 direction under this Act, and any new, consumer-friendly means
474	474	10 of contacting a business.
475	475	11 "Device" means any physical object that is capable of
476	476	12 connecting to the Internet, directly or indirectly, or to
477	477	13 another device.
478	478	14 "Director" means a natural person designated in the
479	479	15 articles of incorporation as director, or elected by the
480	480	16 incorporators and natural persons designated, elected, or
481	481	17 appointed by any other name or title to act as directors, and
482	482	18 their successors.
483	483	19 "Educational standardized assessment or educational
484	484	20 assessment" means a standardized or nonstandardized quiz,
485	485	21 test, or other assessment used to evaluate students in or for
486	486	22 entry to kindergarten and grades 1 through 12, schools,
487	487	23 postsecondary institutions, vocational programs, and
488	488	24 postgraduate programs that are accredited by an accrediting
489	489	25 agency or organization recognized by the State or the United
490	490	26 States Department of Education, as well as certification and
491	491
492	492
493	493
494	494
495	495
496	496	SB3517 - 13 - LRB103 35732 LNS 65813 b
497	497
498	498
499	499	SB3517- 14 -LRB103 35732 LNS 65813 b SB3517 - 14 - LRB103 35732 LNS 65813 b
500	500	SB3517 - 14 - LRB103 35732 LNS 65813 b
501	501	1 licensure examinations used to determine competency and
502	502	2 eligibility to receive certification or licensure from a
503	503	3 government agency or government certification body.
504	504	4 "Family" means a custodial parent or guardian and any
505	505	5 children under 18 years of age over which the parent or
506	506	6 guardian has custody.
507	507	7 "Fraudulent concealment" means the person knows of
508	508	8 material facts related to the person's duties under this Act
509	509	9 and knowingly conceals the facts in performing or omitting to
510	510	10 perform those duties for the purpose of defrauding the public
511	511	11 of information to which it is entitled under this Act.
512	512	12 "Homepage" means the introductory page of an Internet
513	513	13 website and any Internet webpage where personal information is
514	514	14 collected. "Homepage", in the case of an online service such
515	515	15 as a mobile application, means the application's platform page
516	516	16 or download page, a link within the application, such as from
517	517	17 the application configuration, "About", "Information", or
518	518	18 settings page, and any other location that allows consumers to
519	519	19 review the notices required by this Act, including, but not
520	520	20 limited to, before downloading the application.
521	521	21 "Household" means a group, however identified, of
522	522	22 consumers who cohabitate with one another at the same
523	523	23 residential address and share use of common devices or
524	524	24 services.
525	525	25 "Independent contractor" means a natural person who
526	526	26 provides any service to a business under a written contract.
527	527
528	528
529	529
530	530
531	531
532	532	SB3517 - 14 - LRB103 35732 LNS 65813 b
533	533
534	534
535	535	SB3517- 15 -LRB103 35732 LNS 65813 b SB3517 - 15 - LRB103 35732 LNS 65813 b
536	536	SB3517 - 15 - LRB103 35732 LNS 65813 b
537	537	1 "Individually identifiable" means that the medical
538	538	2 information includes or contains any element of personal
539	539	3 identifying information sufficient to allow identification of
540	540	4 the individual, such as the patient's name, address, email
541	541	5 address, telephone number, or social security number, or other
542	542	6 information that, alone or in combination with other publicly
543	543	7 available information, reveals the identity of the individual.
544	544	8 "Infer" or "inference" means the derivation of
545	545	9 information, data, assumptions, or conclusions from facts,
546	546	10 evidence, or other sources of information or data.
547	547	11 "Insurance institution" means any corporation,
548	548	12 association, partnership, reciprocal exchange, interinsurer,
549	549	13 fraternal benefit society, or other person engaged in the
550	550	14 business of insurance. "Insurance institution" does not
551	551	15 include agents, insurance-support organizations, or health
552	552	16 care service plans.
553	553	17 "Intentionally interacts" means when the consumer intends
554	554	18 to interact with a person, or disclose personal information to
555	555	19 a person, via one or more deliberate interactions, including
556	556	20 visiting the person's website or purchasing a good or service
557	557	21 from the person. "Intentionally interacts" does not include
558	558	22 hovering over, muting, pausing, or closing a given piece of
559	559	23 content.
560	560	24 "Jeopardize the validity and reliability of that
561	561	25 educational standardized assessment or educational assessment"
562	562	26 means releasing information that would provide an advantage to
563	563
564	564
565	565
566	566
567	567
568	568	SB3517 - 15 - LRB103 35732 LNS 65813 b
569	569
570	570
571	571	SB3517- 16 -LRB103 35732 LNS 65813 b SB3517 - 16 - LRB103 35732 LNS 65813 b
572	572	SB3517 - 16 - LRB103 35732 LNS 65813 b
573	573	1 the consumer who has submitted a verifiable consumer request
574	574	2 or to another natural person.
575	575	3 "Local educational agency" includes school districts,
576	576	4 county offices of education, and charter schools.
577	577	5 "Management employee" means a natural person whose name
578	578	6 and contact information is reported to or collected by a
579	579	7 commercial credit reporting agency as the primary manager of a
580	580	8 business and used solely within the context of the natural
581	581	9 person's role as the primary manager of the business.
582	582	10 "Medical information" means any individually identifiable
583	583	11 information, in electronic or physical form, in possession of
584	584	12 or derived from a provider of health care, health care service
585	585	13 plan, pharmaceutical company, or contractor regarding a
586	586	14 patient's medical history, mental health application
587	587	15 information, mental or physical condition, or treatment.
588	588	16 "Medical staff member" means a licensed physician and
589	589	17 surgeon, dentist, or podiatric physician, licensed under the
590	590	18 Medical Practice Act of 1987, the Illinois Dental Practice
591	591	19 Act, or the Podiatric Medical Practice Act of 1987 and a
592	592	20 clinical psychologist as defined in the Clinical Psychologist
593	593	21 Licensing Act.
594	594	22 "New motor vehicle dealer" is a dealer who either acquires
595	595	23 for resale new and unregistered motor vehicles from
596	596	24 manufacturers or distributors of those motor vehicles or
597	597	25 acquires for resale new off-highway motorcycles or all-terrain
598	598	26 vehicles from manufacturers or distributors of the vehicles.
599	599
600	600
601	601
602	602
603	603
604	604	SB3517 - 16 - LRB103 35732 LNS 65813 b
605	605
606	606
607	607	SB3517- 17 -LRB103 35732 LNS 65813 b SB3517 - 17 - LRB103 35732 LNS 65813 b
608	608	SB3517 - 17 - LRB103 35732 LNS 65813 b
609	609	1 "Nonpersonalized advertising" means advertising and
610	610	2 marketing that is based solely on personal information derived
611	611	3 from the consumer's current interaction with the business with
612	612	4 the exception of the consumer's precise geolocation.
613	613	5 "Officer" means a natural person elected or appointed by
614	614	6 the board of directors to manage the daily operations of a
615	615	7 corporation, including a chief executive officer, president,
616	616	8 secretary, or treasurer.
617	617	9 "Owner" means a natural person who:
618	618	10 (1) has ownership of, or the power to vote, more than
619	619	11 50% of the outstanding shares of any class of voting
620	620	12 security of a business;
621	621	13 (2) has control in any manner over the election of a
622	622	14 majority of the directors or of individuals exercising
623	623	15 similar functions; or
624	624	16 (3) has the power to exercise a controlling influence
625	625	17 over the management of a company.
626	626	18 "Ownership information" means the name or names of and
627	627	19 contact information for the registered owner or owners.
628	628	20 "Person" means an individual, proprietorship, firm,
629	629	21 partnership, joint venture, syndicate, business, trust,
630	630	22 company, corporation, limited liability company, association,
631	631	23 committee, and any other organization or group of persons
632	632	24 acting in concert.
633	633	25 "Personal information" means information that identifies,
634	634	26 relates to, describes, is reasonably capable of being
635	635
636	636
637	637
638	638
639	639
640	640	SB3517 - 17 - LRB103 35732 LNS 65813 b
641	641
642	642
643	643	SB3517- 18 -LRB103 35732 LNS 65813 b SB3517 - 18 - LRB103 35732 LNS 65813 b
644	644	SB3517 - 18 - LRB103 35732 LNS 65813 b
645	645	1 associated with, or could reasonably be linked, directly or
646	646	2 indirectly, with a particular consumer or household. "Personal
647	647	3 information" includes, but is not limited to, the following if
648	648	4 it identifies, relates to, describes, is reasonably capable of
649	649	5 being associated with, or could be reasonably linked, directly
650	650	6 or indirectly, with a particular consumer or household:
651	651	7 (1) identifiers such as a real name, alias, postal
652	652	8 address, unique personal identifier, online identifier,
653	653	9 Internet Protocol address, email address, account name,
654	654	10 social security number, driver's license number, passport
655	655	11 number, or other similar identifiers;
656	656	12 (2) any information, including, but not limited to,
657	657	13 signature, physical characteristics or description,
658	658	14 address, telephone number, state identification card
659	659	15 number, insurance policy number, education, bank account
660	660	16 number, credit card number, debit card number, or any
661	661	17 other financial information, medical information, or
662	662	18 health insurance information, but does not include
663	663	19 publicly available information that is lawfully made
664	664	20 available to the general public from federal, State, or
665	665	21 local government records;
666	666	22 (3) characteristics of protected classifications under
667	667	23 State or federal law;
668	668	24 (4) commercial information, including records of
669	669	25 personal property, products or services purchased,
670	670	26 obtained, or considered, or other purchasing or consuming
671	671
672	672
673	673
674	674
675	675
676	676	SB3517 - 18 - LRB103 35732 LNS 65813 b
677	677
678	678
679	679	SB3517- 19 -LRB103 35732 LNS 65813 b SB3517 - 19 - LRB103 35732 LNS 65813 b
680	680	SB3517 - 19 - LRB103 35732 LNS 65813 b
681	681	1 histories or tendencies;
682	682	2 (5) biometric information;
683	683	3 (6) Internet or other electronic network activity
684	684	4 information, including, but not limited to, browsing
685	685	5 history, search history, and information regarding a
686	686	6 consumer's interaction with an Internet website,
687	687	7 application, or advertisement;
688	688	8 (7) geolocation data;
689	689	9 (8) audio, electronic, visual, thermal, olfactory, or
690	690	10 similar information;
691	691	11 (9) professional or employment-related information;
692	692	12 (10) education information that is not publicly
693	693	13 available, personally identifiable information as defined
694	694	14 in the federal Family Educational Rights and Privacy Act;
695	695	15 (11) inferences drawn from any of the information
696	696	16 identified in this definition to create a profile about a
697	697	17 consumer to reflect the consumer's preferences,
698	698	18 characteristics, psychological trends, predispositions,
699	699	19 behavior, attitudes, intelligence, abilities, and
700	700	20 aptitudes; or
701	701	21 (12) sensitive personal information.
702	702	22 "Personal information" does not include publicly available
703	703	23 information or lawfully obtained, truthful information that is
704	704	24 a matter of public concern, consumer information that is
705	705	25 deidentified, or aggregate consumer information.
706	706	26 "Precise geolocation" means any data that is derived from
707	707
708	708
709	709
710	710
711	711
712	712	SB3517 - 19 - LRB103 35732 LNS 65813 b
713	713
714	714
715	715	SB3517- 20 -LRB103 35732 LNS 65813 b SB3517 - 20 - LRB103 35732 LNS 65813 b
716	716	SB3517 - 20 - LRB103 35732 LNS 65813 b
717	717	1 a device and that is used or intended to be used to locate a
718	718	2 consumer within a geographic area that is equal to or less than
719	719	3 the area of a circle with a radius of 1,850 feet, except as
720	720	4 prescribed by rules.
721	721	5 "Processing" means any operation or set of operations that
722	722	6 are performed on personal information or on sets of personal
723	723	7 information, whether by automated means.
724	724	8 "Profiling" means any form of automated processing of
725	725	9 personal information to evaluate certain personal aspects
726	726	10 relating to a natural person and in particular to analyze or
727	727	11 predict aspects concerning that natural person's performance
728	728	12 at work, economic situation, health, personal preferences,
729	729	13 interests, reliability, behavior, location, or movements.
730	730	14 "Protected health information" has the meaning given to
731	731	15 that term in Section 160.103 of Title 45 of the Code of Federal
732	732	16 Regulations.
733	733	17 "Provider of health care" means a person licensed or
734	734	18 certified under the Medical Practice Act of 1987, the Nurse
735	735	19 Practice Act, the Illinois Dental Practice Act, the Podiatric
736	736	20 Medical Practice Act of 1987, the Illinois Speech-Language
737	737	21 Pathology and Audiology Practice Act, the Illinois
738	738	22 Occupational Therapy Practice Act, the Dietitian Nutritionist
739	739	23 Practice Act, the Perfusionist Practice Act, the Illinois
740	740	24 Physical Therapy Act, the Licensed Certified Professional
741	741	25 Midwife Practice Act, the Clinical Psychologist Licensing Act,
742	742	26 the Illinois Optometric Practice Act of 1987, the Physician
743	743
744	744
745	745
746	746
747	747
748	748	SB3517 - 20 - LRB103 35732 LNS 65813 b
749	749
750	750
751	751	SB3517- 21 -LRB103 35732 LNS 65813 b SB3517 - 21 - LRB103 35732 LNS 65813 b
752	752	SB3517 - 21 - LRB103 35732 LNS 65813 b
753	753	1 Assistant Practice Act of 1987, the Respiratory Care Practice
754	754	2 Act, the Pharmacy Practice Act, the Massage Licensing Act, the
755	755	3 Music Therapy Licensing and Practice Act, the Veterinary
756	756	4 Medicine and Surgery Practice Act of 2004, the Acupuncture
757	757	5 Practice Act, the Marriage and Family Therapy Licensing Act,
758	758	6 the Behavior Analyst Licensing Act, the Clinical Social Work
759	759	7 and Social Work Practice Act, and the Professional Counselor
760	760	8 and Clinical Professional Counselor Licensing and Practice Act
761	761	9 or a clinic, health dispensary, or health facility licensed
762	762	10 under the Community Living Facilities Licensing Act, the Home
763	763	11 Health, Home Services, and Home Nursing Agency Licensing Act,
764	764	12 the Hospice Program Licensing Act, and the Hospital Licensing
765	765	13 Act. "Provider of health care" does not include insurance
766	766	14 institutions.
767	767	15 "Pseudonymize" or "pseudonymization" means the processing
768	768	16 of personal information in a manner that renders the personal
769	769	17 information no longer attributable to a specific consumer
770	770	18 without the use of additional information, as long as the
771	771	19 additional information is kept separately and is subject to
772	772	20 technical and organizational measures to ensure that the
773	773	21 personal information is not attributed to an identified or
774	774	22 identifiable consumer.
775	775	23 "Publicly available" means information that is lawfully
776	776	24 made available from federal, State, or local government
777	777	25 records, information that a business has a reasonable basis to
778	778	26 believe is lawfully made available to the general public by
779	779
780	780
781	781
782	782
783	783
784	784	SB3517 - 21 - LRB103 35732 LNS 65813 b
785	785
786	786
787	787	SB3517- 22 -LRB103 35732 LNS 65813 b SB3517 - 22 - LRB103 35732 LNS 65813 b
788	788	SB3517 - 22 - LRB103 35732 LNS 65813 b
789	789	1 the consumer or from widely distributed media or information
790	790	2 made available by a person to whom the consumer has disclosed
791	791	3 the information if the consumer has not restricted the
792	792	4 information to a specific audience. "Publicly available" does
793	793	5 not include biometric information collected by a business
794	794	6 about a consumer without the consumer's knowledge.
795	795	7 "Research" means scientific analysis, systematic study,
796	796	8 and observation, including basic research or applied research
797	797	9 that is designed to develop or contribute to public or
798	798	10 scientific knowledge and that adheres or otherwise conforms to
799	799	11 all other applicable ethics and privacy laws, including, but
800	800	12 not limited to, studies conducted in the public interest in
801	801	13 the area of public health.
802	802	14 "Security and integrity" means the ability of:
803	803	15 (1) networks or information systems to detect security
804	804	16 incidents that compromise the availability, authenticity,
805	805	17 integrity, and confidentiality of stored or transmitted
806	806	18 personal information;
807	807	19 (2) businesses to detect security incidents, resist
808	808	20 malicious, deceptive, fraudulent, or illegal actions and
809	809	21 to help prosecute those responsible for those actions; and
810	810	22 (3) businesses to ensure the physical safety of
811	811	23 natural persons.
812	812	24 "Sell", "selling", "sale", or "sold" means selling,
813	813	25 renting, releasing, disclosing, disseminating, making
814	814	26 available, transferring, or otherwise communicating orally, in
815	815
816	816
817	817
818	818
819	819
820	820	SB3517 - 22 - LRB103 35732 LNS 65813 b
821	821
822	822
823	823	SB3517- 23 -LRB103 35732 LNS 65813 b SB3517 - 23 - LRB103 35732 LNS 65813 b
824	824	SB3517 - 23 - LRB103 35732 LNS 65813 b
825	825	1 writing, or by electronic or other means personal information
826	826	2 by the business to a third party for monetary or other valuable
827	827	3 consideration.
828	828	4 "Sensitive personal information" means:
829	829	5 (1) personal information that reveals:
830	830	6 (A) a consumer's social security, driver's
831	831	7 license, state identification card, or passport
832	832	8 number;
833	833	9 (B) a consumer's account log-in, financial
834	834	10 account, debit card, or credit card number in
835	835	11 combination with any required security or access code,
836	836	12 password, or credentials allowing access to an
837	837	13 account;
838	838	14 (C) a consumer's precise geolocation;
839	839	15 (D) a consumer's racial or ethnic origin,
840	840	16 religious or philosophical beliefs, or union
841	841	17 membership;
842	842	18 (E) the contents of a consumer's mail, email, or
843	843	19 text messages unless the business is the intended
844	844	20 recipient of the communication; or
845	845	21 (F) a consumer's genetic data;
846	846	22 (2) the processing of biometric information for the
847	847	23 purpose of uniquely identifying a consumer;
848	848	24 (3) personal information collected and analyzed
849	849	25 concerning a consumer's health; or
850	850	26 (4) personal information collected and analyzed
851	851
852	852
853	853
854	854
855	855
856	856	SB3517 - 23 - LRB103 35732 LNS 65813 b
857	857
858	858
859	859	SB3517- 24 -LRB103 35732 LNS 65813 b SB3517 - 24 - LRB103 35732 LNS 65813 b
860	860	SB3517 - 24 - LRB103 35732 LNS 65813 b
861	861	1 concerning a consumer's sex life or sexual orientation.
862	862	2 "Sensitive personal information" does not include sensitive
863	863	3 personal information that is publicly available.
864	864	4 "Service" or "services" means work, labor, and services,
865	865	5 including services furnished in connection with the sale or
866	866	6 repair of goods.
867	867	7 "Service provider" means a person that processes personal
868	868	8 information on behalf of a business and that receives from or
869	869	9 on behalf of the business personal information for a business
870	870	10 purpose under a written contract, as long as the contract
871	871	11 prohibits the person from:
872	872	12 (1) selling or sharing the personal information;
873	873	13 (2) retaining, using, or disclosing the personal
874	874	14 information for any purpose other than for the specific
875	875	15 business purposes specified in the contract for the
876	876	16 business, including retaining, using, or disclosing the
877	877	17 personal information for a commercial purpose other than
878	878	18 the business purposes specified in the contract with the
879	879	19 business, or as otherwise permitted by this Act;
880	880	20 (3) retaining, using, or disclosing the personal
881	881	21 information outside of the direct business relationship
882	882	22 between the service provider and the business; or
883	883	23 (4) combining the personal information that the
884	884	24 service provider receives from, or on behalf of, the
885	885	25 business with personal information that it receives from,
886	886	26 or on behalf of, another person or persons, or collects
887	887
888	888
889	889
890	890
891	891
892	892	SB3517 - 24 - LRB103 35732 LNS 65813 b
893	893
894	894
895	895	SB3517- 25 -LRB103 35732 LNS 65813 b SB3517 - 25 - LRB103 35732 LNS 65813 b
896	896	SB3517 - 25 - LRB103 35732 LNS 65813 b
897	897	1 from its own interaction with the consumer.
898	898	2 "Share", "shared", or "sharing" means sharing, renting,
899	899	3 releasing, disclosing, disseminating, making available,
900	900	4 transferring, or otherwise communicating orally, in writing,
901	901	5 or by electronic or other means personal information by the
902	902	6 business to a third party for cross-context behavioral
903	903	7 advertising, whether for monetary or other valuable
904	904	8 consideration, including transactions between a business and a
905	905	9 third party for cross-context behavioral advertising for the
906	906	10 benefit of a business in which no money is exchanged.
907	907	11 "Third party" means a person who is not:
908	908	12 (1) the business with whom the consumer intentionally
909	909	13 interacts and that collects personal information from the
910	910	14 consumer as part of the consumer's current interaction
911	911	15 with the business under this Act;
912	912	16 (2) a service provider to the business; or
913	913	17 (3) a contractor.
914	914	18 "Unique identifier" or "unique personal identifier" means
915	915	19 a persistent identifier that can be used to recognize a
916	916	20 consumer, family, or device that is linked to a consumer or
917	917	21 family, over time and across different services, including,
918	918	22 but not limited to, a device identifier, Internet Protocol
919	919	23 address, cookies, beacons, pixel tags, mobile ad identifiers,
920	920	24 or similar technology, customer number, unique pseudonym, or
921	921	25 user alias, telephone numbers, or other forms of persistent or
922	922	26 probabilistic identifiers that can be used to identify a
923	923
924	924
925	925
926	926
927	927
928	928	SB3517 - 25 - LRB103 35732 LNS 65813 b
929	929
930	930
931	931	SB3517- 26 -LRB103 35732 LNS 65813 b SB3517 - 26 - LRB103 35732 LNS 65813 b
932	932	SB3517 - 26 - LRB103 35732 LNS 65813 b
933	933	1 particular consumer or device that is linked to a consumer or
934	934	2 family.
935	935	3 "Vehicle information" means the vehicle information
936	936	4 number, make, model, year, and odometer reading.
937	937	5 "Vehicle manufacturer" means any person who produces from
938	938	6 raw materials or new basic components a vehicle of a type
939	939	7 subject to registration, off-highway motorcycles or
940	940	8 all-terrain vehicles subject to identification, or trailers
941	941	9 subject to identification, or who permanently alters, for
942	942	10 purposes of retail sales, new commercial vehicles by
943	943	11 converting the vehicles into house cars.
944	944	12 "Verifiable consumer request" means a request that is made
945	945	13 by a consumer, by a consumer on behalf of the consumer's minor
946	946	14 child, by a natural person or a person registered with the
947	947	15 Secretary of State authorized by the consumer to act on the
948	948	16 consumer's behalf, or by a person who has power of attorney,
949	949	17 and that the business can reasonably verify, using
950	950	18 commercially reasonable methods to be the consumer about whom
951	951	19 the business has collected personal information.
952	952	20 Section 5-15. Miscellaneous provisions.
953	953	21 (a) The joint venture or partnership and each business
954	954	22 that composes the joint venture or partnership shall
955	955	23 separately be considered a single business, except that
956	956	24 personal information in the possession of each business and
957	957	25 disclosed to the joint venture or partnership shall not be
958	958
959	959
960	960
961	961
962	962
963	963	SB3517 - 26 - LRB103 35732 LNS 65813 b
964	964
965	965
966	966	SB3517- 27 -LRB103 35732 LNS 65813 b SB3517 - 27 - LRB103 35732 LNS 65813 b
967	967	SB3517 - 27 - LRB103 35732 LNS 65813 b
968	968	1 shared with the other business.
969	969	2 (b) A contractor may combine personal information to
970	970	3 perform any business purpose, except as provided for in
971	971	4 paragraph (6) of the definition of business purposes and in
972	972	5 rules adopted by the Agency.
973	973	6 (c) If a contractor engages any other person to assist it
974	974	7 in processing personal information for a business purpose on
975	975	8 behalf of that business, or if any other person engaged by the
976	976	9 contractor engages another person to assist in processing
977	977	10 personal information for that business purposes, it shall
978	978	11 notify the business of that engagement, and the engagement
979	979	12 shall be under a written contract binding the other person to
980	980	13 observe all of the requirements set forth in the definition of
981	981	14 contractor.
982	982	15 (d) A business may attempt to reidentify the deindentified
983	983	16 personal information solely for the purpose of determining
984	984	17 whether its deidentification processes satisfies the
985	985	18 requirements of the definition of deidentified.
986	986	19 (e) Research with personal information that may have been
987	987	20 collected from a consumer in the course of consumer's
988	988	21 interactions with a business's service or device for other
989	989	22 purposes shall be:
990	990	23 (1) compatible with the business purpose for which the
991	991	24 personal information was collected;
992	992	25 (2) subsequently pseudonymized and deidentified, or
993	993	26 deidentified and in the aggregate, such that the
994	994
995	995
996	996
997	997
998	998
999	999	SB3517 - 27 - LRB103 35732 LNS 65813 b
1000	1000
1001	1001
1002	1002	SB3517- 28 -LRB103 35732 LNS 65813 b SB3517 - 28 - LRB103 35732 LNS 65813 b
1003	1003	SB3517 - 28 - LRB103 35732 LNS 65813 b
1004	1004	1 information cannot reasonably identify, relate to,
1005	1005	2 describe, be capable of being associated with, or be
1006	1006	3 linked, directly or indirectly, to a particular consumer,
1007	1007	4 by a business;
1008	1008	5 (3) made subject to technical safeguards that prohibit
1009	1009	6 reidentification of the consumer to whom the information
1010	1010	7 may pertain, other than as needed to support the research;
1011	1011	8 (4) subject to business processes that specifically
1012	1012	9 prohibit reidentification of the information, other than
1013	1013	10 as needed to support the research;
1014	1014	11 (5) made subject to business processes to prevent
1015	1015	12 inadvertent release of deidentified information;
1016	1016	13 (6) protected from any reidentification attempts;
1017	1017	14 (7) used solely for research purposes that are
1018	1018	15 compatible with the context in which the personal
1019	1019	16 information was collected; and
1020	1020	17 (8) subjected by the business conducting the research
1021	1021	18 to additional security controls that limit access to the
1022	1022	19 research data to only those individuals as are necessary
1023	1023	20 to carry out the research purpose.
1024	1024	21 (f) A business that does not sell or share personal
1025	1025	22 information when:
1026	1026	23 (1) a consumer uses or directs the business to
1027	1027	24 intentionally:
1028	1028	25 (A) disclose personal information; or
1029	1029	26 (B) interact with one or more third parties;
1030	1030
1031	1031
1032	1032
1033	1033
1034	1034
1035	1035	SB3517 - 28 - LRB103 35732 LNS 65813 b
1036	1036
1037	1037
1038	1038	SB3517- 29 -LRB103 35732 LNS 65813 b SB3517 - 29 - LRB103 35732 LNS 65813 b
1039	1039	SB3517 - 29 - LRB103 35732 LNS 65813 b
1040	1040	1 (2) the business uses or shares an identifier for a
1041	1041	2 consumer who has opted-out of the sale of personal
1042	1042	3 information or limited the use of sensitive personal
1043	1043	4 information for the purposes of altering persons that the
1044	1044	5 consumer has opted-out of the sale of personal information
1045	1045	6 or limited the use of sensitive personal information; or
1046	1046	7 (3) the business transfers to a third party the
1047	1047	8 personal information as an asset that is part of a merger,
1048	1048	9 acquisition, bankruptcy, or other transaction in which the
1049	1049	10 third party assumes control of all or part of the
1050	1050	11 business, as long as that personal information is used or
1051	1051	12 shared consistently with this Act. If a third party
1052	1052	13 materially alters how it uses or shares the personal
1053	1053	14 information in a manner that is materially inconsistent
1054	1054	15 with the promises made at the time of collection, it shall
1055	1055	16 provide prior notice of the new or changed practice to the
1056	1056	17 consumer. The notice shall be sufficiently prominent and
1057	1057	18 robust to ensure that existing consumers can easily
1058	1058	19 exercise their choices consistently with this Act. This
1059	1059	20 paragraph does not authorize a business to make material,
1060	1060	21 retroactive privacy policy changes or make other changes
1061	1061	22 in their privacy policy in a manner that would violate the
1062	1062	23 Consumer Fraud and Deceptive Business Practices Act.
1063	1063	24 (g) A service provider may combine personal information to
1064	1064	25 perform any business purpose, except as provided for in
1065	1065	26 paragraph (6) of the definition of business purpose in Section
1066	1066
1067	1067
1068	1068
1069	1069
1070	1070
1071	1071	SB3517 - 29 - LRB103 35732 LNS 65813 b
1072	1072
1073	1073
1074	1074	SB3517- 30 -LRB103 35732 LNS 65813 b SB3517 - 30 - LRB103 35732 LNS 65813 b
1075	1075	SB3517 - 30 - LRB103 35732 LNS 65813 b
1076	1076	1 5-10 and in rules adopted by the Agency. The contract may,
1077	1077	2 subject to agreement with the service provider, permit the
1078	1078	3 business to monitor the service provider's compliance with the
1079	1079	4 contract through measures, including, but not limited to,
1080	1080	5 ongoing manual reviews and automated scans and regular
1081	1081	6 assessments, audits, or other technical and operational
1082	1082	7 testing at least once every 12 months.
1083	1083	8 (h) If a service provider engages any other person to
1084	1084	9 assist it in processing personal information for a business
1085	1085	10 purpose on behalf of the business, or if any other person
1086	1086	11 engaged by the service provider engages another person to
1087	1087	12 assist in processing personal information for that business
1088	1088	13 purpose, it shall notify the business of that engagement, and
1089	1089	14 the engagement shall be under a written contract binding the
1090	1090	15 other person to observe all the requirements set forth in the
1091	1091	16 definition of service provider.
1092	1092	17 (i) A business is not obligated to provide information to
1093	1093	18 the consumer under Sections 10-20 and 10-25 to delete personal
1094	1094	19 information or to correct inaccurate personal information, if
1095	1095	20 the business cannot verify that the consumer making the
1096	1096	21 request is the consumer about whom the business has collected
1097	1097	22 information or is a person authorized by the consumer to act on
1098	1098	23 such consumer's behalf.
1099	1099	24 Article 10. Personal Information
1100	1100
1101	1101
1102	1102
1103	1103
1104	1104
1105	1105	SB3517 - 30 - LRB103 35732 LNS 65813 b
1106	1106
1107	1107
1108	1108	SB3517- 31 -LRB103 35732 LNS 65813 b SB3517 - 31 - LRB103 35732 LNS 65813 b
1109	1109	SB3517 - 31 - LRB103 35732 LNS 65813 b
1110	1110	1 Section 10-5. General duties of businesses that collect
1111	1111	2 personal information.
1112	1112	3 (a) A business that controls the collection of personal
1113	1113	4 information shall, at or before the point of collection,
1114	1114	5 inform consumers of:
1115	1115	6 (1) the categories of personal information to be
1116	1116	7 collected and the purposes for which the categories of
1117	1117	8 personal information are collected or used and whether
1118	1118	9 that information is sold or shared. A business shall not
1119	1119	10 collect additional categories of personal information or
1120	1120	11 use personal information collected for additional purposes
1121	1121	12 that are incompatible with the disclosed purpose for which
1122	1122	13 the personal information was collected without providing
1123	1123	14 the consumer with notice consistent with this Section
1124	1124	15 (2) if the business collects sensitive personal
1125	1125	16 information, the categories of sensitive personal
1126	1126	17 information to be collected and the purposes for which the
1127	1127	18 categories of sensitive personal information to be
1128	1128	19 collected. A business shall not collect additional
1129	1129	20 categories of sensitive personal information or use
1130	1130	21 sensitive personal information collected for additional
1131	1131	22 purposes that are incompatible with the disclosed purpose
1132	1132	23 for which the sensitive personal information was collected
1133	1133	24 without providing the consumer with notice consistent with
1134	1134	25 this Section; and
1135	1135	26 (3) the length of time the business intends to retain
1136	1136
1137	1137
1138	1138
1139	1139
1140	1140
1141	1141	SB3517 - 31 - LRB103 35732 LNS 65813 b
1142	1142
1143	1143
1144	1144	SB3517- 32 -LRB103 35732 LNS 65813 b SB3517 - 32 - LRB103 35732 LNS 65813 b
1145	1145	SB3517 - 32 - LRB103 35732 LNS 65813 b
1146	1146	1 each category of personal information, including sensitive
1147	1147	2 personal information, or, if that is not possible, the
1148	1148	3 criteria used to determine that period provided that a
1149	1149	4 business shall not retain personal information or
1150	1150	5 sensitive personal information for each disclosed purpose
1151	1151	6 for which the personal information was collected for
1152	1152	7 longer than is reasonably necessary for that disclosed
1153	1153	8 purpose.
1154	1154	9 (b) A business that, acting as a third party, controls the
1155	1155	10 collection of personal information may satisfy its obligation
1156	1156	11 under subsection (a) by providing the required information
1157	1157	12 prominently and conspicuously on the homepage of its Internet
1158	1158	13 website. If a business acting as a third party controls the
1159	1159	14 collection of personal information on its premises, including
1160	1160	15 in a vehicle, then the business shall, at or before the point
1161	1161	16 of collection, inform consumers as to the categories of
1162	1162	17 personal information to be collected and the purposes for
1163	1163	18 which the categories of personal information are used, and
1164	1164	19 whether that personal information is sold, in a clear and
1165	1165	20 conspicuous manner at the location.
1166	1166	21 (c) Collection, use, retention, and sharing of personal
1167	1167	22 information by a business shall be reasonably necessary and
1168	1168	23 proportionate to achieve the purposes for which the personal
1169	1169	24 information was collected or processed, or for another
1170	1170	25 disclosed purpose that is compatible with the context in which
1171	1171	26 the personal information was collected, and not further
1172	1172
1173	1173
1174	1174
1175	1175
1176	1176
1177	1177	SB3517 - 32 - LRB103 35732 LNS 65813 b
1178	1178
1179	1179
1180	1180	SB3517- 33 -LRB103 35732 LNS 65813 b SB3517 - 33 - LRB103 35732 LNS 65813 b
1181	1181	SB3517 - 33 - LRB103 35732 LNS 65813 b
1182	1182	1 processed in a manner that is incompatible with those
1183	1183	2 purposes.
1184	1184	3 (d) A business that collects personal information and that
1185	1185	4 sells that personal information to, or shares it with, a third
1186	1186	5 party or that discloses it to a service provider or contractor
1187	1187	6 for a business purpose shall enter into an agreement with the
1188	1188	7 third party, service provider, or contractor that:
1189	1189	8 (1) specifies that the personal information is sold or
1190	1190	9 disclosed by the business only for limited and specified
1191	1191	10 purposes;
1192	1192	11 (2) obligates the third party, service provider, or
1193	1193	12 contractor to comply with applicable obligations under
1194	1194	13 this Act and obligate those persons to provide the same
1195	1195	14 level of privacy protection as is required under this Act;
1196	1196	15 (3) grants the business rights to take reasonable and
1197	1197	16 appropriate steps to help ensure that the third party,
1198	1198	17 service provider, or contractor uses the personal
1199	1199	18 information transferred in a manner consistent with the
1200	1200	19 obligations of the business under this Act;
1201	1201	20 (4) requires the third party, service provider, or
1202	1202	21 contractor to notify the business if it makes a
1203	1203	22 determination that it can no longer meet its obligations
1204	1204	23 under this Act; and
1205	1205	24 (5) grants the business the right, upon notice, to
1206	1206	25 take reasonable and appropriate steps to stop and
1207	1207	26 remediate unauthorized use of personal information.
1208	1208
1209	1209
1210	1210
1211	1211
1212	1212
1213	1213	SB3517 - 33 - LRB103 35732 LNS 65813 b
1214	1214
1215	1215
1216	1216	SB3517- 34 -LRB103 35732 LNS 65813 b SB3517 - 34 - LRB103 35732 LNS 65813 b
1217	1217	SB3517 - 34 - LRB103 35732 LNS 65813 b
1218	1218	1 (e) A business that collects personal information shall
1219	1219	2 implement reasonable security procedures and practices
1220	1220	3 appropriate to the nature of the personal information to
1221	1221	4 protect the personal information from unauthorized or illegal
1222	1222	5 access, destruction, use, modification, or disclosure.
1223	1223	6 (f) Nothing in this Section shall require a business to
1224	1224	7 disclose trade secrets.
1225	1225	8 Section 10-10. Right to delete personal information.
1226	1226	9 (a) A consumer shall have the right to request that a
1227	1227	10 business delete any personal information about the consumer
1228	1228	11 which the business has collected from the consumer.
1229	1229	12 (b) A business that collects personal information shall
1230	1230	13 disclose the consumer's rights to request the deletion of the
1231	1231	14 personal information.
1232	1232	15 (c) A business that receives a verifiable consumer request
1233	1233	16 from a consumer to delete the personal information under
1234	1234	17 subsection (a) shall delete the personal information from its
1235	1235	18 records, notify any service providers or contractors to delete
1236	1236	19 the personal information from their records, and notify all
1237	1237	20 third parties to whom the business has sold or shared the
1238	1238	21 personal information to delete the personal information unless
1239	1239	22 this proves impossible or involves disproportionate effort.
1240	1240	23 The business may maintain a confidential record of
1241	1241	24 deletion requests solely for the purpose of preventing the
1242	1242	25 personal information of a consumer who has submitted a
1243	1243
1244	1244
1245	1245
1246	1246
1247	1247
1248	1248	SB3517 - 34 - LRB103 35732 LNS 65813 b
1249	1249
1250	1250
1251	1251	SB3517- 35 -LRB103 35732 LNS 65813 b SB3517 - 35 - LRB103 35732 LNS 65813 b
1252	1252	SB3517 - 35 - LRB103 35732 LNS 65813 b
1253	1253	1 deletion request from being sold, for compliance with laws or
1254	1254	2 for other purposes, solely to the extent permissible under
1255	1255	3 this Act.
1256	1256	4 A service provider or contractor shall cooperate with the
1257	1257	5 business in responding to a verifiable consumer request, and,
1258	1258	6 at the direction of the business, shall delete, or enable the
1259	1259	7 business to delete, and notify any of its own service
1260	1260	8 providers or contractors to delete the personal information
1261	1261	9 collected, used, processed, or retained by the service
1262	1262	10 provider or contractor. The service provider or contractor
1263	1263	11 shall notify any service providers, contractors, or third
1264	1264	12 parties who may have accessed personal information from or
1265	1265	13 through the service provider or contractor, unless the
1266	1266	14 information was accessed at the direction of the business, to
1267	1267	15 delete the personal information unless this proves impossible
1268	1268	16 or involves disproportionate effort. A service provider or
1269	1269	17 contractor shall not be required to comply with a deletion
1270	1270	18 request submitted by the consumer directly to the service
1271	1271	19 provider or contractor to the extent that the service provider
1272	1272	20 or contractor has collected, used, processed, or retained the
1273	1273	21 personal information in its role as a service provider or
1274	1274	22 contractor to the business.
1275	1275	23 (d) A business, or a service provider or contractor acting
1276	1276	24 under its contract with the business, shall not be required to
1277	1277	25 comply with a consumer's request to delete personal
1278	1278	26 information if it is reasonably necessary for the business,
1279	1279
1280	1280
1281	1281
1282	1282
1283	1283
1284	1284	SB3517 - 35 - LRB103 35732 LNS 65813 b
1285	1285
1286	1286
1287	1287	SB3517- 36 -LRB103 35732 LNS 65813 b SB3517 - 36 - LRB103 35732 LNS 65813 b
1288	1288	SB3517 - 36 - LRB103 35732 LNS 65813 b
1289	1289	1 service provider, or contractor to maintain the personal
1290	1290	2 information in order to:
1291	1291	3 (1) complete the transaction for which the personal
1292	1292	4 information was collected, fulfill the terms of a written
1293	1293	5 warranty or product recall conducted in accordance with
1294	1294	6 federal law, provide a good or service requested by the
1295	1295	7 consumer, or reasonably anticipate an ongoing business
1296	1296	8 relationship with the consumer, or otherwise perform a
1297	1297	9 contract between the business and the consumer;
1298	1298	10 (2) help to ensure security and integrity to the
1299	1299	11 extent the use of the personal information is reasonably
1300	1300	12 necessary and proportionate for those purposes;
1301	1301	13 (3) debug to identify and repair errors that impair
1302	1302	14 existing intended functionality;
1303	1303	15 (4) exercise free speech, ensure the right of another
1304	1304	16 consumer to exercise that consumer's right of free speech,
1305	1305	17 or exercise another right provided for by law;
1306	1306	18 (5) comply with the Protecting Household Privacy Act;
1307	1307	19 (6) engage in public or peer-reviewed scientific,
1308	1308	20 historical, or statistical research that conforms or
1309	1309	21 adheres to all other applicable ethics and privacy laws,
1310	1310	22 when the deletion of the information is likely to render
1311	1311	23 impossible or seriously impair the ability to complete
1312	1312	24 such research, if the consumer has provided informed
1313	1313	25 consent;
1314	1314	26 (7) to enable solely internal uses that are reasonably
1315	1315
1316	1316
1317	1317
1318	1318
1319	1319
1320	1320	SB3517 - 36 - LRB103 35732 LNS 65813 b
1321	1321
1322	1322
1323	1323	SB3517- 37 -LRB103 35732 LNS 65813 b SB3517 - 37 - LRB103 35732 LNS 65813 b
1324	1324	SB3517 - 37 - LRB103 35732 LNS 65813 b
1325	1325	1 aligned with the expectations of the consumer based on the
1326	1326	2 consumer's relationship with the business and compatible
1327	1327	3 with the context in which the consumer provided the
1328	1328	4 information; or
1329	1329	5 (8) comply with a legal obligation.
1330	1330	6 Section 10-15. Right to correct inaccurate personal
1331	1331	7 information.
1332	1332	8 (a) A consumer shall have the right to request a business
1333	1333	9 that maintains inaccurate personal information about the
1334	1334	10 consumer to correct that inaccurate personal information,
1335	1335	11 taking into account the nature of the personal information and
1336	1336	12 the purposes of the processing of the personal information.
1337	1337	13 (b) A business that collects personal information shall
1338	1338	14 disclose the consumer's right to request correction of
1339	1339	15 inaccurate personal information.
1340	1340	16 (c) A business that receives a verifiable consumer request
1341	1341	17 to correct inaccurate personal information shall use
1342	1342	18 commercially reasonable efforts to correct the inaccurate
1343	1343	19 personal information as directed by the consumer.
1344	1344	20 Section 10-20. Right to know what personal information is
1345	1345	21 being collected; right to access personal information.
1346	1346	22 (a) A consumer shall have the right to request that a
1347	1347	23 business that collects personal information about the consumer
1348	1348	24 disclose to the consumer:
1349	1349
1350	1350
1351	1351
1352	1352
1353	1353
1354	1354	SB3517 - 37 - LRB103 35732 LNS 65813 b
1355	1355
1356	1356
1357	1357	SB3517- 38 -LRB103 35732 LNS 65813 b SB3517 - 38 - LRB103 35732 LNS 65813 b
1358	1358	SB3517 - 38 - LRB103 35732 LNS 65813 b
1359	1359	1 (1) the categories of personal information it has
1360	1360	2 collected about the consumer;
1361	1361	3 (2) the categories of sources from which the personal
1362	1362	4 information is collected;
1363	1363	5 (3) the business or commercial purpose for collecting,
1364	1364	6 selling, or sharing personal information;
1365	1365	7 (4) the categories of third parties to whom the
1366	1366	8 business discloses personal information; and
1367	1367	9 (5) the specific pieces of personal information it has
1368	1368	10 collected about that consumer.
1369	1369	11 (b) A business that collects personal information shall
1370	1370	12 disclose to the consumer the information specified in
1371	1371	13 subsection (a) upon receipt of a verifiable consumer request
1372	1372	14 from the consumer.
1373	1373	15 (c) A business that collects personal information shall
1374	1374	16 disclose that a consumer has the right to request the specific
1375	1375	17 pieces of information the business has collected about that
1376	1376	18 consumer.
1377	1377	19 Section 10-25. Right to know what personal information is
1378	1378	20 sold or shared and to whom.
1379	1379	21 (a) A consumer shall have the right to request that a
1380	1380	22 business that sells or shares personal information, or that
1381	1381	23 discloses personal information for a business purpose,
1382	1382	24 disclose to that consumer:
1383	1383	25 (1) the categories of personal information that the
1384	1384
1385	1385
1386	1386
1387	1387
1388	1388
1389	1389	SB3517 - 38 - LRB103 35732 LNS 65813 b
1390	1390
1391	1391
1392	1392	SB3517- 39 -LRB103 35732 LNS 65813 b SB3517 - 39 - LRB103 35732 LNS 65813 b
1393	1393	SB3517 - 39 - LRB103 35732 LNS 65813 b
1394	1394	1 business collected about the consumer;
1395	1395	2 (2) the categories of personal information that the
1396	1396	3 business sold or shared about the consumer and the
1397	1397	4 categories of third parties to whom the personal
1398	1398	5 information was sold or shared, by category or categories
1399	1399	6 of personal information for each category of third parties
1400	1400	7 to whom the personal information was sold or shared; and
1401	1401	8 (3) the categories of personal information that the
1402	1402	9 business disclosed about the consumer for a business
1403	1403	10 purpose and the categories of persons to whom it was
1404	1404	11 disclosed for a business purpose.
1405	1405	12 (b) A business that sells or shares personal information,
1406	1406	13 or that discloses personal information for a business purpose,
1407	1407	14 shall disclose the personal information specified in
1408	1408	15 subsection (a) to the consumer upon receipt of a verifiable
1409	1409	16 consumer request from the consumer.
1410	1410	17 (c) A business that sells or shares personal information,
1411	1411	18 or that discloses personal information for a business purpose,
1412	1412	19 shall disclose:
1413	1413	20 (1) the category or categories of personal information
1414	1414	21 it has sold or shared, or if the business has not sold or
1415	1415	22 shared personal information, it shall disclose that fact;
1416	1416	23 and
1417	1417	24 (2) the category or categories of personal information
1418	1418	25 it has disclosed for a business purpose, or if the
1419	1419	26 business has not disclosed personal information for a
1420	1420
1421	1421
1422	1422
1423	1423
1424	1424
1425	1425	SB3517 - 39 - LRB103 35732 LNS 65813 b
1426	1426
1427	1427
1428	1428	SB3517- 40 -LRB103 35732 LNS 65813 b SB3517 - 40 - LRB103 35732 LNS 65813 b
1429	1429	SB3517 - 40 - LRB103 35732 LNS 65813 b
1430	1430	1 business purpose, it shall disclose that fact.
1431	1431	2 (d) A third party shall not sell or share personal
1432	1432	3 information that has been sold to, or shared with, the third
1433	1433	4 party by a business unless the consumer has received explicit
1434	1434	5 notice and is provided an opportunity to exercise the right to
1435	1435	6 opt out.
1436	1436	7 Section 10-30. Right to opt out of sale or sharing of
1437	1437	8 personal information.
1438	1438	9 (a) A consumer shall have the right, at any time, to direct
1439	1439	10 a business that sells or shares personal information to third
1440	1440	11 parties not to sell or share the personal information. This
1441	1441	12 right may be referred to as the right to opt out of sale or
1442	1442	13 sharing.
1443	1443	14 (b) A business that sells personal information to, or
1444	1444	15 shares it with, third parties shall provide notice to
1445	1445	16 consumers that this information may be sold or shared and that
1446	1446	17 consumers have the right to opt out of the sale or sharing of
1447	1447	18 their personal information.
1448	1448	19 (c) Notwithstanding subsection (a), a business shall not
1449	1449	20 sell or share the personal information of consumers if the
1450	1450	21 business has actual knowledge that the consumer is less than
1451	1451	22 16 years of age, unless the consumer, in the case of consumers
1452	1452	23 at least 13 years of age and less than 16 years of age, or the
1453	1453	24 consumer's parent or guardian in the case of consumers who are
1454	1454	25 less than 13 years of age, has affirmatively authorized the
1455	1455
1456	1456
1457	1457
1458	1458
1459	1459
1460	1460	SB3517 - 40 - LRB103 35732 LNS 65813 b
1461	1461
1462	1462
1463	1463	SB3517- 41 -LRB103 35732 LNS 65813 b SB3517 - 41 - LRB103 35732 LNS 65813 b
1464	1464	SB3517 - 41 - LRB103 35732 LNS 65813 b
1465	1465	1 sale or sharing of the personal information. A business that
1466	1466	2 willfully disregards the consumer's age shall be deemed to
1467	1467	3 have had actual knowledge of the consumer's age.
1468	1468	4 (d) A business that has received direction from a consumer
1469	1469	5 not to sell or share personal information or, in the case of a
1470	1470	6 minor consumer's personal information has not received consent
1471	1471	7 to sell or share the minor consumer's personal information,
1472	1472	8 shall be prohibited from selling or sharing the personal
1473	1473	9 information after its receipt of the consumer's direction,
1474	1474	10 unless the consumer subsequently provides consent, for the
1475	1475	11 sale or sharing of the personal information.
1476	1476	12 Section 10-35. Right to limit use and disclosure of
1477	1477	13 sensitive personal information.
1478	1478	14 (a) A consumer shall have the right, at any time, to direct
1479	1479	15 a business that collects sensitive personal information to
1480	1480	16 limit its use of the sensitive personal information to that
1481	1481	17 use which is necessary to perform the services or provide the
1482	1482	18 goods reasonably expected by an average consumer who requests
1483	1483	19 those goods or services, to perform the services set forth in
1484	1484	20 paragraphs (2), (4), (5), and (8) in the definition of
1485	1485	21 business purpose in Section 5-10, and as authorized by rule. A
1486	1486	22 business that uses or discloses sensitive personal information
1487	1487	23 for purposes other than those specified in this subsection
1488	1488	24 shall provide notice to consumers that this information may be
1489	1489	25 used, or disclosed to a service provider or contractor, for
1490	1490
1491	1491
1492	1492
1493	1493
1494	1494
1495	1495	SB3517 - 41 - LRB103 35732 LNS 65813 b
1496	1496
1497	1497
1498	1498	SB3517- 42 -LRB103 35732 LNS 65813 b SB3517 - 42 - LRB103 35732 LNS 65813 b
1499	1499	SB3517 - 42 - LRB103 35732 LNS 65813 b
1500	1500	1 additional, specified purposes and that consumers have the
1501	1501	2 right to limit the use or disclosure of their sensitive
1502	1502	3 personal information.
1503	1503	4 (b) A business that has received direction from a consumer
1504	1504	5 not to use or disclose the sensitive personal information,
1505	1505	6 except as authorized under subsection (a), shall be prohibited
1506	1506	7 from using or disclosing the sensitive personal information
1507	1507	8 for any other purpose after its receipt of the consumer's
1508	1508	9 direction unless the consumer subsequently provides consent
1509	1509	10 for the use or disclosure of the sensitive personal
1510	1510	11 information for additional purposes.
1511	1511	12 (c) A service provider or contractor that assists a
1512	1512	13 business in performing the purposes authorized by subsection
1513	1513	14 (a) may not use the sensitive personal information after it
1514	1514	15 has received instructions from the business and to the extent
1515	1515	16 it has actual knowledge that the sensitive personal
1516	1516	17 information is sensitive personal information for any other
1517	1517	18 purpose. A service provider or contractor is only required to
1518	1518	19 limit its use of sensitive personal information received under
1519	1519	20 a written contract with the business in response to
1520	1520	21 instructions from the business and only with respect to its
1521	1521	22 relationship with that business.
1522	1522	23 (d) Sensitive personal information that is collected or
1523	1523	24 processed without the purpose of inferring characteristics
1524	1524	25 about a consumer is not subject to this Section, as further
1525	1525	26 defined by rule, and shall be treated as personal information.
1526	1526
1527	1527
1528	1528
1529	1529
1530	1530
1531	1531	SB3517 - 42 - LRB103 35732 LNS 65813 b
1532	1532
1533	1533
1534	1534	SB3517- 43 -LRB103 35732 LNS 65813 b SB3517 - 43 - LRB103 35732 LNS 65813 b
1535	1535	SB3517 - 43 - LRB103 35732 LNS 65813 b
1536	1536	1 Section 10-40. Right of no retaliation following opt-out
1537	1537	2 or exercise of other rights.
1538	1538	3 (a) A business shall not discriminate against a consumer
1539	1539	4 because the consumer exercised any of the consumer's rights
1540	1540	5 under this Act, including, but not limited to:
1541	1541	6 (1) denying goods or services to the consumer;
1542	1542	7 (2) charging different prices or rates for goods or
1543	1543	8 services, including through the use of discounts or other
1544	1544	9 benefits or imposing penalties;
1545	1545	10 (3) providing a different level or quality of goods or
1546	1546	11 services to the consumer; or
1547	1547	12 (4) suggesting that the consumer will receive a
1548	1548	13 different price or rate for goods or services or a
1549	1549	14 different level or quality of goods or services.
1550	1550	15 A business shall not retaliate against an employee
1551	1551	16 applicant for employment, or independent contractor for
1552	1552	17 exercising their rights under this Act.
1553	1553	18 Nothing in this subsection prohibits a business from
1554	1554	19 charging a consumer a different price or rate, or from
1555	1555	20 providing a different level or quality of goods or services,
1556	1556	21 to the consumer if that difference is reasonably related to
1557	1557	22 the value provided to the business by the consumer's data.
1558	1558	23 This subsection does not prohibit a business from offering
1559	1559	24 loyalty, rewards, premium features, discounts, or club card
1560	1560	25 programs consistent with this Act.
1561	1561
1562	1562
1563	1563
1564	1564
1565	1565
1566	1566	SB3517 - 43 - LRB103 35732 LNS 65813 b
1567	1567
1568	1568
1569	1569	SB3517- 44 -LRB103 35732 LNS 65813 b SB3517 - 44 - LRB103 35732 LNS 65813 b
1570	1570	SB3517 - 44 - LRB103 35732 LNS 65813 b
1571	1571	1 (b) A business may offer financial incentives, including
1572	1572	2 payments to consumers as compensation, for the collection of
1573	1573	3 personal information, or the retention of personal
1574	1574	4 information. A business may also offer a different price,
1575	1575	5 rate, level, or quality of goods or services to the consumer if
1576	1576	6 that price or difference is reasonably related to the value
1577	1577	7 provided to the business by the consumer's data.
1578	1578	8 A business that offers any financial incentives under this
1579	1579	9 subsection shall notify consumers of the financial incentives
1580	1580	10 under Section 10-45.
1581	1581	11 A business may enter a consumer into a financial incentive
1582	1582	12 program only if the consumer gives the business prior opt-in
1583	1583	13 consent based on clearly described material terms of the
1584	1584	14 financial incentive program, which may be revoked by the
1585	1585	15 consumer at any time. If a consumer refuses to provide opt-in
1586	1586	16 consent, then the business shall wait for at least 12 months
1587	1587	17 before next requesting that the consumer provide opt-in
1588	1588	18 consent, or as prescribed by rules.
1589	1589	19 A business shall not use financial incentive practices
1590	1590	20 that are unjust, unreasonable, coercive, or usurious in
1591	1591	21 nature.
1592	1592	22 Section 10-45. Notice, disclosure, correction, and
1593	1593	23 deletion requirements.
1594	1594	24 (a) In order to comply with Sections 10-5, 10-10, 10-15,
1595	1595	25 10-20, 10-25, and 10-45, a business shall, in a form that is
1596	1596
1597	1597
1598	1598
1599	1599
1600	1600
1601	1601	SB3517 - 44 - LRB103 35732 LNS 65813 b
1602	1602
1603	1603
1604	1604	SB3517- 45 -LRB103 35732 LNS 65813 b SB3517 - 45 - LRB103 35732 LNS 65813 b
1605	1605	SB3517 - 45 - LRB103 35732 LNS 65813 b
1606	1606	1 reasonably accessible to consumers:
1607	1607	2 (1) (A) make available to consumers 2 or more
1608	1608	3 designated methods for submitting requests for information
1609	1609	4 required to be disclosed under Sections 10-20 and 10-25 or
1610	1610	5 requests for deletion or correction under Sections 10-10
1611	1611	6 and 10-15, including, at a minimum, a toll-free telephone
1612	1612	7 number. A business that operates exclusively online and
1613	1613	8 has a direct relationship with a consumer from whom it
1614	1614	9 collects personal information shall only be required to
1615	1615	10 provide an email address for submitting requests for
1616	1616	11 information required to be disclosed under Sections 10-20
1617	1617	12 and 10-25;
1618	1618	13 (B) if the business maintains an Internet website,
1619	1619	14 make the internet website available to consumers to submit
1620	1620	15 requests for information required to be disclosed under
1621	1621	16 Sections 10-20 and 10-25 or requests for deletion or
1622	1622	17 correction under Sections 10-10 and 10-15;
1623	1623	18 (2) disclose and deliver the required information to a
1624	1624	19 consumer free of charge, correct inaccurate personal
1625	1625	20 information, or delete personal information, based on the
1626	1626	21 consumer's request, within 45 days of receiving a
1627	1627	22 verifiable consumer request from the consumer. The
1628	1628	23 business shall promptly take steps to determine whether
1629	1629	24 the request is a verifiable consumer request, but this
1630	1630	25 shall not extend the business's duty to disclose and
1631	1631	26 deliver the information, correct inaccurate personal
1632	1632
1633	1633
1634	1634
1635	1635
1636	1636
1637	1637	SB3517 - 45 - LRB103 35732 LNS 65813 b
1638	1638
1639	1639
1640	1640	SB3517- 46 -LRB103 35732 LNS 65813 b SB3517 - 46 - LRB103 35732 LNS 65813 b
1641	1641	SB3517 - 46 - LRB103 35732 LNS 65813 b
1642	1642	1 information, or delete personal information within 45 days
1643	1643	2 of receipt of the consumer's request. The period to
1644	1644	3 provide the required information, correct inaccurate
1645	1645	4 personal information, or delete personal information may
1646	1646	5 be extended once by an additional 45 days when reasonably
1647	1647	6 necessary, as long as the consumer is provided notice of
1648	1648	7 the extension within the first 45-day period. The
1649	1649	8 disclosure of the required information shall be made in
1650	1650	9 writing and delivered through the consumer's account with
1651	1651	10 the business, if the consumer maintains an account with
1652	1652	11 the business, or by mail or electronically at the
1653	1653	12 consumer's option if the consumer does not maintain an
1654	1654	13 account with the business, in a readily usable format that
1655	1655	14 allows the consumer to transmit this information from one
1656	1656	15 entity to another entity without hindrance. The business
1657	1657	16 may require authentication of the consumer that is
1658	1658	17 reasonable in light of the nature of the personal
1659	1659	18 information requested, but shall not require the consumer
1660	1660	19 to create an account with the business in order to make a
1661	1661	20 verifiable consumer request. If the consumer has an
1662	1662	21 account with the business, the business may require the
1663	1663	22 consumer to use that account to submit a verifiable
1664	1664	23 consumer request.
1665	1665	24 The disclosure of the required information shall cover
1666	1666	25 the 12-month period preceding the business' receipt of the
1667	1667	26 verifiable consumer request. Upon the adoption of a rule
1668	1668
1669	1669
1670	1670
1671	1671
1672	1672
1673	1673	SB3517 - 46 - LRB103 35732 LNS 65813 b
1674	1674
1675	1675
1676	1676	SB3517- 47 -LRB103 35732 LNS 65813 b SB3517 - 47 - LRB103 35732 LNS 65813 b
1677	1677	SB3517 - 47 - LRB103 35732 LNS 65813 b
1678	1678	1 under Section 10-75, a consumer may request that the
1679	1679	2 business disclose the required information beyond the
1680	1680	3 12-month period, and the business shall be required to
1681	1681	4 provide that information unless doing so proves impossible
1682	1682	5 or would involve a disproportionate effort. A consumer's
1683	1683	6 right to request required information beyond the 12-month
1684	1684	7 period, and a business's obligation to provide that
1685	1685	8 information, shall only apply to personal information
1686	1686	9 collected on or after January 1, 2025. Nothing in this
1687	1687	10 subparagraph shall require a business to keep personal
1688	1688	11 information for any length of time;
1689	1689	12 (3) a business that receives a verifiable consumer
1690	1690	13 request under Section 10-20 or 10-25, disclose any
1691	1691	14 personal information it has collected about a consumer,
1692	1692	15 directly or indirectly, including through or by a service
1693	1693	16 provider or contractor, to the consumer. A service
1694	1694	17 provider or contractor shall not be required to comply
1695	1695	18 with a verifiable consumer request received directly from
1696	1696	19 a consumer or consumer's authorized agent under Section
1697	1697	20 10-20 or 10-25 to the extent that the service provider or
1698	1698	21 contractor has collected personal information about the
1699	1699	22 consumer in its role as a service provider or contractor.
1700	1700	23 A service provider or contractor shall provide assistance
1701	1701	24 to a business with which it has a contractual relationship
1702	1702	25 with respect to the business's response to a verifiable
1703	1703	26 consumer request, including, but not limited to, by
1704	1704
1705	1705
1706	1706
1707	1707
1708	1708
1709	1709	SB3517 - 47 - LRB103 35732 LNS 65813 b
1710	1710
1711	1711
1712	1712	SB3517- 48 -LRB103 35732 LNS 65813 b SB3517 - 48 - LRB103 35732 LNS 65813 b
1713	1713	SB3517 - 48 - LRB103 35732 LNS 65813 b
1714	1714	1 providing to the business the personal information in the
1715	1715	2 service provider's or contractor's possession that the
1716	1716	3 service provider or contractor obtained as a result of
1717	1717	4 providing services to the business and by correcting
1718	1718	5 inaccurate information or by enabling the business to do
1719	1719	6 the same. A service provider or contractor that collects
1720	1720	7 personal information under a written contract with a
1721	1721	8 business shall be required to assist the business through
1722	1722	9 appropriate technical and organizational measures in
1723	1723	10 complying with the requirements of subsections (d) through
1724	1724	11 (f) of Section 10-5, taking into account the nature of the
1725	1725	12 processing.
1726	1726	13 (4) for purposes of subsection (b) of Section 10-20:
1727	1727	14 (A) to identify the consumer, associate the
1728	1728	15 information provided to the consumer in the verifiable
1729	1729	16 consumer request to any personal information
1730	1730	17 previously collected by the business about the
1731	1731	18 consumer;
1732	1732	19 (B) identify by category or categories the
1733	1733	20 personal information collected about the consumer for
1734	1734	21 the applicable period by reference to the enumerated
1735	1735	22 category or categories in subsection (c) that most
1736	1736	23 closely describes the personal information collected,
1737	1737	24 the categories of sources from which the personal
1738	1738	25 information was collected, the business or commercial
1739	1739	26 purpose for collecting, selling, or sharing the
1740	1740
1741	1741
1742	1742
1743	1743
1744	1744
1745	1745	SB3517 - 48 - LRB103 35732 LNS 65813 b
1746	1746
1747	1747
1748	1748	SB3517- 49 -LRB103 35732 LNS 65813 b SB3517 - 49 - LRB103 35732 LNS 65813 b
1749	1749	SB3517 - 49 - LRB103 35732 LNS 65813 b
1750	1750	1 personal information, and the categories of third
1751	1751	2 parties to whom the business discloses the personal
1752	1752	3 information; and
1753	1753	4 (C) provide the specific pieces of personal
1754	1754	5 information obtained from the consumer in a format
1755	1755	6 that is easily understandable to the average consumer,
1756	1756	7 and to the extent technically feasible, in a
1757	1757	8 structured, commonly used, machine-readable format
1758	1758	9 that may also be transmitted to another entity at the
1759	1759	10 consumer's request without hindrance. Specific pieces
1760	1760	11 of personal information do not include data generated
1761	1761	12 to help ensure security and integrity or as prescribed
1762	1762	13 by rule. Personal information is not considered to
1763	1763	14 have been disclosed by a business when a consumer
1764	1764	15 instructs a business to transfer the personal
1765	1765	16 information from one business to another in the
1766	1766	17 context of switching services;
1767	1767	18 (5) for purposes of subsection (b) of Section 10-25:
1768	1768	19 (A) identify the consumer and associate the
1769	1769	20 information provided by the consumer in the verifiable
1770	1770	21 consumer request to any personal information
1771	1771	22 previously collected by the business about the
1772	1772	23 consumer;
1773	1773	24 (B) identify by category or categories the
1774	1774	25 personal information of the consumer that the business
1775	1775	26 sold or shared during the applicable period by
1776	1776
1777	1777
1778	1778
1779	1779
1780	1780
1781	1781	SB3517 - 49 - LRB103 35732 LNS 65813 b
1782	1782
1783	1783
1784	1784	SB3517- 50 -LRB103 35732 LNS 65813 b SB3517 - 50 - LRB103 35732 LNS 65813 b
1785	1785	SB3517 - 50 - LRB103 35732 LNS 65813 b
1786	1786	1 reference to the enumerated category in subsection (c)
1787	1787	2 that most closely describes the personal information,
1788	1788	3 and provide the categories of third parties to whom
1789	1789	4 the personal information was sold or shared during the
1790	1790	5 applicable period by reference to the enumerated
1791	1791	6 category or categories in subsection (c) that most
1792	1792	7 closely describes the personal information sold or
1793	1793	8 shared. The business shall disclose the information in
1794	1794	9 a list that is separate from a list generated under
1795	1795	10 subparagraph (C); and
1796	1796	11 (C) identify by category or categories the
1797	1797	12 personal information of the consumer that the business
1798	1798	13 disclosed for a business purpose during the applicable
1799	1799	14 period by reference to the enumerated category or
1800	1800	15 categories in subsection (c) that most closely
1801	1801	16 describes the personal information, and provide the
1802	1802	17 categories of persons to whom the personal information
1803	1803	18 was disclosed for a business purpose during the
1804	1804	19 applicable period by reference to the enumerated
1805	1805	20 category or categories in subsection (c) that most
1806	1806	21 closely describes the personal information disclosed.
1807	1807	22 The business shall disclose the information in a list
1808	1808	23 that is separate from a list generated under
1809	1809	24 subparagraph (B);
1810	1810	25 (6) disclose the following information in its online
1811	1811	26 privacy policy or policies if the business has an online
1812	1812
1813	1813
1814	1814
1815	1815
1816	1816
1817	1817	SB3517 - 50 - LRB103 35732 LNS 65813 b
1818	1818
1819	1819
1820	1820	SB3517- 51 -LRB103 35732 LNS 65813 b SB3517 - 51 - LRB103 35732 LNS 65813 b
1821	1821	SB3517 - 51 - LRB103 35732 LNS 65813 b
1822	1822	1 privacy police or policies and in any State-specific
1823	1823	2 description of consumer privacy rights, or if the business
1824	1824	3 does not maintain those policies, on its Internet website
1825	1825	4 and update that information at least once every 12 months:
1826	1826	5 (A) a description of a consumer's rights under
1827	1827	6 Sections 10-5, 10-10, 10-15, 10-20, 10-25, and 10-45
1828	1828	7 and 2 more designated methods for submitting requests,
1829	1829	8 except as provided in subparagraph (A) of paragraph
1830	1830	9 (1) of subsection (a);
1831	1831	10 (B) for purposes of subsection (c) of Section
1832	1832	11 10-20:
1833	1833	12 (i) a list of categories of personal
1834	1834	13 information it has collected about consumers in
1835	1835	14 the preceding 12 months by reference to the
1836	1836	15 enumerated category or categories in subsection
1837	1837	16 (c) that most closely describe the personal
1838	1838	17 information collected;
1839	1839	18 (ii) the categories of sources from which
1840	1840	19 personal information is collected;
1841	1841	20 (iii) the business or commercial purpose for
1842	1842	21 collecting, selling, or sharing personal
1843	1843	22 information; and
1844	1844	23 (iv) the categories of third parties to whom
1845	1845	24 the business discloses personal information; and
1846	1846	25 (C) for purposes of paragraphs (1) and (2) of
1847	1847	26 subsection (c) of Section 10-25, 2 separate lists:
1848	1848
1849	1849
1850	1850
1851	1851
1852	1852
1853	1853	SB3517 - 51 - LRB103 35732 LNS 65813 b
1854	1854
1855	1855
1856	1856	SB3517- 52 -LRB103 35732 LNS 65813 b SB3517 - 52 - LRB103 35732 LNS 65813 b
1857	1857	SB3517 - 52 - LRB103 35732 LNS 65813 b
1858	1858	1 (i) a list of categories of personal
1859	1859	2 information it has sold or shared about consumers
1860	1860	3 in the preceding 12 months by reference to the
1861	1861	4 enumerated category or categories in subsection
1862	1862	5 (c) that most closely describe the personal
1863	1863	6 information sold or shared, or if the business has
1864	1864	7 not sold or shared personal information in the
1865	1865	8 preceding 12 months, the business shall
1866	1866	9 prominently disclose that fact in its privacy
1867	1867	10 policy; and
1868	1868	11 (ii) a list of the categories of personal
1869	1869	12 information it has disclosed about consumers for a
1870	1870	13 business purpose in the preceding 12 months by
1871	1871	14 reference to the enumerated category or categories
1872	1872	15 in subsection (c) that most closely describes the
1873	1873	16 personal information disclosed, or if the business
1874	1874	17 has not disclosed personal information in the
1875	1875	18 preceding 12 months, the business shall disclose
1876	1876	19 that fact;
1877	1877	20 (7) ensure that all individuals responsible for
1878	1878	21 handling consumer inquiries about the business' privacy
1879	1879	22 practices or the business' compliance with this Act are
1880	1880	23 informed of all requirements in Sections 10-5, 10-10,
1881	1881	24 10-15, 10-20, 10-25, and 10-45 and this Section, and how
1882	1882	25 to direct consumers to exercise their rights under those
1883	1883	26 Sections; and
1884	1884
1885	1885
1886	1886
1887	1887
1888	1888
1889	1889	SB3517 - 52 - LRB103 35732 LNS 65813 b
1890	1890
1891	1891
1892	1892	SB3517- 53 -LRB103 35732 LNS 65813 b SB3517 - 53 - LRB103 35732 LNS 65813 b
1893	1893	SB3517 - 53 - LRB103 35732 LNS 65813 b
1894	1894	1 (8) use any personal information collected from the
1895	1895	2 consumer in connection with the business' verification of
1896	1896	3 the consumer's request solely for the purposes of
1897	1897	4 verification and shall not further disclose the personal
1898	1898	5 information, retain it longer than necessary for purposes
1899	1899	6 of verification, or use it for unrelated purposes.
1900	1900	7 (b) A business is not obligated to provide the information
1901	1901	8 required by Sections 10-20 and 10-25 to the same consumer more
1902	1902	9 than twice in a 12-month period.
1903	1903	10 (c) The categories of personal information required to be
1904	1904	11 disclosed under Sections 10-5, 10-20, and 10-25 shall follow
1905	1905	12 the definitions of personal information and sensitive personal
1906	1906	13 information by describing the categories of personal
1907	1907	14 information using the specific terms set forth in the
1908	1908	15 definition of personal information and by describing the
1909	1909	16 categories of sensitive personal information using the
1910	1910	17 specific terms set forth in the definition of sensitive
1911	1911	18 personal information.
1912	1912	19 Section 10-50. Methods of limiting sale, sharing, and use
1913	1913	20 of personal information and use of sensitive personal
1914	1914	21 information.
1915	1915	22 (a) A business that is sells or shares personal
1916	1916	23 information or discloses sensitive personal information for
1917	1917	24 purposes other than those authorized by subsection (a) of
1918	1918	25 Section 10-35 shall, in a form that is reasonably accessible
1919	1919
1920	1920
1921	1921
1922	1922
1923	1923
1924	1924	SB3517 - 53 - LRB103 35732 LNS 65813 b
1925	1925
1926	1926
1927	1927	SB3517- 54 -LRB103 35732 LNS 65813 b SB3517 - 54 - LRB103 35732 LNS 65813 b
1928	1928	SB3517 - 54 - LRB103 35732 LNS 65813 b
1929	1929	1 to consumers:
1930	1930	2 (1) provide a clear and conspicuous link on the
1931	1931	3 business's Internet homepage titled "Do Not Sell or Share
1932	1932	4 My Personal Information" to an Internet webpage that
1933	1933	5 enables a consumer, or a person authorized by the
1934	1934	6 consumer, to opt out of the sale or sharing of the personal
1935	1935	7 information;
1936	1936	8 (2) provide a clear and conspicuous link on the
1937	1937	9 business's Internet homepage titled "Limit the Use of My
1938	1938	10 Sensitive Personal Information" that enables a consumer,
1939	1939	11 or a person authorized by the consumer, to limit the use or
1940	1940	12 disclosure of the sensitive personal information;
1941	1941	13 (3) at the business's discretion, use a single,
1942	1942	14 clearly labeled link on the business's Internet homepage,
1943	1943	15 in lieu of complying with paragraphs (1) and (2), if that
1944	1944	16 link easily allows a consumer to opt out of the sale or
1945	1945	17 sharing of the personal information and to limit the use
1946	1946	18 or disclosure of the sensitive personal information; and
1947	1947	19 (4) if the business responds to opt-out requests
1948	1948	20 received under paragraph (1), (2), or (3) by informing the
1949	1949	21 consumer of a charge for the use of any product or service,
1950	1950	22 present the terms of any financial incentive offered under
1951	1951	23 subsection (b) of Section 10-40, for the retention, use,
1952	1952	24 sale, or sharing of the personal information or sensitive
1953	1953	25 personal information.
1954	1954	26 (b) A business shall not be required to comply with
1955	1955
1956	1956
1957	1957
1958	1958
1959	1959
1960	1960	SB3517 - 54 - LRB103 35732 LNS 65813 b
1961	1961
1962	1962
1963	1963	SB3517- 55 -LRB103 35732 LNS 65813 b SB3517 - 55 - LRB103 35732 LNS 65813 b
1964	1964	SB3517 - 55 - LRB103 35732 LNS 65813 b
1965	1965	1 subsection (a) if the business allows consumers to opt out of
1966	1966	2 the sale or sharing of personal information or limit the use of
1967	1967	3 sensitive personal information through an opt-out preference
1968	1968	4 signal sent with the consumer's consent by a platform,
1969	1969	5 technology, or mechanism, based on technical specifications
1970	1970	6 set forth by rules, to the business indicating the consumer's
1971	1971	7 intent to opt out of the business's sale or sharing of the
1972	1972	8 personal information or to limit the use or disclosure of the
1973	1973	9 sensitive personal information, or both.
1974	1974	10 A business that allows consumers to opt out of the sale or
1975	1975	11 sharing of their personal information and to limit the use of
1976	1976	12 sensitive personal information under this subsection may
1977	1977	13 provide a link to a webpage that enables the consumer to
1978	1978	14 consent to the business ignoring the opt-out preference signal
1979	1979	15 with respect to that business's sale or sharing of the
1980	1980	16 personal information or the use of the sensitive personal
1981	1981	17 information for additional purposes if:
1982	1982	18 (1) the consent webpage also allows the consumer
1983	1983	19 or a person authorized by the consumer to revoke the
1984	1984	20 consent as easily as it affirmatively provided;
1985	1985	21 (2) the link to the webpage does not degrade the
1986	1986	22 consumer's experience on the webpage the consumer
1987	1987	23 intends to visit and has a similar look, feel, and size
1988	1988	24 relative to other links on the same webpage; and
1989	1989	25 (3) the consent webpage complies with technical
1990	1990	26 specifications set forth by rules.
1991	1991
1992	1992
1993	1993
1994	1994
1995	1995
1996	1996	SB3517 - 55 - LRB103 35732 LNS 65813 b
1997	1997
1998	1998
1999	1999	SB3517- 56 -LRB103 35732 LNS 65813 b SB3517 - 56 - LRB103 35732 LNS 65813 b
2000	2000	SB3517 - 56 - LRB103 35732 LNS 65813 b
2001	2001	1 A business that complies with subsection (a) is not
2002	2002	2 required to comply with subsection (b). A business may elect
2003	2003	3 whether to comply with subsection (a) or (b).
2004	2004	4 (c) A business that is subject to this Section shall:
2005	2005	5 (1) not require a consumer to create an account or
2006	2006	6 provide additional information beyond what is necessary in
2007	2007	7 order to direct the business not to sell or share the
2008	2008	8 personal information or to limit use or disclosure of the
2009	2009	9 sensitive personal information;
2010	2010	10 (2) include a description of a consumer's rights under
2011	2011	11 Sections 10-30 and 10-35, along with a separate link to
2012	2012	12 the "Do Not Sell or Share My Personal Information"
2013	2013	13 Internet webpage and a separate link to the "Limit the Use
2014	2014	14 of My Sensitive Personal Information" Internet webpage, if
2015	2015	15 applicable, or a single link to both choices, or a
2016	2016	16 statement that the business responds to and abides by
2017	2017	17 opt-out preference signals sent by a platform, technology,
2018	2018	18 or mechanism in accordance with subsection (b), in:
2019	2019	19 (A) its online privacy policy or policies if the
2020	2020	20 business has an online privacy policy or policies; and
2021	2021	21 (B) any State-specific description of consumers'
2022	2022	22 privacy rights;
2023	2023	23 (3) ensure that all individuals responsible for
2024	2024	24 handling consumer inquiries about the business's privacy
2025	2025	25 practices or the business's compliance with this Act are
2026	2026	26 informed of all requirements in Sections 10-30 and 10-35
2027	2027
2028	2028
2029	2029
2030	2030
2031	2031
2032	2032	SB3517 - 56 - LRB103 35732 LNS 65813 b
2033	2033
2034	2034
2035	2035	SB3517- 57 -LRB103 35732 LNS 65813 b SB3517 - 57 - LRB103 35732 LNS 65813 b
2036	2036	SB3517 - 57 - LRB103 35732 LNS 65813 b
2037	2037	1 and this Section and how to direct consumers to exercise
2038	2038	2 their rights under those Sections;
2039	2039	3 (4) for consumers who exercise their right to opt out
2040	2040	4 of the sale or sharing of their personal information or
2041	2041	5 limit the use or disclosure of their sensitive personal
2042	2042	6 information, refrain from selling or sharing the personal
2043	2043	7 information or using or disclosing the sensitive personal
2044	2044	8 information and wait for at least 12 months before
2045	2045	9 requesting that the consumer authorize the sale or sharing
2046	2046	10 of the personal information or the use and disclosure of
2047	2047	11 the sensitive personal information for additional
2048	2048	12 purposes, or as authorized by rules;
2049	2049	13 (5) for consumers under 16 years of age who do not
2050	2050	14 consent to the sale or sharing of their personal
2051	2051	15 information, refrain from selling or sharing the personal
2052	2052	16 information of the consumer under 16 years of age and wait
2053	2053	17 for at least 12 months before requesting the consumer's
2054	2054	18 consent again, or as authorized by rules or until the
2055	2055	19 consumer attains 16 years of age; and
2056	2056	20 (6) use any personal information collected from the
2057	2057	21 consumer in connection with the submission of the
2058	2058	22 consumer's opt-out request solely for the purposes of
2059	2059	23 complying with the opt-out request.
2060	2060	24 (d) Nothing in this Act shall be construed to require a
2061	2061	25 business to comply with the Act by including the required
2062	2062	26 links and text on the homepage that the business makes
2063	2063
2064	2064
2065	2065
2066	2066
2067	2067
2068	2068	SB3517 - 57 - LRB103 35732 LNS 65813 b
2069	2069
2070	2070
2071	2071	SB3517- 58 -LRB103 35732 LNS 65813 b SB3517 - 58 - LRB103 35732 LNS 65813 b
2072	2072	SB3517 - 58 - LRB103 35732 LNS 65813 b
2073	2073	1 available to the public generally, if the business maintains a
2074	2074	2 separate and additional homepage that is dedicated to State
2075	2075	3 consumers and that includes the required links and text, and
2076	2076	4 the business takes reasonable steps to ensure that State
2077	2077	5 consumers are directed to the homepage for State consumers and
2078	2078	6 not the homepage made available to the public generally.
2079	2079	7 (e) A consumer may authorize another person to opt out of
2080	2080	8 the sale or sharing of the personal information and to limit
2081	2081	9 the use of the sensitive personal information on the
2082	2082	10 consumer's behalf, including through an opt-out preference
2083	2083	11 signal, indicating the consumer's intent to opt out, and a
2084	2084	12 business shall comply with an opt-out request received from a
2085	2085	13 person authorized by the consumer to act on the consumer's
2086	2086	14 behalf, under the rules adopted by the Attorney General,
2087	2087	15 regardless of whether the business has elected to comply with
2088	2088	16 subsection (a) or (b). A business that elects to comply with
2089	2089	17 subsection (a) may respond to the consumer's opt-out request
2090	2090	18 consistent with Section 10-40.
2091	2091	19 (f) If a business communicates a consumer's opt-out
2092	2092	20 request to any persona authorized by the business to collect
2093	2093	21 personal information, the person shall thereafter only use
2094	2094	22 that personal information for a business purpose specified by
2095	2095	23 the business, or as otherwise permitted by this Act, and shall
2096	2096	24 be prohibited from:
2097	2097	25 (1) selling or sharing that personal information; or
2098	2098	26 (2) retaining, using, or disclosing that personal
2099	2099
2100	2100
2101	2101
2102	2102
2103	2103
2104	2104	SB3517 - 58 - LRB103 35732 LNS 65813 b
2105	2105
2106	2106
2107	2107	SB3517- 59 -LRB103 35732 LNS 65813 b SB3517 - 59 - LRB103 35732 LNS 65813 b
2108	2108	SB3517 - 59 - LRB103 35732 LNS 65813 b
2109	2109	1 information:
2110	2110	2 (A) for any purpose other than for the specific
2111	2111	3 purpose of performing the services offered to the
2112	2112	4 business;
2113	2113	5 (B) outside of the direct business relationship
2114	2114	6 between the person and the business; or
2115	2115	7 (C) for a commercial purpose other than providing
2116	2116	8 the services to the business.
2117	2117	9 (g) A business that communicates a consumer's opt-out
2118	2118	10 request to a person under subsection (f) shall not be liable
2119	2119	11 under this Act if the person receiving the opt-out request
2120	2120	12 violates the restrictions set forth in the Act, if, at the time
2121	2121	13 of communicating the opt-out request, the business does not
2122	2122	14 have actual knowledge, or reason to believe, that the person
2123	2123	15 intends to commit such a violation. Any provision of a
2124	2124	16 contract or agreement of any kind that purports to waive or
2125	2125	17 limit this subsection in any way shall be void and
2126	2126	18 unenforceable.
2127	2127	19 Section 10-55. Exemptions.
2128	2128	20 (a) The obligations imposed on a business by this Act
2129	2129	21 shall not restrict a business's ability to:
2130	2130	22 (1) comply with federal, State, or local laws or
2131	2131	23 comply with a court order or subpoena to provide
2132	2132	24 information;
2133	2133	25 (2) comply with a civil, criminal, or regulatory
2134	2134
2135	2135
2136	2136
2137	2137
2138	2138
2139	2139	SB3517 - 59 - LRB103 35732 LNS 65813 b
2140	2140
2141	2141
2142	2142	SB3517- 60 -LRB103 35732 LNS 65813 b SB3517 - 60 - LRB103 35732 LNS 65813 b
2143	2143	SB3517 - 60 - LRB103 35732 LNS 65813 b
2144	2144	1 inquiry, investigation, subpoena, or summons by federal,
2145	2145	2 State, or local authorities. Law enforcement agencies,
2146	2146	3 including police and sheriff's departments, may direct a
2147	2147	4 business under a law enforcement agency-approved
2148	2148	5 investigation with an active case number not to delete
2149	2149	6 personal information, and upon receipt of that direction,
2150	2150	7 a business shall not delete the personal information for
2151	2151	8 90 days in order to allow the law enforcement agency to
2152	2152	9 obtain a court-issued subpoena, order, or warrant to
2153	2153	10 obtain that personal information. For good cause and only
2154	2154	11 to the extent necessary for investigatory purposes, a law
2155	2155	12 enforcement agency may direct a business not to delete the
2156	2156	13 personal information for additional 90-day periods. A
2157	2157	14 business that has received direction from a law
2158	2158	15 enforcement agency not to delete the personal information
2159	2159	16 of a consumer who has requested deletion of the personal
2160	2160	17 information shall not use the personal information for any
2161	2161	18 purpose other than retaining it to produce to law
2162	2162	19 enforcement in response to a court-issued subpoena, order,
2163	2163	20 or warrant unless the deletion request is subject to an
2164	2164	21 exemption from deletion under this Act;
2165	2165	22 (3) cooperate with law enforcement agencies concerning
2166	2166	23 conduct or activity that the business, service provider,
2167	2167	24 or third party reasonably and in good faith believes may
2168	2168	25 violate federal, State, or local law;
2169	2169	26 (4) cooperate with a government agency request for
2170	2170
2171	2171
2172	2172
2173	2173
2174	2174
2175	2175	SB3517 - 60 - LRB103 35732 LNS 65813 b
2176	2176
2177	2177
2178	2178	SB3517- 61 -LRB103 35732 LNS 65813 b SB3517 - 61 - LRB103 35732 LNS 65813 b
2179	2179	SB3517 - 61 - LRB103 35732 LNS 65813 b
2180	2180	1 emergency access to personal information if a natural
2181	2181	2 person is at risk or danger of death or serious physical
2182	2182	3 injury if:
2183	2183	4 (A) the request is approved by a high-ranking
2184	2184	5 government agency officer for emergency access to
2185	2185	6 personal information;
2186	2186	7 (B) the request is based on the government
2187	2187	8 agency's good faith determination that it has a lawful
2188	2188	9 basis to access the personal information on a
2189	2189	10 nonemergency basis; and
2190	2190	11 (C) the government agency agrees to petition a
2191	2191	12 court for an appropriate order within 3 days and to
2192	2192	13 destroy the personal information if that order is not
2193	2193	14 granted;
2194	2194	15 (5) exercise or defend legal claims;
2195	2195	16 (6) collect, use, retain, sell, share, or disclose
2196	2196	17 personal information that is deidentified or aggregate
2197	2197	18 consumer information; or
2198	2198	19 (7) collect, sell, or share personal information if
2199	2199	20 every aspect of that commercial conduct takes place wholly
2200	2200	21 outside of the State. Commercial conduct takes place
2201	2201	22 wholly outside of the State if the business collected that
2202	2202	23 information while the consumer was outside of the State,
2203	2203	24 no part of the sale of the personal information occurred
2204	2204	25 in the State, and no personal information collected while
2205	2205	26 the consumer was in the State is sold. This paragraph
2206	2206
2207	2207
2208	2208
2209	2209
2210	2210
2211	2211	SB3517 - 61 - LRB103 35732 LNS 65813 b
2212	2212
2213	2213
2214	2214	SB3517- 62 -LRB103 35732 LNS 65813 b SB3517 - 62 - LRB103 35732 LNS 65813 b
2215	2215	SB3517 - 62 - LRB103 35732 LNS 65813 b
2216	2216	1 shall not prohibit a business from storing, including on a
2217	2217	2 device, personal information about a consumer when the
2218	2218	3 consumer is in the State and then collecting that personal
2219	2219	4 information when the consumer and stored personal
2220	2220	5 information is outside of the State.
2221	2221	6 (b) The obligations imposed on businesses by Sections
2222	2222	7 10-20, 10-25, 10-30, 10-35, 10-45, and 10-50 shall not apply
2223	2223	8 where compliance by the business with the Act would violate an
2224	2224	9 evidentiary privilege under State law and shall not prevent a
2225	2225	10 business from providing the personal information of a consumer
2226	2226	11 to a person covered by an evidentiary privilege under State
2227	2227	12 law as part of a privileged communication.
2228	2228	13 (c) This Act shall not apply to:
2229	2229	14 (1) medical information governed by the Medical
2230	2230	15 Patient Rights Act or protected health information that is
2231	2231	16 collected by a covered entity or business associate
2232	2232	17 governed by the privacy, security, and breach notification
2233	2233	18 rules issued by the United States Department of Health and
2234	2234	19 Human Services, Parts 160 and 164 of Title 45 of the Code
2235	2235	20 of Federal Regulations;
2236	2236	21 (2) a provider of health care governed by the Medical
2237	2237	22 Patient Rights Act or a covered entity governed by the
2238	2238	23 privacy, security, and breach notification rules issued by
2239	2239	24 the United States Department of Health and Human Services,
2240	2240	25 Parts 160 and 164 of Title 45 of the Code of Federal
2241	2241	26 Regulations to the extent the provider or covered entity
2242	2242
2243	2243
2244	2244
2245	2245
2246	2246
2247	2247	SB3517 - 62 - LRB103 35732 LNS 65813 b
2248	2248
2249	2249
2250	2250	SB3517- 63 -LRB103 35732 LNS 65813 b SB3517 - 63 - LRB103 35732 LNS 65813 b
2251	2251	SB3517 - 63 - LRB103 35732 LNS 65813 b
2252	2252	1 maintains patient information in the same manner as
2253	2253	2 medical information or protected health information as
2254	2254	3 described in paragraph (1); or
2255	2255	4 (3) personal information collected as part of a
2256	2256	5 clinical trial or other biomedical research study subject
2257	2257	6 to or conducted in accordance with the Federal Policy for
2258	2258	7 the Protection of Human Subjects under good clinical
2259	2259	8 practice guidelines issued by the International Council
2260	2260	9 for Harmonisation or under human subject protection
2261	2261	10 requirements of the United States Food and Drug
2262	2262	11 Administration, as long as the information is not sold or
2263	2263	12 shared in a manner not permitted by this paragraph, and if
2264	2264	13 it is inconsistent, that participants be informed of that
2265	2265	14 use and provide consent.
2266	2266	15 (d) This Act applies to an activity involving the
2267	2267	16 collection, maintenance, disclosure, sale, communication, or
2268	2268	17 use of any personal information bearing on a consumer's credit
2269	2269	18 worthiness, credit standing, credit capacity, character,
2270	2270	19 general reputation, personal characteristics, or mode of
2271	2271	20 living by a consumer reporting agency, as defined in
2272	2272	21 subsection (f) of Section 1681a of Title 15 of the United
2273	2273	22 States Code, by a furnisher of information, as set forth in
2274	2274	23 Section 1681s-2 of Title 15 of the United States Code, who
2275	2275	24 provides information for use in a consumer report, as defined
2276	2276	25 in subsection (d) of Section 1681a of Title 15 of the United
2277	2277	26 States Code, and by a user of a consumer report, as set forth
2278	2278
2279	2279
2280	2280
2281	2281
2282	2282
2283	2283	SB3517 - 63 - LRB103 35732 LNS 65813 b
2284	2284
2285	2285
2286	2286	SB3517- 64 -LRB103 35732 LNS 65813 b SB3517 - 64 - LRB103 35732 LNS 65813 b
2287	2287	SB3517 - 64 - LRB103 35732 LNS 65813 b
2288	2288	1 in Section 1681b of Title 15 of the United States Code.
2289	2289	2 This subsection applies only to the extent that such
2290	2290	3 activity involving the collection, maintenance, disclosure,
2291	2291	4 sale, communication, or use of such information by the
2292	2292	5 consumer reporting agency, furnisher, or user is subject to
2293	2293	6 regulation under the federal Fair Credit Reporting Act and the
2294	2294	7 information is not collected, maintained, used, communicated,
2295	2295	8 disclosed, or sold except as authorized by the federal Fair
2296	2296	9 Credit Reporting Act.
2297	2297	10 This subsection shall not apply to Section 10-60.
2298	2298	11 (e) This Act shall not apply to personal information
2299	2299	12 collected, processed, sold, or disclosed under the federal
2300	2300	13 Gramm-Leach-Bliley Act or the federal Farm Credit Act of 1971.
2301	2301	14 This subsection shall not apply to Section 10-60.
2302	2302	15 (f) This Act shall not apply to personal information
2303	2303	16 collected, processed, sold, or disclosed under the federal
2304	2304	17 Driver's Privacy Protection Act of 1994. This subsection shall
2305	2305	18 not apply to Section 10-60.
2306	2306	19 (g) Section 10-30 shall not apply to vehicle information
2307	2307	20 or ownership information retained or shared between a new
2308	2308	21 motor vehicle dealer and the vehicle's manufacturer, if the
2309	2309	22 vehicle or ownership information is shared for the purpose of
2310	2310	23 effectuating, or in anticipation of effectuating, a vehicle
2311	2311	24 repair covered by a vehicle warranty or a recall conducted
2312	2312	25 under Sections 30118 through 30120 of Title 49 of the United
2313	2313	26 States Code, as long as the new motor vehicle dealer or vehicle
2314	2314
2315	2315
2316	2316
2317	2317
2318	2318
2319	2319	SB3517 - 64 - LRB103 35732 LNS 65813 b
2320	2320
2321	2321
2322	2322	SB3517- 65 -LRB103 35732 LNS 65813 b SB3517 - 65 - LRB103 35732 LNS 65813 b
2323	2323	SB3517 - 65 - LRB103 35732 LNS 65813 b
2324	2324	1 manufacturer with which that vehicle information or ownership
2325	2325	2 information is shared does not sell, share, or use that
2326	2326	3 information for any other purpose.
2327	2327	4 (h) Notwithstanding a business's obligations to respond to
2328	2328	5 and honor consumer rights requests under this Act:
2329	2329	6 (1) a period for a business to respond to a consumer
2330	2330	7 for any verifiable consumer request may be extended by up
2331	2331	8 to a total of 90 additional days where necessary, taking
2332	2332	9 into account the complexity and number of the requests.
2333	2333	10 The business shall inform the consumer of any such
2334	2334	11 extension within 45 days of receipt of the request,
2335	2335	12 together with the reasons for the delay;
2336	2336	13 (2) if the business does not take action on the
2337	2337	14 request of the consumer, the business shall inform the
2338	2338	15 consumer, without delay and, at the latest, within the
2339	2339	16 time permitted of response by this subsection, of the
2340	2340	17 reasons for not taking action and any rights the consumer
2341	2341	18 may have to appeal the decision to the business; and
2342	2342	19 (3) if requests from a consumer are manifestly
2343	2343	20 unfounded or excessive, in particular because of their
2344	2344	21 repetitive character, a business may either charge a
2345	2345	22 reasonable fee, taking into account the administrative
2346	2346	23 costs of providing the information or communication or
2347	2347	24 taking the action requested, or refuse to act on the
2348	2348	25 request and notify the consumer of the reason for refusing
2349	2349	26 the request. The business shall bear the burden of
2350	2350
2351	2351
2352	2352
2353	2353
2354	2354
2355	2355	SB3517 - 65 - LRB103 35732 LNS 65813 b
2356	2356
2357	2357
2358	2358	SB3517- 66 -LRB103 35732 LNS 65813 b SB3517 - 66 - LRB103 35732 LNS 65813 b
2359	2359	SB3517 - 66 - LRB103 35732 LNS 65813 b
2360	2360	1 demonstrating that any verifiable consumer request is
2361	2361	2 manifestly unfounded or excessive.
2362	2362	3 (i)(1) A business that discloses personal information to a
2363	2363	4 service provider or contractor in compliance with this Act
2364	2364	5 shall not be liable under this Act if the service provider or
2365	2365	6 contractor receiving the personal information uses it in
2366	2366	7 violation of the restrictions set forth in this Act, and if, at
2367	2367	8 the time of disclosing the personal information, the business
2368	2368	9 does not have actual knowledge, or reason to believe, that the
2369	2369	10 service provider or contractor intends to commit such a
2370	2370	11 violation. A service provider or contractor shall not be
2371	2371	12 liable under this Act for the obligations of a business for
2372	2372	13 which it provides services as set forth in this Act. The
2373	2373	14 service provider or contractor shall be liable for its own
2374	2374	15 violations of this Act.
2375	2375	16 (2) A business that discloses personal information of a
2376	2376	17 consumer, with the exception of consumers who have exercised
2377	2377	18 their right to opt out of the sale or sharing of their personal
2378	2378	19 information, consumers who have limited the use or disclosure
2379	2379	20 of their sensitive personal information, and minor consumers
2380	2380	21 who have not opted-in to the collection or sale of their
2381	2381	22 personal information, to a third party under a written
2382	2382	23 contract that requires the third party to provide the same
2383	2383	24 level of protection of the consumer's rights under this Act as
2384	2384	25 provided by the business shall not be liable under this Act if
2385	2385	26 the third party receiving the personal information uses it in
2386	2386
2387	2387
2388	2388
2389	2389
2390	2390
2391	2391	SB3517 - 66 - LRB103 35732 LNS 65813 b
2392	2392
2393	2393
2394	2394	SB3517- 67 -LRB103 35732 LNS 65813 b SB3517 - 67 - LRB103 35732 LNS 65813 b
2395	2395	SB3517 - 67 - LRB103 35732 LNS 65813 b
2396	2396	1 violation of the restrictions set forth in this Act, and if, at
2397	2397	2 the time of disclosing the personal information, the business
2398	2398	3 does not have actual knowledge, or reason to believe, that the
2399	2399	4 third party intends to commit such a violation.
2400	2400	5 (j) This Act shall not be construed to require a business,
2401	2401	6 service provider, or contractor to:
2402	2402	7 (1) reidentify or otherwise link information that, in
2403	2403	8 the ordinary course of business, is not maintained in a
2404	2404	9 manner that would be considered personal information;
2405	2405	10 (2) retain any personal information about a consumer
2406	2406	11 if, in the ordinary course of business, that information
2407	2407	12 about the consumer would not be retained; or
2408	2408	13 (3) maintain information in identifiable, linkable, or
2409	2409	14 associable form, or collect, obtain, retain, or access any
2410	2410	15 data or technology, in order to be capable of linking or
2411	2411	16 associating a verifiable consumer request with personal
2412	2412	17 information.
2413	2413	18 (k) The rights afforded to consumers and the obligations
2414	2414	19 imposed on the business in this Act shall not adversely affect
2415	2415	20 the rights and freedoms of other natural persons. A verifiable
2416	2416	21 consumer request for specific pieces of personal information,
2417	2417	22 to delete personal information, or to correct inaccurate
2418	2418	23 personal information shall not extend to personal information
2419	2419	24 about the consumer that belongs to, or the business maintains
2420	2420	25 on behalf of, another natural person. A business may rely on
2421	2421	26 representations made in a verifiable consumer request as to
2422	2422
2423	2423
2424	2424
2425	2425
2426	2426
2427	2427	SB3517 - 67 - LRB103 35732 LNS 65813 b
2428	2428
2429	2429
2430	2430	SB3517- 68 -LRB103 35732 LNS 65813 b SB3517 - 68 - LRB103 35732 LNS 65813 b
2431	2431	SB3517 - 68 - LRB103 35732 LNS 65813 b
2432	2432	1 rights with respect to personal information and is under no
2433	2433	2 legal requirement to seek out other persons that may have or
2434	2434	3 claim to have rights to personal information, and a business
2435	2435	4 is under no legal obligation under this Act or any other
2436	2436	5 provision of law to take any action under this Act if there is
2437	2437	6 a dispute between or among persons claiming rights to personal
2438	2438	7 information in the business' possession.
2439	2439	8 (l) The rights afforded to consumers and the obligations
2440	2440	9 imposed on businesses under this Act shall not apply to the
2441	2441	10 extent that they infringe on the noncommercial activities of a
2442	2442	11 person or entity described in Section 4 of Article I of the
2443	2443	12 Illinois Constitution.
2444	2444	13 (m) This Act shall not apply to:
2445	2445	14 (1) personal information that is collected by a
2446	2446	15 business about a natural person in the course of the
2447	2447	16 natural person acting as a job applicant to, employee of,
2448	2448	17 owner of, director of, officer of, medical staff member
2449	2449	18 of, or independent contractor of that business to the
2450	2450	19 extent that the natural person's personal information is
2451	2451	20 collected and used by the business solely within the
2452	2452	21 context of the natural person's role or former role as a
2453	2453	22 job applicant to, an employee of, owner of, director of,
2454	2454	23 officer of, medical staff member of, or an independent
2455	2455	24 contractor of, that business;
2456	2456	25 (2) personal information that is collected by a
2457	2457	26 business that is emergency contact information of the
2458	2458
2459	2459
2460	2460
2461	2461
2462	2462
2463	2463	SB3517 - 68 - LRB103 35732 LNS 65813 b
2464	2464
2465	2465
2466	2466	SB3517- 69 -LRB103 35732 LNS 65813 b SB3517 - 69 - LRB103 35732 LNS 65813 b
2467	2467	SB3517 - 69 - LRB103 35732 LNS 65813 b
2468	2468	1 natural person acting as a job applicant to, employee of,
2469	2469	2 owner of, director of, officer of, medical staff member
2470	2470	3 of, or independent contractor of that business to the
2471	2471	4 extent that the personal information is collected and used
2472	2472	5 solely within the context of having an emergency contact
2473	2473	6 on file; or
2474	2474	7 (3) personal information that is necessary for the
2475	2475	8 business to retain to administer benefits for another
2476	2476	9 natural person relating to the natural person acting as a
2477	2477	10 job applicant to, employee of, owner of, director of,
2478	2478	11 officer of, medical staff member of, or independent
2479	2479	12 contractor of that business to the extent that the
2480	2480	13 personal information is collected and used solely within
2481	2481	14 the context of administering those benefits.
2482	2482	15 This subsection shall not apply to subsection (a) of
2483	2483	16 Section 10-5 or 10-60.
2484	2484	17 This subsection shall become inoperative on January 1,
2485	2485	18 2026.
2486	2486	19 (n) The obligations imposed on businesses by Sections
2487	2487	20 10-5, 10-10, 10-15, 10-20, 10-25, 10-35, 10-45, and 10-50
2488	2488	21 shall not apply to personal information reflecting a written
2489	2489	22 or verbal communication or a transaction between the business
2490	2490	23 and the consumer, where the consumer is a natural person who
2491	2491	24 acted or is acting as an employee, owner, director, officer,
2492	2492	25 or independent contractor of a company, partnership, sole
2493	2493	26 proprietorship, nonprofit, or government agency and whose
2494	2494
2495	2495
2496	2496
2497	2497
2498	2498
2499	2499	SB3517 - 69 - LRB103 35732 LNS 65813 b
2500	2500
2501	2501
2502	2502	SB3517- 70 -LRB103 35732 LNS 65813 b SB3517 - 70 - LRB103 35732 LNS 65813 b
2503	2503	SB3517 - 70 - LRB103 35732 LNS 65813 b
2504	2504	1 communications or transaction with the business occur solely
2505	2505	2 within the context of the business conducting due diligence
2506	2506	3 regarding, or providing or receiving a product or service to
2507	2507	4 or from such company, partnership, sole proprietorship,
2508	2508	5 nonprofit, or government agency.
2509	2509	6 This subsection shall become inoperative on January 1,
2510	2510	7 2026.
2511	2511	8 (o) Sections 10-10 and 10-30 shall not apply to a
2512	2512	9 commercial credit reporting agency's collection, processing,
2513	2513	10 sale, or disclosure of business controller information to the
2514	2514	11 extent the commercial credit reporting agency uses the
2515	2515	12 business controller information solely to identify the
2516	2516	13 relationship of a consumer to a business that the consumer
2517	2517	14 owns or contact the consumer only in the consumer's role as the
2518	2518	15 owner, director, officer, or management employee of the
2519	2519	16 business.
2520	2520	17 (p) The obligations imposed on businesses in Sections
2521	2521	18 10-10, 10-15, 10-20, and 10-25 shall not apply to household
2522	2522	19 data.
2523	2523	20 (q) This Act does not require a business to comply with a
2524	2524	21 verifiable consumer request to delete personal information to
2525	2525	22 the extent the verifiable consumer request applies to a
2526	2526	23 student's grades, educational scores, or educational test
2527	2527	24 results that the business holds on behalf of a local
2528	2528	25 educational agency at which the student is currently enrolled.
2529	2529	26 If a business does not comply with a request under this
2530	2530
2531	2531
2532	2532
2533	2533
2534	2534
2535	2535	SB3517 - 70 - LRB103 35732 LNS 65813 b
2536	2536
2537	2537
2538	2538	SB3517- 71 -LRB103 35732 LNS 65813 b SB3517 - 71 - LRB103 35732 LNS 65813 b
2539	2539	SB3517 - 71 - LRB103 35732 LNS 65813 b
2540	2540	1 Section, it shall notify the consumer that it is acting under
2541	2541	2 this exception.
2542	2542	3 This Act does not require, in response to a request under
2543	2543	4 Section 10-20, that a business disclose an educational
2544	2544	5 standardized assessment or educational assessment or a
2545	2545	6 consumer's specific responses to the educational standardized
2546	2546	7 assessment or educational assessment if consumer access,
2547	2547	8 possession, or control would jeopardize the validity and
2548	2548	9 reliability of that educational standardized assessment or
2549	2549	10 educational assessment. If a business does not comply with a
2550	2550	11 request under this Section, it shall notify the consumer that
2551	2551	12 it is acting under this exception.
2552	2552	13 (r) Sections 10-10 and 10-30 shall not apply to a
2553	2553	14 business's use, disclosure, or sale of particular pieces of
2554	2554	15 personal information if the consumer has consented to the
2555	2555	16 business's use, disclosure, or sale of that personal
2556	2556	17 information to produce a physical item, including a school
2557	2557	18 yearbook containing the consumer's photograph, if:
2558	2558	19 (1) the business has incurred significant expense in
2559	2559	20 reliance on the consumer's consent;
2560	2560	21 (2) compliance with the consumer's request to opt out
2561	2561	22 of the sale of the personal information or to delete the
2562	2562	23 personal information would not be commercially reasonable;
2563	2563	24 and
2564	2564	25 (3) the business complies with the consumer's request
2565	2565	26 as soon as it is commercially reasonable to do so.
2566	2566
2567	2567
2568	2568
2569	2569
2570	2570
2571	2571	SB3517 - 71 - LRB103 35732 LNS 65813 b
2572	2572
2573	2573
2574	2574	SB3517- 72 -LRB103 35732 LNS 65813 b SB3517 - 72 - LRB103 35732 LNS 65813 b
2575	2575	SB3517 - 72 - LRB103 35732 LNS 65813 b
2576	2576	1 Section 10-60. Personal information security breaches.
2577	2577	2 (a) Any consumer whose nonencrypted and nonredacted
2578	2578	3 personal information or whose email address in combination
2579	2579	4 with a password or security question and answer that would
2580	2580	5 permit access to the account is subject to an unauthorized
2581	2581	6 access and exfiltration, theft, or disclosure as a result of
2582	2582	7 the business's violation of the duty to implement and maintain
2583	2583	8 reasonable security procedures and practices appropriate to
2584	2584	9 the nature of the information to protect the personal
2585	2585	10 information may institute a civil action for:
2586	2586	11 (1) the recovery of damages in an amount not less than
2587	2587	12 $100 and not greater than $750 per consumer per incident
2588	2588	13 or actual damages, whichever is greater;
2589	2589	14 (2) injunctive or declaratory relief; or
2590	2590	15 (3) any other relief the court deems proper.
2591	2591	16 In assessing the amount of statutory damages, the court
2592	2592	17 shall consider any one or more of the relevant circumstances
2593	2593	18 presented by any of the parties to the case, including, but not
2594	2594	19 limited to, the nature and seriousness of the misconduct, the
2595	2595	20 number of violations, the persistence of the misconduct, the
2596	2596	21 length of time over which the misconduct occurred, the
2597	2597	22 willfulness of the defendant's misconduct, and the defendant's
2598	2598	23 assets, liabilities, and net worth.
2599	2599	24 (b) Actions under this Section may be brought by a
2600	2600	25 consumer if, prior to initiating any action against a business
2601	2601
2602	2602
2603	2603
2604	2604
2605	2605
2606	2606	SB3517 - 72 - LRB103 35732 LNS 65813 b
2607	2607
2608	2608
2609	2609	SB3517- 73 -LRB103 35732 LNS 65813 b SB3517 - 73 - LRB103 35732 LNS 65813 b
2610	2610	SB3517 - 73 - LRB103 35732 LNS 65813 b
2611	2611	1 for statutory damages on an individual or classwide basis, a
2612	2612	2 consumer provides a business 30 days' written notice
2613	2613	3 identifying the specific provisions of this Act the consumer
2614	2614	4 alleges have been or are being violated. If a cure is possible
2615	2615	5 and if, within the 30 days, the business actually cures the
2616	2616	6 noticed violation and provides the consumer an express written
2617	2617	7 statement that the violations have been cured and that no
2618	2618	8 further violations shall occur, no action for individual
2619	2619	9 statutory damages or classwide statutory damages may be
2620	2620	10 initiated against the business. The implementation and
2621	2621	11 maintenance of reasonable security procedures and practices
2622	2622	12 following a breach does not constitute a cure with respect to
2623	2623	13 that breach. No notice shall be required prior to an
2624	2624	14 individual consumer initiating an action solely for actual
2625	2625	15 pecuniary damages suffered as a result of the alleged
2626	2626	16 violations of this Act. If a business continues to violate
2627	2627	17 this Act in breach of the express written statement provided
2628	2628	18 to the consumer under this Section, the consumer may initiate
2629	2629	19 an action against the business to enforce the written
2630	2630	20 statement and may pursue statutory damages for each breach of
2631	2631	21 the express written statement, as well as any other violation
2632	2632	22 of this Act that postdates the written statement.
2633	2633	23 (c) The cause of action established by this Section shall
2634	2634	24 apply only to violations as defined in subsection (a) and
2635	2635	25 shall not be based on violations of any other Section of this
2636	2636	26 Act. Nothing in this Act shall be interpreted to serve as the
2637	2637
2638	2638
2639	2639
2640	2640
2641	2641
2642	2642	SB3517 - 73 - LRB103 35732 LNS 65813 b
2643	2643
2644	2644
2645	2645	SB3517- 74 -LRB103 35732 LNS 65813 b SB3517 - 74 - LRB103 35732 LNS 65813 b
2646	2646	SB3517 - 74 - LRB103 35732 LNS 65813 b
2647	2647	1 basis for a private right of action under any other law. This
2648	2648	2 shall not be construed to relieve any party from any duties or
2649	2649	3 obligations imposed under other law or the United States or
2650	2650	4 Illinois Constitution.
2651	2651	5 Section 10-65. Administrative enforcement.
2652	2652	6 (a) Any business, service provider, contractor, or other
2653	2653	7 person that violates this Act shall be subject to an
2654	2654	8 injunction and liable for an administrative fine of not more
2655	2655	9 than $2,500 for each violation or $7,500 for each intentional
2656	2656	10 violation or violations involving the personal information of
2657	2657	11 consumers whom the business, service provider, contractor, or
2658	2658	12 other person has actual knowledge are under 16 years of age in
2659	2659	13 an administrative enforcement action brought by the Agency.
2660	2660	14 (b) Any administrative fine assessed for a violation of
2661	2661	15 this Act, and the proceeds of any settlement of an action
2662	2662	16 brought under subsection (a), shall be deposited into the
2663	2663	17 Consumer Privacy Fund, with the intent to fully offset any
2664	2664	18 costs incurred by the State courts, the Attorney General, and
2665	2665	19 the Agency in connection with this Act.
2666	2666	20 Section 10-70. Consumer Privacy Fund.
2667	2667	21 (a) A special fund to be known as the Consumer Privacy Fund
2668	2668	22 is hereby created within the State treasury, and is available
2669	2669	23 upon appropriation by the General Assembly first to offset any
2670	2670	24 costs incurred by the State courts in connection with actions
2671	2671
2672	2672
2673	2673
2674	2674
2675	2675
2676	2676	SB3517 - 74 - LRB103 35732 LNS 65813 b
2677	2677
2678	2678
2679	2679	SB3517- 75 -LRB103 35732 LNS 65813 b SB3517 - 75 - LRB103 35732 LNS 65813 b
2680	2680	SB3517 - 75 - LRB103 35732 LNS 65813 b
2681	2681	1 brought to enforce this Act, the costs incurred by the
2682	2682	2 Attorney General in carrying out the Attorney General's duties
2683	2683	3 under this Act, and then for the purposes of establishing an
2684	2684	4 investment fund in the State treasury, with any earnings or
2685	2685	5 interest from the Fund to be deposited into the General
2686	2686	6 Revenue Fund, and making grants to promote and protect
2687	2687	7 consumer privacy, educate children in the area of online
2688	2688	8 privacy, and fund cooperative programs with international law
2689	2689	9 enforcement organizations to combat fraudulent activities with
2690	2690	10 respect to consumer data breaches.
2691	2691	11 (b) Funds transferred to the Consumer Privacy Fund shall
2692	2692	12 be used exclusively as follows:
2693	2693	13 (1) to offset any costs incurred by the State courts
2694	2694	14 and the Attorney General in connection with this Act; and
2695	2695	15 (2) after satisfying the obligations under paragraph
2696	2696	16 (1), the remaining funds shall be allocated each fiscal
2697	2697	17 year as follows:
2698	2698	18 (A) 91% shall be invested by the Treasurer in
2699	2699	19 financial assets with the goal of maximizing long term
2700	2700	20 yields consistent with a prudent level of risk. The
2701	2701	21 principal shall not be subject to transfer or
2702	2702	22 appropriation, as long as any interest and earnings
2703	2703	23 shall be transferred on an annual basis to the General
2704	2704	24 Revenue Fund for appropriation by the General Assembly
2705	2705	25 for General Revenue Fund purposes; and
2706	2706	26 (B) 9% shall be made available to the Agency for
2707	2707
2708	2708
2709	2709
2710	2710
2711	2711
2712	2712	SB3517 - 75 - LRB103 35732 LNS 65813 b
2713	2713
2714	2714
2715	2715	SB3517- 76 -LRB103 35732 LNS 65813 b SB3517 - 76 - LRB103 35732 LNS 65813 b
2716	2716	SB3517 - 76 - LRB103 35732 LNS 65813 b
2717	2717	1 the purposes of making grants in this State, with 3%
2718	2718	2 allocated to the following grant recipients:
2719	2719	3 (i) nonprofit organizations to promote and
2720	2720	4 protect consumer privacy;
2721	2721	5 (ii) nonprofit organizations and public
2722	2722	6 agencies, including school districts, to educate
2723	2723	7 children in the area of online privacy; and
2724	2724	8 (iii) State and local law enforcement agencies
2725	2725	9 to fund cooperative programs with international
2726	2726	10 law enforcement organizations to combat fraudulent
2727	2727	11 activities with respect to consumer data breaches.
2728	2728	12 (c) Funds in the Consumer Privacy Fund shall not be
2729	2729	13 subject to appropriation or transfer by the General Assembly
2730	2730	14 for any other purpose.
2731	2731	15 Section 10-75. Rules.
2732	2732	16 (a) By July 1, 2025, the Attorney General shall solicit
2733	2733	17 broad public participation and adopt rules to further the
2734	2734	18 purposes of this Act, including, but not limited to:
2735	2735	19 (1) updating or adding categories of personal
2736	2736	20 information to the definition of personal information and
2737	2737	21 updating or adding categories of sensitive personal
2738	2738	22 information to the definition of sensitive personal
2739	2739	23 information in order to address changes in technology,
2740	2740	24 data collection practices, obstacles to implementation,
2741	2741	25 and privacy concerns;
2742	2742
2743	2743
2744	2744
2745	2745
2746	2746
2747	2747	SB3517 - 76 - LRB103 35732 LNS 65813 b
2748	2748
2749	2749
2750	2750	SB3517- 77 -LRB103 35732 LNS 65813 b SB3517 - 77 - LRB103 35732 LNS 65813 b
2751	2751	SB3517 - 77 - LRB103 35732 LNS 65813 b
2752	2752	1 (2) updating as needed the definitions of deidentified
2753	2753	2 and unique identifier to address changes in technology,
2754	2754	3 data collection, obstacles to implementation, and privacy
2755	2755	4 concerns and adding, modifying, or deleting categories to
2756	2756	5 the definition of designated methods for submitting
2757	2757	6 requests to facilitate a consumer's ability to obtain
2758	2758	7 information from a business under Section 10-45. The
2759	2759	8 authority to update the definition of deidentified shall
2760	2760	9 not apply to deidentification standards set forth in
2761	2761	10 Section 164.514 of Title 45 of the Code of Federal
2762	2762	11 Regulations;
2763	2763	12 (3) establishing any exceptions necessary to comply
2764	2764	13 with State or federal law, including, but not limited to,
2765	2765	14 those relating to trade secrets and intellectual property
2766	2766	15 rights, within one year of the effective date of this Act
2767	2767	16 and as needed thereafter, with the intention that trade
2768	2768	17 secrets should not be disclosed in response to a
2769	2769	18 verifiable consumer request;
2770	2770	19 (4) establishing rules and procedures:
2771	2771	20 (A) to facilitate and govern the submission of a
2772	2772	21 request by a consumer to opt out of the sale or sharing
2773	2773	22 of personal information and to limit the use of
2774	2774	23 sensitive personal information to ensure that
2775	2775	24 consumers have the ability to exercise their choices
2776	2776	25 without undue burden and to prevent business from
2777	2777	26 engaging in deceptive or harassing conduct, including
2778	2778
2779	2779
2780	2780
2781	2781
2782	2782
2783	2783	SB3517 - 77 - LRB103 35732 LNS 65813 b
2784	2784
2785	2785
2786	2786	SB3517- 78 -LRB103 35732 LNS 65813 b SB3517 - 78 - LRB103 35732 LNS 65813 b
2787	2787	SB3517 - 78 - LRB103 35732 LNS 65813 b
2788	2788	1 in retaliation against consumers for exercising their
2789	2789	2 rights, while allowing businesses to inform consumers
2790	2790	3 of the consequences of their decision to opt out of the
2791	2791	4 sale or sharing of their personal information or to
2792	2792	5 limit the use of their sensitive personal information;
2793	2793	6 (B) to govern business compliance with a
2794	2794	7 consumer's opt-out request; and
2795	2795	8 (C) for the development and use of a recognizable
2796	2796	9 and uniform opt-out logo or button by all businesses
2797	2797	10 to promote consumer awareness of the opportunity to
2798	2798	11 opt out of the sale of personal information;
2799	2799	12 (5) adjusting the monetary threshold in January of
2800	2800	13 every odd-numbered year to reflect any increase in the
2801	2801	14 Consumer Price Index, in the definition of business,
2802	2802	15 subparagraph (A) of paragraph (1) of subsection (a) of
2803	2803	16 Section 10-60, subsection (a) of Section 10-65, Section
2804	2804	17 15-20, and subsection (a) of Section 15-85;
2805	2805	18 (6) establishing rules, procedures, and any exceptions
2806	2806	19 necessary to ensure that the notices and information that
2807	2807	20 businesses are required to provide under this Act are
2808	2808	21 provided in a manner that may be easily understood by the
2809	2809	22 average consumer, are accessible to consumers with
2810	2810	23 disabilities, and are available in the language primarily
2811	2811	24 used to interact with the consumer, including establishing
2812	2812	25 rules and guidelines regarding financial incentives,
2813	2813	26 within one year of the effective date of this Act and as
2814	2814
2815	2815
2816	2816
2817	2817
2818	2818
2819	2819	SB3517 - 78 - LRB103 35732 LNS 65813 b
2820	2820
2821	2821
2822	2822	SB3517- 79 -LRB103 35732 LNS 65813 b SB3517 - 79 - LRB103 35732 LNS 65813 b
2823	2823	SB3517 - 79 - LRB103 35732 LNS 65813 b
2824	2824	1 needed thereafter;
2825	2825	2 (7) establishing rules and procedures to further the
2826	2826	3 purposes of Sections 10-10, 10-15, 10-20, and 10-25 and to
2827	2827	4 facilitate a consumer's or the consumer's authorized
2828	2828	5 agent's ability to delete personal information, correct
2829	2829	6 inaccurate personal information, or obtain information,
2830	2830	7 with the goal of minimizing the administrative burden on a
2831	2831	8 consumer, taking into account available technology,
2832	2832	9 security concerns, and the burden on the business, to
2833	2833	10 govern a business's determination that a request for
2834	2834	11 information received from a consumer is a verifiable
2835	2835	12 consumer request, including treating a request submitted
2836	2836	13 through a password-protected account maintained by the
2837	2837	14 consumer with the business while the consumer is logged
2838	2838	15 into the account as a verifiable consumer request and
2839	2839	16 providing a mechanism for a consumer who does not maintain
2840	2840	17 an account with the business to request information
2841	2841	18 through the business's authentication of the consumer's
2842	2842	19 identity, within one year of the effective date of this
2843	2843	20 Act and as needed thereafter;
2844	2844	21 (8) establishing how often, and under what
2845	2845	22 circumstances, a consumer may request a correction under
2846	2846	23 Section 10-15, including standards governing:
2847	2847	24 (A) how a business responds to a request for
2848	2848	25 correction, including exceptions for requests to which
2849	2849	26 a response is impossible or would involve
2850	2850
2851	2851
2852	2852
2853	2853
2854	2854
2855	2855	SB3517 - 79 - LRB103 35732 LNS 65813 b
2856	2856
2857	2857
2858	2858	SB3517- 80 -LRB103 35732 LNS 65813 b SB3517 - 80 - LRB103 35732 LNS 65813 b
2859	2859	SB3517 - 80 - LRB103 35732 LNS 65813 b
2860	2860	1 disproportionate effort, and requests for correction
2861	2861	2 of accurate information;
2862	2862	3 (B) how concerns regarding the accuracy of the
2863	2863	4 information may be resolved;
2864	2864	5 (C) the steps a business may take to prevent
2865	2865	6 fraud; and
2866	2866	7 (D) if a business rejects a request to correct
2867	2867	8 personal information collected and analyzed concerning
2868	2868	9 a consumer's health, the right of a consumer to
2869	2869	10 provide a written addendum to the business with
2870	2870	11 respect to any item or statement regarding any such
2871	2871	12 personal information that the consumer believes to be
2872	2872	13 incomplete or incorrect. The addendum shall be limited
2873	2873	14 to 250 words per alleged incomplete or incorrect item
2874	2874	15 and shall clearly indicate in writing that the
2875	2875	16 consumer requests the addendum to be made a part of the
2876	2876	17 consumer's record;
2877	2877	18 (9) establishing the standard to govern a business's
2878	2878	19 determination that providing information beyond the
2879	2879	20 12-month period in a response to a verifiable consumer
2880	2880	21 request is impossible or would involve a disproportionate
2881	2881	22 effort;
2882	2882	23 (10) issuing rules further defining and adding to the
2883	2883	24 business purposes, including other notified purposes, for
2884	2884	25 which businesses, service providers, and contractors may
2885	2885	26 use personal information consistent with consumers'
2886	2886
2887	2887
2888	2888
2889	2889
2890	2890
2891	2891	SB3517 - 80 - LRB103 35732 LNS 65813 b
2892	2892
2893	2893
2894	2894	SB3517- 81 -LRB103 35732 LNS 65813 b SB3517 - 81 - LRB103 35732 LNS 65813 b
2895	2895	SB3517 - 81 - LRB103 35732 LNS 65813 b
2896	2896	1 expectations, and further defining the business purposes
2897	2897	2 for which service providers and contractors may combine
2898	2898	3 personal information obtained from different sources,
2899	2899	4 except as provided for in the definition of business
2900	2900	5 purposes;
2901	2901	6 (11) issuing rules identifying those business
2902	2902	7 purposes, including other notified purposes, for which
2903	2903	8 service providers and contractors may use consumers'
2904	2904	9 personal information received under a written contract
2905	2905	10 with a business, for the service provider or contractor's
2906	2906	11 own business purposes, with the goal of maximizing
2907	2907	12 consumer privacy;
2908	2908	13 (12) issuing rules to further define intentionally
2909	2909	14 interacts with the goal of maximizing consumer privacy;
2910	2910	15 (13) issuing rules to further define precise
2911	2911	16 geolocation, including if the size defined is not
2912	2912	17 sufficient to protect consumer privacy in sparsely
2913	2913	18 populated areas or when the personal information is used
2914	2914	19 for normal operational purposes, including billing;
2915	2915	20 (14) issuing rules to define specific pieces of
2916	2916	21 information obtained from the consumer with the goal of
2917	2917	22 maximizing a consumer's right to access relevant personal
2918	2918	23 information while minimizing the delivery of information
2919	2919	24 to a consumer that would not be useful to the consumer,
2920	2920	25 including system log information and other technical data.
2921	2921	26 For delivery of the most sensitive personal information,
2922	2922
2923	2923
2924	2924
2925	2925
2926	2926
2927	2927	SB3517 - 81 - LRB103 35732 LNS 65813 b
2928	2928
2929	2929
2930	2930	SB3517- 82 -LRB103 35732 LNS 65813 b SB3517 - 82 - LRB103 35732 LNS 65813 b
2931	2931	SB3517 - 82 - LRB103 35732 LNS 65813 b
2932	2932	1 the rules may require a higher standard of authentication
2933	2933	2 as long as the Agency shall monitor the impact of the
2934	2934	3 higher standard on the right of consumers to obtain their
2935	2935	4 personal information to ensure that the requirements of
2936	2936	5 verification do not result in the unreasonable denial of
2937	2937	6 verifiable consumer requests;
2938	2938	7 (15) issuing rules requiring businesses whose
2939	2939	8 processing of personal information presents significant
2940	2940	9 risk to consumers' privacy or security, to:
2941	2941	10 (A) perform a cybersecurity audit on an annual
2942	2942	11 basis, including defining the scope of the audit and
2943	2943	12 establishing a process to ensure that audits are
2944	2944	13 thorough and independent. The factors to be considered
2945	2945	14 in determining when processing may result in
2946	2946	15 significant risk to the security of personal
2947	2947	16 information shall include the size and complexity of
2948	2948	17 the business and the nature and scope of processing
2949	2949	18 activities; and
2950	2950	19 (B) submit to the Agency on a regular basis a risk
2951	2951	20 assessment with respect to their processing of
2952	2952	21 personal information, including whether the processing
2953	2953	22 involves sensitive personal information, and
2954	2954	23 identifying and weighing the benefits resulting from
2955	2955	24 the processing to the business, the consumer, other
2956	2956	25 stakeholders, and the public, against the potential
2957	2957	26 risks to the rights of the consumer associated with
2958	2958
2959	2959
2960	2960
2961	2961
2962	2962
2963	2963	SB3517 - 82 - LRB103 35732 LNS 65813 b
2964	2964
2965	2965
2966	2966	SB3517- 83 -LRB103 35732 LNS 65813 b SB3517 - 83 - LRB103 35732 LNS 65813 b
2967	2967	SB3517 - 83 - LRB103 35732 LNS 65813 b
2968	2968	1 that processing, with the goal of restricting or
2969	2969	2 prohibiting the processing if the risks to privacy of
2970	2970	3 the consumer outweigh the benefits resulting from
2971	2971	4 processing to the consumer, the business, other
2972	2972	5 stakeholders, and the public. Nothing in this Section
2973	2973	6 shall require a business to divulge trade secrets;
2974	2974	7 (16) issuing rules governing access and opt-out rights
2975	2975	8 with respect to a business's use of automated
2976	2976	9 decision-making technology, including profiling and
2977	2977	10 requiring business's response to access requests to
2978	2978	11 include meaningful information about the logic involved in
2979	2979	12 those decision-making processes, as well as a description
2980	2980	13 of the likely outcome of the process with respect to the
2981	2981	14 consumer;
2982	2982	15 (17) issuing rules to further define a law enforcement
2983	2983	16 agency-approved investigation for purposes of the
2984	2984	17 exception in paragraph (2) of subsection (a) of Section
2985	2985	18 10-55;
2986	2986	19 (18) issuing rules to define the scope and process for
2987	2987	20 the exercise of the Agency's audit authority, to establish
2988	2988	21 criteria for selection of persons to audit, and to protect
2989	2989	22 consumers' personal information from disclosure to an
2990	2990	23 auditor in the absence of a court order, warrant, or
2991	2991	24 subpoena;
2992	2992	25 (19) (A) issuing rules to define the requirements and
2993	2993	26 technical specifications for an opt-out preference signal
2994	2994
2995	2995
2996	2996
2997	2997
2998	2998
2999	2999	SB3517 - 83 - LRB103 35732 LNS 65813 b
3000	3000
3001	3001
3002	3002	SB3517- 84 -LRB103 35732 LNS 65813 b SB3517 - 84 - LRB103 35732 LNS 65813 b
3003	3003	SB3517 - 84 - LRB103 35732 LNS 65813 b
3004	3004	1 sent by a platform, technology, or mechanism, to indicate
3005	3005	2 a consumer's intent to opt out of the sale or sharing of
3006	3006	3 the personal information and to limit the use or
3007	3007	4 disclosure of the sensitive personal information. The
3008	3008	5 requirements and specifications for the opt-out preference
3009	3009	6 signal should be updated from time to time to reflect the
3010	3010	7 means by which consumers interact with businesses, and
3011	3011	8 should:
3012	3012	9 (i) ensure that the manufacturer of a platform or
3013	3013	10 browser or device that sends the opt-out preference
3014	3014	11 signal cannot unfairly disadvantage another business;
3015	3015	12 (ii) ensure that the opt-out preference signal is
3016	3016	13 consumer-friendly, clearly described, and easy to use
3017	3017	14 by an average consumer and does not require that the
3018	3018	15 consumer provide additional information beyond what is
3019	3019	16 necessary;
3020	3020	17 (iii) clearly represent a consumer's intent and be
3021	3021	18 free of defaults constraining or presupposing that
3022	3022	19 intent;
3023	3023	20 (iv) ensure that the opt-out preference signal
3024	3024	21 does not conflict with other commonly used privacy
3025	3025	22 settings or tools that consumers may employ;
3026	3026	23 (v) provide a mechanism for the consumer to
3027	3027	24 selectively consent to a business's sale of the
3028	3028	25 personal information or the use or disclosure of the
3029	3029	26 sensitive personal information without affecting the
3030	3030
3031	3031
3032	3032
3033	3033
3034	3034
3035	3035	SB3517 - 84 - LRB103 35732 LNS 65813 b
3036	3036
3037	3037
3038	3038	SB3517- 85 -LRB103 35732 LNS 65813 b SB3517 - 85 - LRB103 35732 LNS 65813 b
3039	3039	SB3517 - 85 - LRB103 35732 LNS 65813 b
3040	3040	1 consumer's preferences with respect to other
3041	3041	2 businesses or disabling the opt-out preference signal
3042	3042	3 globally; and
3043	3043	4 (vi) state that in the case of a page or setting
3044	3044	5 view that the consumer accesses to set the opt-out
3045	3045	6 preference signal, the consumer should see up to 3
3046	3046	7 choices, including:
3047	3047	8 (I) a global opt-out from sale and sharing of
3048	3048	9 personal information, including a direction to
3049	3049	10 limit the use of sensitive personal information;
3050	3050	11 (II) a choice to "Limit the Use of My
3051	3051	12 Sensitive Personal Information"; and
3052	3052	13 (III) a choice to "Do Not Sell or Do Not Share
3053	3053	14 My Personal Information for Cross-Context
3054	3054	15 Behavioral Advertising";
3055	3055	16 (B) issuing rules to establish technical
3056	3056	17 specifications for an opt-out preference signal that
3057	3057	18 allows the consumer, or the consumer's parent or guardian,
3058	3058	19 to specify that the consumer is less than 13 years of age
3059	3059	20 or at least 13 years of age and less than 16 years of age;
3060	3060	21 and
3061	3061	22 (C) issuing rules, with the goal of strengthening
3062	3062	23 consumer privacy while considering the legitimate
3063	3063	24 operational interests of businesses, to govern the use or
3064	3064	25 disclosure of sensitive personal information,
3065	3065	26 notwithstanding the consumer's direction to limit the use
3066	3066
3067	3067
3068	3068
3069	3069
3070	3070
3071	3071	SB3517 - 85 - LRB103 35732 LNS 65813 b
3072	3072
3073	3073
3074	3074	SB3517- 86 -LRB103 35732 LNS 65813 b SB3517 - 86 - LRB103 35732 LNS 65813 b
3075	3075	SB3517 - 86 - LRB103 35732 LNS 65813 b
3076	3076	1 or disclosure of the sensitive personal information,
3077	3077	2 including:
3078	3078	3 (i) determining any additional purposes for which
3079	3079	4 a business may use or disclose sensitive personal
3080	3080	5 information;
3081	3081	6 (ii) determining the scope of activities permitted
3082	3082	7 under the definition of business purposes, as
3083	3083	8 authorized by subsection (a) of Section 10-35, to
3084	3084	9 ensure that the activities do not involve
3085	3085	10 health-related research;
3086	3086	11 (iii) ensuring the functionality of the business'
3087	3087	12 operations; and
3088	3088	13 (iv) ensuring that the exemption in subsection (d)
3089	3089	14 of Section 10-35 for sensitive personal information
3090	3090	15 applies to sensitive personal information that is
3091	3091	16 collected or processed incidentally, or without the
3092	3092	17 purpose of inferring characteristics about a consumer,
3093	3093	18 while ensuring that businesses do not use the
3094	3094	19 exemption for the purpose of evading consumers' rights
3095	3095	20 to limit the use and disclosure of sensitive personal
3096	3096	21 information under Section 10-35;
3097	3097	22 (20) issuing rules to govern how a business that has
3098	3098	23 elected to comply with subsection (b) of Section 10-50
3099	3099	24 responds to the opt-out preference signal and provides
3100	3100	25 consumers with the opportunity subsequently to consent to
3101	3101	26 the sale or sharing of their personal information or the
3102	3102
3103	3103
3104	3104
3105	3105
3106	3106
3107	3107	SB3517 - 86 - LRB103 35732 LNS 65813 b
3108	3108
3109	3109
3110	3110	SB3517- 87 -LRB103 35732 LNS 65813 b SB3517 - 87 - LRB103 35732 LNS 65813 b
3111	3111	SB3517 - 87 - LRB103 35732 LNS 65813 b
3112	3112	1 use and disclosure of their sensitive personal information
3113	3113	2 for purposes in addition to those authorized by subsection
3114	3114	3 (a) of Section 10-50. The rules should:
3115	3115	4 (A) strive to promote competition and consumer
3116	3116	5 choice and be technology neutral;
3117	3117	6 (B) ensure that the business does not respond to
3118	3118	7 an opt-out preference signal by:
3119	3119	8 (i) intentionally degrading the functionality
3120	3120	9 of the consumer experience;
3121	3121	10 (ii) charging the consumer a fee in response
3122	3122	11 to the consumer's opt-out preferences;
3123	3123	12 (iii) making any products or services not
3124	3124	13 function properly or fully for the consumer, as
3125	3125	14 compared to consumers who do not use the opt-out
3126	3126	15 preference signal;
3127	3127	16 (iv) attempting to coerce the consumer to opt
3128	3128	17 in to the sale or sharing of the personal
3129	3129	18 information, or the use or disclosure of the
3130	3130	19 sensitive personal information, by stating or
3131	3131	20 implying that the use of the opt-out preference
3132	3132	21 signal will adversely affect the consumer as
3133	3133	22 compared to consumers who do not use the opt-out
3134	3134	23 preference signal, including stating or implying
3135	3135	24 that the consumer will not be able to use the
3136	3136	25 business' products or services or that those
3137	3137	26 products or services may not function properly or
3138	3138
3139	3139
3140	3140
3141	3141
3142	3142
3143	3143	SB3517 - 87 - LRB103 35732 LNS 65813 b
3144	3144
3145	3145
3146	3146	SB3517- 88 -LRB103 35732 LNS 65813 b SB3517 - 88 - LRB103 35732 LNS 65813 b
3147	3147	SB3517 - 88 - LRB103 35732 LNS 65813 b
3148	3148	1 fully; and
3149	3149	2 (v) displaying any notification or pop-up in
3150	3150	3 response to the consumer's opt-out preference
3151	3151	4 signal;
3152	3152	5 (C) ensure that any link to a webpage or its
3153	3153	6 supporting content that allows the consumer to consent
3154	3154	7 to opt in:
3155	3155	8 (i) is not part of a pop-up, notice, banner,
3156	3156	9 or other intrusive design that obscures any part
3157	3157	10 of the webpage the consumer intended to visit from
3158	3158	11 full view or that interferes with or impedes in
3159	3159	12 any way the consumer's experience visiting or
3160	3160	13 browsing the webpage or website the consumer
3161	3161	14 intended to visit;
3162	3162	15 (ii) does not require or imply that the
3163	3163	16 consumer must click the link to receive full
3164	3164	17 functionality of any products or services,
3165	3165	18 including the website;
3166	3166	19 (iii) does not make use of any dark patterns;
3167	3167	20 and
3168	3168	21 (iv) applies only to the business with which
3169	3169	22 the consumer intends to interact; and
3170	3170	23 (D) strive to curb coercive or deceptive practices
3171	3171	24 in response to an opt-out preference signal but should
3172	3172	25 not unduly restrict businesses that are trying in good
3173	3173	26 faith to comply with Section 10-50;
3174	3174
3175	3175
3176	3176
3177	3177
3178	3178
3179	3179	SB3517 - 88 - LRB103 35732 LNS 65813 b
3180	3180
3181	3181
3182	3182	SB3517- 89 -LRB103 35732 LNS 65813 b SB3517 - 89 - LRB103 35732 LNS 65813 b
3183	3183	SB3517 - 89 - LRB103 35732 LNS 65813 b
3184	3184	1 (21) reviewing existing Illinois Insurance Code
3185	3185	2 provisions and rules relating to consumer privacy, except
3186	3186	3 those relating to insurance rates or pricing, to determine
3187	3187	4 whether any provisions of the Illinois Insurance Code
3188	3188	5 provide greater protection to consumers than the
3189	3189	6 provisions of this Act. Upon completing its review, the
3190	3190	7 Agency shall adopt a rule that applies only the more
3191	3191	8 protective provisions of this Act to insurance companies.
3192	3192	9 The Director of Insurance shall have jurisdiction over
3193	3193	10 insurance rates and pricing; and
3194	3194	11 (22) harmonizing the rules governing opt-out
3195	3195	12 mechanisms, notices to consumers, and other operational
3196	3196	13 mechanisms in this Act to promote clarity and the
3197	3197	14 functionality of this Act for consumers.
3198	3198	15 (b) The Attorney General may adopt additional rules as
3199	3199	16 necessary to further the purposes of this Act.
3200	3200	17 (c) The Attorney General shall not bring an enforcement
3201	3201	18 action under this Act until 6 months after the publication of
3202	3202	19 the final rules adopted under this Section or July 1, 2025,
3203	3203	20 whichever is sooner.
3204	3204	21 (d) Notwithstanding subsection (a), the timeline for
3205	3205	22 adopting final rules required by the Act shall be July 1, 2025.
3206	3206	23 Beginning the later of July 1, 2025, or 6 months after the
3207	3207	24 Agency provides notice to the Attorney General that it is
3208	3208	25 prepared to begin rulemaking under this Act, the authority
3209	3209	26 assigned to the Attorney General to adopt rules under this
3210	3210
3211	3211
3212	3212
3213	3213
3214	3214
3215	3215	SB3517 - 89 - LRB103 35732 LNS 65813 b
3216	3216
3217	3217
3218	3218	SB3517- 90 -LRB103 35732 LNS 65813 b SB3517 - 90 - LRB103 35732 LNS 65813 b
3219	3219	SB3517 - 90 - LRB103 35732 LNS 65813 b
3220	3220	1 Section shall be exercised by the Agency. Notwithstanding any
3221	3221	2 other law, civil and administrative enforcement of the
3222	3222	3 provisions of law added or amended by this Act shall not
3223	3223	4 commence until July 1, 2025, and shall only apply to
3224	3224	5 violations occurring on or after that date.
3225	3225	6 Section 10-80. Anti-avoidance. A court or the Agency shall
3226	3226	7 disregard the intermediate steps or transactions for purposes
3227	3227	8 of effectuating the purposes of this Act:
3228	3228	9 (1) if a series of steps or transactions were
3229	3229	10 component parts of a single transaction intended from the
3230	3230	11 beginning to be taken with the intention of avoiding the
3231	3231	12 reach of this Act, including the disclosure of personal
3232	3232	13 information by a business to a third party in order to
3233	3233	14 avoid the definition of sell or share; or
3234	3234	15 (2) if steps or transactions were taken to purposely
3235	3235	16 avoid the definition of sell or share by eliminating any
3236	3236	17 monetary or other valuable consideration, including by
3237	3237	18 entering into contracts that do not include an exchange
3238	3238	19 for monetary or other valuable consideration, but where a
3239	3239	20 party is obtaining something of value or use.
3240	3240	21 Section 10-85. Waiver. Any provision of a contract or
3241	3241	22 agreement of any kind, including a representative action
3242	3242	23 waiver, that purports to waive or limit in any way a consumer's
3243	3243	24 rights under this Act, including, but not limited to, any
3244	3244
3245	3245
3246	3246
3247	3247
3248	3248
3249	3249	SB3517 - 90 - LRB103 35732 LNS 65813 b
3250	3250
3251	3251
3252	3252	SB3517- 91 -LRB103 35732 LNS 65813 b SB3517 - 91 - LRB103 35732 LNS 65813 b
3253	3253	SB3517 - 91 - LRB103 35732 LNS 65813 b
3254	3254	1 right to a remedy or means of enforcement, shall be deemed
3255	3255	2 contrary to public policy and shall be void and unenforceable.
3256	3256	3 This Section shall not prevent a consumer from declining to
3257	3257	4 request personal information from a business, declining to opt
3258	3258	5 out of a business's sale of the personal information, or
3259	3259	6 authorizing a business to sell or share the personal
3260	3260	7 information after previously opting-out.
3261	3261	8 Section 10-90. Good faith cooperation. The Agency, and any
3262	3262	9 court, as applicable, shall consider the good faith
3263	3263	10 cooperation of the business, service provider, contractor, or
3264	3264	11 other person in determining the amount of any administrative
3265	3265	12 fine or civil penalty for a violation of this Act. A business
3266	3266	13 shall not be required by the Agency, a court, or otherwise to
3267	3267	14 pay both an administrative fine and a civil penalty for the
3268	3268	15 same violation.
3269	3269	16 Section 10-95. Remedies.
3270	3270	17 (a) Any business, service provider, contractor, or other
3271	3271	18 person that violates this Act shall be subject to an
3272	3272	19 injunction and liable for a civil penalty of not more than
3273	3273	20 $2,500 for each violation or $7,500 for each intentional
3274	3274	21 violation and each violation involving the personal
3275	3275	22 information of minor consumers, as adjusted by rule, which
3276	3276	23 shall be assessed and recovered in a civil action brought by
3277	3277	24 the Attorney General. The court may consider the good faith
3278	3278
3279	3279
3280	3280
3281	3281
3282	3282
3283	3283	SB3517 - 91 - LRB103 35732 LNS 65813 b
3284	3284
3285	3285
3286	3286	SB3517- 92 -LRB103 35732 LNS 65813 b SB3517 - 92 - LRB103 35732 LNS 65813 b
3287	3287	SB3517 - 92 - LRB103 35732 LNS 65813 b
3288	3288	1 cooperation of the business, service provider, contractor, or
3289	3289	2 other person in determining the amount of the civil penalty.
3290	3290	3 (b) Any civil penalty recovered by an action brought by
3291	3291	4 the Attorney General for a violation of this Act, and the
3292	3292	5 proceeds of any settlement of any said action, shall be
3293	3293	6 deposited into the Consumer Privacy Fund.
3294	3294	7 (c) The Agency shall, upon request by the Attorney
3295	3295	8 General, stay an administrative action or investigation under
3296	3296	9 this Act to permit the Attorney General to proceed with an
3297	3297	10 investigation or civil action and shall not pursue an
3298	3298	11 administrative action or investigation, unless the Attorney
3299	3299	12 General subsequently determines not to pursue an investigation
3300	3300	13 or civil action. The Agency may not limit the authority of the
3301	3301	14 Attorney General to enforce this Act.
3302	3302	15 (d) No civil action may be filed by the Attorney General
3303	3303	16 under this Section for any violation of this Act after the
3304	3304	17 Agency has issued a decision under Section 15-80 or an order
3305	3305	18 under Section 15-50 against that person for the same
3306	3306	19 violation.
3307	3307	20 (e) This Section shall not affect the private right of
3308	3308	21 action provided for in Section 10-60.
3309	3309	22 Article 15. Privacy Protection Agency
3310	3310	23 Section 15-5. Establishment of Privacy Protection Agency.
3311	3311	24 (a) There is hereby established the Privacy Protection
3312	3312
3313	3313
3314	3314
3315	3315
3316	3316
3317	3317	SB3517 - 92 - LRB103 35732 LNS 65813 b
3318	3318
3319	3319
3320	3320	SB3517- 93 -LRB103 35732 LNS 65813 b SB3517 - 93 - LRB103 35732 LNS 65813 b
3321	3321	SB3517 - 93 - LRB103 35732 LNS 65813 b
3322	3322	1 Agency, which is vested with full administrative power,
3323	3323	2 authority, and jurisdiction to implement and enforce this Act.
3324	3324	3 The Agency shall be governed by a 5-member board, including
3325	3325	4 the chairperson. The chairperson and one member of the Board
3326	3326	5 shall be appointed by the Governor. The Attorney General,
3327	3327	6 President of the Senate, and Speaker of the House shall each
3328	3328	7 appoint one member to the Board. These appointments should be
3329	3329	8 made from among State residents with expertise in the areas of
3330	3330	9 privacy, technology, and consumer rights.
3331	3331	10 (b) The initial appointments to the Board shall be made
3332	3332	11 within 90 days of the effective date of this Act.
3333	3333	12 Section 15-10. Member requirements. Members of the Board
3334	3334	13 shall:
3335	3335	14 (1) have qualifications, experience, and skills, in
3336	3336	15 particular in the areas of privacy and technology,
3337	3337	16 required to perform the duties of the Agency and exercise
3338	3338	17 its powers;
3339	3339	18 (2) maintain the confidentiality of information which
3340	3340	19 has come to their knowledge in the course of the
3341	3341	20 performance of their tasks or exercise of their powers,
3342	3342	21 except to the extent that disclosure is required by the
3343	3343	22 Freedom of Information Act;
3344	3344	23 (3) remain free from external influence, whether
3345	3345	24 direct or indirect, and shall neither seek nor take
3346	3346	25 instructions from another;
3347	3347
3348	3348
3349	3349
3350	3350
3351	3351
3352	3352	SB3517 - 93 - LRB103 35732 LNS 65813 b
3353	3353
3354	3354
3355	3355	SB3517- 94 -LRB103 35732 LNS 65813 b SB3517 - 94 - LRB103 35732 LNS 65813 b
3356	3356	SB3517 - 94 - LRB103 35732 LNS 65813 b
3357	3357	1 (4) refrain from any action incompatible with their
3358	3358	2 duties and engaging in any incompatible occupation,
3359	3359	3 whether gainful or not, during their term;
3360	3360	4 (5) have the right of access to all information made
3361	3361	5 available by the Agency to the chairperson;
3362	3362	6 (6) be precluded, for a period of one year after
3363	3363	7 leaving office, from accepting employment with a business
3364	3364	8 that was subject to an enforcement action or civil action
3365	3365	9 under this Act during the member's tenure or during the
3366	3366	10 5-year period preceding the member's appointment; and
3367	3367	11 (7) be precluded for a period of 2 years after leaving
3368	3368	12 office from acting, for compensation, as an agent or
3369	3369	13 attorney for, or otherwise representing, any other person
3370	3370	14 in a matter pending before the Agency if the purpose is to
3371	3371	15 influence an action of the Agency.
3372	3372	16 Section 15-15. Terms. Members of the Board, including the
3373	3373	17 chairperson, shall serve at the pleasure of their appointing
3374	3374	18 authority but shall serve for no longer than 8 consecutive
3375	3375	19 years.
3376	3376	20 Section 15-20. Compensation. For each day on which they
3377	3377	21 engage in official duties, members of the Board shall be
3378	3378	22 compensated at the rate of $100, adjusted biennially to
3379	3379	23 reflect changes in the cost of living, and shall be reimbursed
3380	3380	24 for expenses incurred in performance of their official duties.
3381	3381
3382	3382
3383	3383
3384	3384
3385	3385
3386	3386	SB3517 - 94 - LRB103 35732 LNS 65813 b
3387	3387
3388	3388
3389	3389	SB3517- 95 -LRB103 35732 LNS 65813 b SB3517 - 95 - LRB103 35732 LNS 65813 b
3390	3390	SB3517 - 95 - LRB103 35732 LNS 65813 b
3391	3391	1 Section 15-25. Executive director, officers, counsel, and
3392	3392	2 employees. The Board shall appoint an executive director who
3393	3393	3 shall act in accordance with Agency policies and rules and
3394	3394	4 with applicable law. The Agency shall appoint and discharge
3395	3395	5 officers, counsel, and employees, consistent with applicable
3396	3396	6 civil service laws, and shall fix the compensation of
3397	3397	7 employees and prescribe their duties. The Agency may contract
3398	3398	8 for services that cannot be provided by its employees.
3399	3399	9 Section 15-30. Authority. The Board may delegate authority
3400	3400	10 to the chairperson or the executive director to act in the name
3401	3401	11 of the Agency between meetings of the Agency, except with
3402	3402	12 respect to resolution of enforcement actions and rulemaking
3403	3403	13 authority.
3404	3404	14 Section 15-35. Functions. The Agency shall perform the
3405	3405	15 following functions:
3406	3406	16 (1) administer, implement, and enforce through
3407	3407	17 administrative actions this Act;
3408	3408	18 (2) on and after the earlier of July 1, 2025, or within
3409	3409	19 6 months of the Agency providing the Attorney General with
3410	3410	20 notice that it is prepared to assume rulemaking
3411	3411	21 responsibilities under this Act, adopt, amend, and rescind
3412	3412	22 rules under Section 10-75 to carry out the purposes and
3413	3413	23 provisions of this Act, including rules specifying
3414	3414
3415	3415
3416	3416
3417	3417
3418	3418
3419	3419	SB3517 - 95 - LRB103 35732 LNS 65813 b
3420	3420
3421	3421
3422	3422	SB3517- 96 -LRB103 35732 LNS 65813 b SB3517 - 96 - LRB103 35732 LNS 65813 b
3423	3423	SB3517 - 96 - LRB103 35732 LNS 65813 b
3424	3424	1 recordkeeping requirements for businesses to ensure
3425	3425	2 compliance with this Act;
3426	3426	3 (3) through the implementation of this Act, protect
3427	3427	4 the fundamental privacy rights of natural persons with
3428	3428	5 respect to the use of their personal information;
3429	3429	6 (4) promote public awareness and understanding of the
3430	3430	7 risks, rules, responsibilities, safeguards, and rights in
3431	3431	8 relation to the collection, use, sale, and disclosure of
3432	3432	9 personal information, including the rights of minors with
3433	3433	10 respect to their own information, and provide a public
3434	3434	11 report summarizing the risk assessments filed with the
3435	3435	12 Agency while ensuring that data security is not
3436	3436	13 compromised;
3437	3437	14 (5) provide guidance to consumers regarding their
3438	3438	15 rights under this Act;
3439	3439	16 (6) provide guidance to businesses regarding their
3440	3440	17 duties and responsibilities under this Act and appoint a
3441	3441	18 Chief Privacy Auditor to conduct audits of businesses to
3442	3442	19 ensure compliance with this Act;
3443	3443	20 (7) provide technical assistance and advice to the
3444	3444	21 General Assembly, upon request, with respect to
3445	3445	22 privacy-related legislation;
3446	3446	23 (8) monitor relevant developments relating to the
3447	3447	24 protection of personal information and in particular, the
3448	3448	25 development of information and communication technologies
3449	3449	26 and commercial practices;
3450	3450
3451	3451
3452	3452
3453	3453
3454	3454
3455	3455	SB3517 - 96 - LRB103 35732 LNS 65813 b
3456	3456
3457	3457
3458	3458	SB3517- 97 -LRB103 35732 LNS 65813 b SB3517 - 97 - LRB103 35732 LNS 65813 b
3459	3459	SB3517 - 97 - LRB103 35732 LNS 65813 b
3460	3460	1 (9) cooperate with other agencies with jurisdiction
3461	3461	2 over privacy laws and with data processing authorities in
3462	3462	3 this State, other states, territories, and countries to
3463	3463	4 ensure consistent application of privacy protections;
3464	3464	5 (10) establish a mechanism under which persons doing
3465	3465	6 business in this State that do not meet the definition of
3466	3466	7 business may voluntarily certify that they are in
3467	3467	8 compliance with this Act, and make a list of those
3468	3468	9 entities available to the public;
3469	3469	10 (11) solicit, review, and approve applications for
3470	3470	11 grants to the extent funds are available under paragraph
3471	3471	12 (2) of subsection (b) of Section 10-70; and
3472	3472	13 (12) perform all other acts necessary or appropriate
3473	3473	14 in the exercise of its power, authority, and jurisdiction
3474	3474	15 and seek to balance the goals of strengthening consumer
3475	3475	16 privacy while giving attention to the impact on
3476	3476	17 businesses.
3477	3477	18 Section 15-40. Investigation of violations.
3478	3478	19 (a) Upon the sworn complaint of any person or on its own
3479	3479	20 initiative, the Agency may investigate possible violations of
3480	3480	21 this Act relating to any business, service provider,
3481	3481	22 contractor, or person. The Agency may decide not to
3482	3482	23 investigate a complaint or decide to provide a business with a
3483	3483	24 period to cure the alleged violation. In making a decision not
3484	3484	25 to investigate or provide more time to cure, the Agency may
3485	3485
3486	3486
3487	3487
3488	3488
3489	3489
3490	3490	SB3517 - 97 - LRB103 35732 LNS 65813 b
3491	3491
3492	3492
3493	3493	SB3517- 98 -LRB103 35732 LNS 65813 b SB3517 - 98 - LRB103 35732 LNS 65813 b
3494	3494	SB3517 - 98 - LRB103 35732 LNS 65813 b
3495	3495	1 consider:
3496	3496	2 (1) the lack of intent to violate this Act; and
3497	3497	3 (2) the voluntary efforts undertaken by the business,
3498	3498	4 service provider, contractor, or person to cure the
3499	3499	5 alleged violation prior to being notified by the Agency of
3500	3500	6 the complaint.
3501	3501	7 (b) The Agency shall notify in writing the person who made
3502	3502	8 the complaint of the action, if any, the Agency has taken or
3503	3503	9 plans to take on the complaint, together with the reasons for
3504	3504	10 that action or nonaction.
3505	3505	11 Section 15-45. Notice. No finding of probable cause to
3506	3506	12 believe this Act has been violated shall be made by the Agency
3507	3507	13 unless, at least 30 days prior to the Agency's consideration
3508	3508	14 of the alleged violation, the business, service provider,
3509	3509	15 contractor, or person alleged to have violated this Act is
3510	3510	16 notified of the violation by service of process or registered
3511	3511	17 mail with return receipt requested, provided with a summary of
3512	3512	18 the evidence, and informed of their right to be present in
3513	3513	19 person and represented by counsel at any proceeding of the
3514	3514	20 Agency held for the purpose of considering whether probable
3515	3515	21 cause exists for believing the person violated this Act.
3516	3516	22 Notice to the alleged violator shall be deemed made on the date
3517	3517	23 of service, the date the registered mail receipt is signed, or
3518	3518	24 if the registered mail receipt is not signed, the date
3519	3519	25 returned by the post office. A proceeding held for the purpose
3520	3520
3521	3521
3522	3522
3523	3523
3524	3524
3525	3525	SB3517 - 98 - LRB103 35732 LNS 65813 b
3526	3526
3527	3527
3528	3528	SB3517- 99 -LRB103 35732 LNS 65813 b SB3517 - 99 - LRB103 35732 LNS 65813 b
3529	3529	SB3517 - 99 - LRB103 35732 LNS 65813 b
3530	3530	1 of considering probable cause shall be private unless the
3531	3531	2 alleged violator files with the Agency a written request that
3532	3532	3 the proceeding be public.
3533	3533	4 Section 15-50. Procedure.
3534	3534	5 (a) If the Agency determines there is probable cause for
3535	3535	6 believing this Act has been violated, it shall hold a hearing
3536	3536	7 to determine if a violation or violations have occurred.
3537	3537	8 Notice shall be given and the hearing conducted in accordance
3538	3538	9 with the Illinois Administrative Procedure Act. The Agency
3539	3539	10 shall have all the powers granted by that Act. If the Agency
3540	3540	11 determines on the basis of the hearing conducted under this
3541	3541	12 subsection that a violation or violations have occurred, it
3542	3542	13 shall issue an order that may require the violator to do all or
3543	3543	14 any of the following:
3544	3544	15 (1) cease and desist violation of this Act; or
3545	3545	16 (2) subject to Section 10-65, pay an administrative
3546	3546	17 fine of up to $2,500 for each violation, or up to $7,500
3547	3547	18 for each intentional violation and each violation
3548	3548	19 involving the personal information of minor consumers to
3549	3549	20 the Consumer Privacy Fund.
3550	3550	21 If the Agency determines that no violation has occurred,
3551	3551	22 it shall publish a declaration so stating.
3552	3552	23 (b) If 2 or more persons are responsible for any violation
3553	3553	24 or violations, they shall be jointly and severally liable.
3554	3554
3555	3555
3556	3556
3557	3557
3558	3558
3559	3559	SB3517 - 99 - LRB103 35732 LNS 65813 b
3560	3560
3561	3561
3562	3562	SB3517- 100 -LRB103 35732 LNS 65813 b SB3517 - 100 - LRB103 35732 LNS 65813 b
3563	3563	SB3517 - 100 - LRB103 35732 LNS 65813 b
3564	3564	1 Section 15-55. Rejection of administrative law decision.
3565	3565	2 Whenever the Agency rejects the decision of an administrative
3566	3566	3 law judge, the Agency shall state the reasons in writing for
3567	3567	4 rejecting the decision.
3568	3568	5 Section 15-60. Subpoenas and evidence. The Agency may
3569	3569	6 subpoena witnesses, compel their attendance and testimony,
3570	3570	7 administer oaths and affirmations, take evidence and require
3571	3571	8 by subpoena the production of any books, papers, records, or
3572	3572	9 other items material to the performance of the Agency's duties
3573	3573	10 or exercise of its powers, including, but not limited to, its
3574	3574	11 power to audit a business's compliance with this Act.
3575	3575	12 Section 15-65. Limitations. No administrative action
3576	3576	13 brought under this Act alleging a violation of any of the
3577	3577	14 provisions of this Act shall be commenced more than 5 years
3578	3578	15 after the date on which the violation occurred.
3579	3579	16 (1) The service of the probable cause hearing notice
3580	3580	17 upon the person alleged to have violated this Act shall
3581	3581	18 constitute the commencement of the administrative action.
3582	3582	19 (2) If the person alleged to have violated this Act
3583	3583	20 engages in the fraudulent concealment of the person's acts
3584	3584	21 or identity, the 5-year period shall be tolled for the
3585	3585	22 period of the concealment.
3586	3586	23 (3) If, upon being ordered by a court to produce any
3587	3587	24 documents sought by a subpoena in any administrative
3588	3588
3589	3589
3590	3590
3591	3591
3592	3592
3593	3593	SB3517 - 100 - LRB103 35732 LNS 65813 b
3594	3594
3595	3595
3596	3596	SB3517- 101 -LRB103 35732 LNS 65813 b SB3517 - 101 - LRB103 35732 LNS 65813 b
3597	3597	SB3517 - 101 - LRB103 35732 LNS 65813 b
3598	3598	1 proceeding under this Act and the person alleged to have
3599	3599	2 violated this Act fails to produce documents in response
3600	3600	3 to the order by the date ordered to comply therewith, the
3601	3601	4 5-year period shall be tolled for the period of the delay
3602	3602	5 from the date of filing of the motion to compel until the
3603	3603	6 date the documents are produced.
3604	3604	7 Section 15-70. Collection of administrative fines.
3605	3605	8 (a) In addition to any other available remedies, the
3606	3606	9 Agency may bring a civil action and obtain a judgment in court
3607	3607	10 for the purpose of collecting any unpaid administrative fines
3608	3608	11 imposed under this Act after exhaustion of judicial review of
3609	3609	12 the Agency's action. The venue for this action shall be in the
3610	3610	13 county where the administrative fines were imposed by the
3611	3611	14 Agency. In order to obtain a judgment in a proceeding under
3612	3612	15 this Section, the Agency shall show, following the procedures
3613	3613	16 and rules of evidence as applied in ordinary civil actions:
3614	3614	17 (1) that the administrative fines were imposed
3615	3615	18 following the procedures set forth in this Act and
3616	3616	19 implementing rules;
3617	3617	20 (2) that the defendant or defendants in the action
3618	3618	21 were notified, by actual or constructive notice, of the
3619	3619	22 imposition of the administrative fines; and
3620	3620	23 (3) that a demand for payment has been made by the
3621	3621	24 Agency and full payment has not been received.
3622	3622	25 (b) A civil action brought under subsection (a) shall be
3623	3623
3624	3624
3625	3625
3626	3626
3627	3627
3628	3628	SB3517 - 101 - LRB103 35732 LNS 65813 b
3629	3629
3630	3630
3631	3631	SB3517- 102 -LRB103 35732 LNS 65813 b SB3517 - 102 - LRB103 35732 LNS 65813 b
3632	3632	SB3517 - 102 - LRB103 35732 LNS 65813 b
3633	3633	1 commenced within 4 years after the date on which the
3634	3634	2 administrative fines were imposed.
3635	3635	3 Section 15-75. Judgment.
3636	3636	4 (a) If the time for judicial review of a final Agency order
3637	3637	5 or decision has lapsed, or if all means of judicial review of
3638	3638	6 the order or decision have been exhausted, the Agency may
3639	3639	7 apply to the clerk of the court for a judgment to collect the
3640	3640	8 administrative fines imposed by the order or decision, or the
3641	3641	9 order as modified in accordance with a decision on judicial
3642	3642	10 review.
3643	3643	11 (b) The application, which shall include a certified copy
3644	3644	12 of the order or decision, or the order as modified in
3645	3645	13 accordance with a decision on judicial review, and proof of
3646	3646	14 service of the order or decision, constitutes a sufficient
3647	3647	15 showing to warrant issuance of the judgment to collect the
3648	3648	16 administrative fines. The clerk of the court shall enter the
3649	3649	17 judgment immediately in conformity with the application.
3650	3650	18 (c) An application made under this Section shall be made
3651	3651	19 to the clerk of the court in the county where the
3652	3652	20 administrative fines were imposed by the Agency.
3653	3653	21 (d) A judgment entered in accordance with this Section has
3654	3654	22 the same force and effect as, and is subject to all the
3655	3655	23 provisions of law relating to, a judgment in a civil action and
3656	3656	24 may be enforced in the same manner as any other judgment of the
3657	3657	25 court in which it is entered.
3658	3658
3659	3659
3660	3660
3661	3661
3662	3662
3663	3663	SB3517 - 102 - LRB103 35732 LNS 65813 b
3664	3664
3665	3665
3666	3666	SB3517- 103 -LRB103 35732 LNS 65813 b SB3517 - 103 - LRB103 35732 LNS 65813 b
3667	3667	SB3517 - 103 - LRB103 35732 LNS 65813 b
3668	3668	1 (e) The Agency may bring an application under this Section
3669	3669	2 only within 4 years after the date on which all means of
3670	3670	3 judicial review of the order or decision have been exhausted.
3671	3671	4 (f) The remedies available under this Section are in
3672	3672	5 addition to those available under any other law.
3673	3673	6 Section 15-80. Judicial review. Any decision of the Agency
3674	3674	7 with respect to a complaint or administrative fine shall be
3675	3675	8 subject to judicial review in an action brought by an
3676	3676	9 interested party to the complaint or administrative fine and
3677	3677	10 shall be subject to an abuse of discretion standard.
3678	3678	11 Article 20. Miscellaneous
3679	3679	12 Section 20-5. Conflicting provisions. This Act is intended
3680	3680	13 to further the constitutional right of privacy and to
3681	3681	14 supplement existing laws relating to personal information. The
3682	3682	15 provisions of this Act are not limited to information
3683	3683	16 collected electronically or over the Internet, but apply to
3684	3684	17 the collection and sale of all personal information collected
3685	3685	18 by a business from consumers. Wherever possible, law relating
3686	3686	19 to personal information should be construed to harmonize with
3687	3687	20 the provisions of this Act, but if a conflict between other
3688	3688	21 laws and the provisions of this Act, the provisions of the law
3689	3689	22 that afford the greatest protection for the right of privacy
3690	3690	23 for consumers shall control.
3691	3691
3692	3692
3693	3693
3694	3694
3695	3695
3696	3696	SB3517 - 103 - LRB103 35732 LNS 65813 b
3697	3697
3698	3698
3699	3699	SB3517- 104 -LRB103 35732 LNS 65813 b SB3517 - 104 - LRB103 35732 LNS 65813 b
3700	3700	SB3517 - 104 - LRB103 35732 LNS 65813 b
3701	3701	1 Section 20-10. Preemption. This Act is a matter of
3702	3702	2 statewide concern and supersedes and preempts all rules,
3703	3703	3 regulations, codes, ordinances, and other laws adopted by a
3704	3704	4 city, county, municipality, or local agency regarding the
3705	3705	5 collection and sale of consumers' personal information by a
3706	3706	6 business.
3707	3707	7 Section 20-15. Severability. The provisions of this Act
3708	3708	8 are severable under Section 1.31 of the Statute on Statutes.
3709	3709	9 Section 20-20. Standing. Notwithstanding any other
3710	3710	10 provision of law, if the State or any of its officials fail to
3711	3711	11 defend the constitutionality of this Act, any other
3712	3712	12 governmental agency of this State shall have the authority to
3713	3713	13 intervene in any court action challenging the
3714	3714	14 constitutionality of this Act for the purpose of defending its
3715	3715	15 constitutionality, whether that action is in State or federal
3716	3716	16 trial court, on appeal, or on discretionary review by the
3717	3717	17 Illinois Supreme Court or the Supreme Court of the United
3718	3718	18 States. The reasonable fees and costs of defending the action
3719	3719	19 shall be a charge on funds appropriated to the Office of the
3720	3720	20 Attorney General, which shall be satisfied promptly.
3721	3721	21 Section 20-25. Construction. This Act shall be liberally
3722	3722	22 construed to effectuate its purposes.
3723	3723
3724	3724
3725	3725
3726	3726
3727	3727
3728	3728	SB3517 - 104 - LRB103 35732 LNS 65813 b
3729	3729
3730	3730
3731	3731	SB3517- 105 -LRB103 35732 LNS 65813 b SB3517 - 105 - LRB103 35732 LNS 65813 b
3732	3732	SB3517 - 105 - LRB103 35732 LNS 65813 b
3733	3733	1 Section 20-30. Saving clause. This Act is intended to
3734	3734	2 supplement federal and State law, where permissible, but shall
3735	3735	3 not apply if that application is preempted by, or in conflict
3736	3736	4 with, federal law or the Illinois Constitution. The provisions
3737	3737	5 of this Act relating to children under 16 years of age shall
3738	3738	6 only apply to the extent not in conflict with the federal
3739	3739	7 Children's Online Privacy Protection Act.
3740	3740	8 Article 25. Amendatory Provisions
3741	3741	9 Section 25-5. The State Finance Act is amended by adding
3742	3742	10 Section 5.1015 as follows:
3743	3743
3744	3744
3745	3745
3746	3746
3747	3747
3748	3748	SB3517 - 105 - LRB103 35732 LNS 65813 b