Illinois 2025-2026 Regular Session

Illinois House Bill HB2838 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB2838 Introduced , by Rep. Dan Ugaste SYNOPSIS AS INTRODUCED: 740 ILCS 14/10740 ILCS 14/15740 ILCS 14/20740 ILCS 14/25 Amends the Biometric Information Privacy Act. Changes the definition of "biometric identifier". Defines "biometric lock", "biometric time clock", "person", and "security purpose". Waives certain requirements for collecting, capturing, or otherwise obtaining a person's or a customer's biometric identifier or biometric information under certain circumstances relating to security purposes. Provides that nothing in the Act shall be construed to apply to information captured by a biometric time clock or biometric lock that converts a person's biometric identifier or biometric information to a mathematical representation. Provides that any person aggrieved by a violation of this Act has a right of action in State court or federal court within one year from its occurrence. Requires the aggrieved person to provide the private entity 30 days a written entity alleging the specific provisions of the Act that have been violated. Provides the private entity 30 days to cure the noticed violation. Exempts a private entity if its employees are covered by a collective bargaining agreement that provides for different policies regarding the retention, collection, disclosure, and destruction of biometric information. Effective immediately. LRB104 08099 JRC 18145 b A BILL FOR 104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB2838 Introduced , by Rep. Dan Ugaste SYNOPSIS AS INTRODUCED: 740 ILCS 14/10740 ILCS 14/15740 ILCS 14/20740 ILCS 14/25 740 ILCS 14/10 740 ILCS 14/15 740 ILCS 14/20 740 ILCS 14/25 Amends the Biometric Information Privacy Act. Changes the definition of "biometric identifier". Defines "biometric lock", "biometric time clock", "person", and "security purpose". Waives certain requirements for collecting, capturing, or otherwise obtaining a person's or a customer's biometric identifier or biometric information under certain circumstances relating to security purposes. Provides that nothing in the Act shall be construed to apply to information captured by a biometric time clock or biometric lock that converts a person's biometric identifier or biometric information to a mathematical representation. Provides that any person aggrieved by a violation of this Act has a right of action in State court or federal court within one year from its occurrence. Requires the aggrieved person to provide the private entity 30 days a written entity alleging the specific provisions of the Act that have been violated. Provides the private entity 30 days to cure the noticed violation. Exempts a private entity if its employees are covered by a collective bargaining agreement that provides for different policies regarding the retention, collection, disclosure, and destruction of biometric information. Effective immediately. LRB104 08099 JRC 18145 b LRB104 08099 JRC 18145 b A BILL FOR
2	2	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB2838 Introduced , by Rep. Dan Ugaste SYNOPSIS AS INTRODUCED:
3	3	740 ILCS 14/10740 ILCS 14/15740 ILCS 14/20740 ILCS 14/25 740 ILCS 14/10 740 ILCS 14/15 740 ILCS 14/20 740 ILCS 14/25
4	4	740 ILCS 14/10
5	5	740 ILCS 14/15
6	6	740 ILCS 14/20
7	7	740 ILCS 14/25
8	8	Amends the Biometric Information Privacy Act. Changes the definition of "biometric identifier". Defines "biometric lock", "biometric time clock", "person", and "security purpose". Waives certain requirements for collecting, capturing, or otherwise obtaining a person's or a customer's biometric identifier or biometric information under certain circumstances relating to security purposes. Provides that nothing in the Act shall be construed to apply to information captured by a biometric time clock or biometric lock that converts a person's biometric identifier or biometric information to a mathematical representation. Provides that any person aggrieved by a violation of this Act has a right of action in State court or federal court within one year from its occurrence. Requires the aggrieved person to provide the private entity 30 days a written entity alleging the specific provisions of the Act that have been violated. Provides the private entity 30 days to cure the noticed violation. Exempts a private entity if its employees are covered by a collective bargaining agreement that provides for different policies regarding the retention, collection, disclosure, and destruction of biometric information. Effective immediately.
9	9	LRB104 08099 JRC 18145 b LRB104 08099 JRC 18145 b
10	10	LRB104 08099 JRC 18145 b
11	11	A BILL FOR
12	12	HB2838LRB104 08099 JRC 18145 b HB2838 LRB104 08099 JRC 18145 b
13	13	HB2838 LRB104 08099 JRC 18145 b
14	14	1 AN ACT concerning civil law.
15	15	2 Be it enacted by the People of the State of Illinois,
16	16	3 represented in the General Assembly:
17	17	4 Section 5. The Biometric Information Privacy Act is
18	18	5 amended by changing Sections 10, 15, 20, and 25 as follows:
19	19	6 (740 ILCS 14/10)
20	20	7 Sec. 10. Definitions. In this Act:
21	21	8 "Biometric identifier" means a retina or iris scan,
22	22	9 fingerprint, voiceprint, or scan of hand or face geometry.
23	23	10 Biometric identifiers do not include writing samples, written
24	24	11 signatures, photographs, human biological samples used for
25	25	12 valid scientific testing or screening, demographic data,
26	26	13 tattoo descriptions, or physical descriptions such as height,
27	27	14 weight, hair color, or eye color. Biometric identifiers do not
28	28	15 include donated organs, tissues, or parts as defined in the
29	29	16 Illinois Anatomical Gift Act or blood or serum stored on
30	30	17 behalf of recipients or potential recipients of living or
31	31	18 cadaveric transplants and obtained or stored by a federally
32	32	19 designated organ procurement agency. Biometric identifiers do
33	33	20 not include biological materials regulated under the Genetic
34	34	21 Information Privacy Act. Biometric identifiers do not include
35	35	22 information captured from a patient in a health care setting
36	36	23 or information collected, used, or stored for health care
37	37
38	38
39	39
40	40	104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026 HB2838 Introduced , by Rep. Dan Ugaste SYNOPSIS AS INTRODUCED:
41	41	740 ILCS 14/10740 ILCS 14/15740 ILCS 14/20740 ILCS 14/25 740 ILCS 14/10 740 ILCS 14/15 740 ILCS 14/20 740 ILCS 14/25
42	42	740 ILCS 14/10
43	43	740 ILCS 14/15
44	44	740 ILCS 14/20
45	45	740 ILCS 14/25
46	46	Amends the Biometric Information Privacy Act. Changes the definition of "biometric identifier". Defines "biometric lock", "biometric time clock", "person", and "security purpose". Waives certain requirements for collecting, capturing, or otherwise obtaining a person's or a customer's biometric identifier or biometric information under certain circumstances relating to security purposes. Provides that nothing in the Act shall be construed to apply to information captured by a biometric time clock or biometric lock that converts a person's biometric identifier or biometric information to a mathematical representation. Provides that any person aggrieved by a violation of this Act has a right of action in State court or federal court within one year from its occurrence. Requires the aggrieved person to provide the private entity 30 days a written entity alleging the specific provisions of the Act that have been violated. Provides the private entity 30 days to cure the noticed violation. Exempts a private entity if its employees are covered by a collective bargaining agreement that provides for different policies regarding the retention, collection, disclosure, and destruction of biometric information. Effective immediately.
47	47	LRB104 08099 JRC 18145 b LRB104 08099 JRC 18145 b
48	48	LRB104 08099 JRC 18145 b
49	49	A BILL FOR
50	50
51	51
52	52
53	53
54	54
55	55	740 ILCS 14/10
56	56	740 ILCS 14/15
57	57	740 ILCS 14/20
58	58	740 ILCS 14/25
59	59
60	60
61	61
62	62	LRB104 08099 JRC 18145 b
63	63
64	64
65	65
66	66
67	67
68	68
69	69
70	70
71	71
72	72	HB2838 LRB104 08099 JRC 18145 b
73	73
74	74
75	75	HB2838- 2 -LRB104 08099 JRC 18145 b HB2838 - 2 - LRB104 08099 JRC 18145 b
76	76	HB2838 - 2 - LRB104 08099 JRC 18145 b
77	77	1 treatment, payment, or operations under the federal Health
78	78	2 Insurance Portability and Accountability Act of 1996.
79	79	3 Biometric identifiers do not include an X-ray, roentgen
80	80	4 process, computed tomography, MRI, PET scan, mammography, or
81	81	5 other image or film of the human anatomy used to diagnose,
82	82	6 prognose, or treat an illness or other medical condition or to
83	83	7 further validate scientific testing or screening. "Biometric
84	84	8 identifier" does not include (i) information captured and
85	85	9 converted to a mathematical representation, including, but not
86	86	10 limited to, a numeric string or similar method that cannot be
87	87	11 used to recreate the biometric identifier or (ii) information
88	88	12 that cannot reasonably be used to identify an individual.
89	89	13 "Biometric information" means any information, regardless
90	90	14 of how it is captured, converted, stored, or shared, based on
91	91	15 an individual's biometric identifier used to identify an
92	92	16 individual. Biometric information does not include information
93	93	17 derived from items or procedures excluded under the definition
94	94	18 of biometric identifiers.
95	95	19 "Biometric lock" means a device that is used to grant
96	96	20 access to a person and converts the person's biometric
97	97	21 identifier or biometric information to a mathematical
98	98	22 representation, including, but not limited to, a numeric
99	99	23 string or similar method that cannot be used to recreate the
100	100	24 person's biometric identifier.
101	101	25 "Biometric time clock" means a device that is used for
102	102	26 time management and converts a person's biometric identifier
103	103
104	104
105	105
106	106
107	107
108	108	HB2838 - 2 - LRB104 08099 JRC 18145 b
109	109
110	110
111	111	HB2838- 3 -LRB104 08099 JRC 18145 b HB2838 - 3 - LRB104 08099 JRC 18145 b
112	112	HB2838 - 3 - LRB104 08099 JRC 18145 b
113	113	1 or biometric information to a mathematical representation,
114	114	2 including, but not limited to, a numeric string or similar
115	115	3 method that cannot be used to recreate the person's biometric
116	116	4 identifier.
117	117	5 "Confidential and sensitive information" means personal
118	118	6 information that can be used to uniquely identify an
119	119	7 individual or an individual's account or property. Examples of
120	120	8 confidential and sensitive information include, but are not
121	121	9 limited to, a genetic marker, genetic testing information, a
122	122	10 unique identifier number to locate an account or property, an
123	123	11 account number, a PIN number, a pass code, a driver's license
124	124	12 number, or a social security number.
125	125	13 "Electronic signature" means an electronic sound, symbol,
126	126	14 or process attached to or logically associated with a record
127	127	15 and executed or adopted by a person with the intent to sign the
128	128	16 record.
129	129	17 "Person" means a natural person. A person does not include
130	130	18 an individual a private entity has no knowing contact with, or
131	131	19 awareness of.
132	132	20 "Private entity" means any individual, partnership,
133	133	21 corporation, limited liability company, association, or other
134	134	22 group, however organized. A private entity does not include a
135	135	23 State or local government agency. A private entity does not
136	136	24 include any court of Illinois, a clerk of the court, or a judge
137	137	25 or justice thereof.
138	138	26 "Security purpose" means for the purpose of preventing or
139	139
140	140
141	141
142	142
143	143
144	144	HB2838 - 3 - LRB104 08099 JRC 18145 b
145	145
146	146
147	147	HB2838- 4 -LRB104 08099 JRC 18145 b HB2838 - 4 - LRB104 08099 JRC 18145 b
148	148	HB2838 - 4 - LRB104 08099 JRC 18145 b
149	149	1 investigating retail theft, fraud, or any other
150	150	2 misappropriation or theft of a thing of value. "Security
151	151	3 purpose" includes protecting property from trespass,
152	152	4 controlling access to property, or protecting any person from
153	153	5 harm, including stalking, violence, or harassment, and
154	154	6 includes assisting a law enforcement investigation.
155	155	7 "Written release" means informed written consent,
156	156	8 electronic signature, or, in the context of employment, a
157	157	9 release executed by an employee as a condition of employment.
158	158	10 (Source: P.A. 103-769, eff. 8-2-24.)
159	159	11 (740 ILCS 14/15)
160	160	12 Sec. 15. Retention; collection; disclosure; destruction.
161	161	13 (a) A private entity in possession of biometric
162	162	14 identifiers or biometric information must develop a written
163	163	15 policy, made available to the person from whom biometric
164	164	16 information is to be collected or was collected public,
165	165	17 establishing a retention schedule and guidelines for
166	166	18 permanently destroying biometric identifiers and biometric
167	167	19 information when the initial purpose for collecting or
168	168	20 obtaining such identifiers or information has been satisfied
169	169	21 or within 3 years of the individual's last interaction with
170	170	22 the private entity, whichever occurs first. Absent a valid
171	171	23 order, warrant, or subpoena issued by a court of competent
172	172	24 jurisdiction or a local or federal governmental agency, a
173	173	25 private entity in possession of biometric identifiers or
174	174
175	175
176	176
177	177
178	178
179	179	HB2838 - 4 - LRB104 08099 JRC 18145 b
180	180
181	181
182	182	HB2838- 5 -LRB104 08099 JRC 18145 b HB2838 - 5 - LRB104 08099 JRC 18145 b
183	183	HB2838 - 5 - LRB104 08099 JRC 18145 b
184	184	1 biometric information must comply with its established
185	185	2 retention schedule and destruction guidelines.
186	186	3 (b) No private entity may collect, capture, purchase,
187	187	4 receive through trade, or otherwise obtain a person's or a
188	188	5 customer's biometric identifier or biometric information,
189	189	6 unless it first:
190	190	7 (1) informs the subject or the subject's legally
191	191	8 authorized representative in writing that a biometric
192	192	9 identifier or biometric information is being collected or
193	193	10 stored;
194	194	11 (2) informs the subject or the subject's legally
195	195	12 authorized representative in writing of the specific
196	196	13 purpose and length of term for which a biometric
197	197	14 identifier or biometric information is being collected,
198	198	15 stored, and used; and
199	199	16 (3) receives a written release executed by the subject
200	200	17 of the biometric identifier or biometric information or
201	201	18 the subject's legally authorized representative.
202	202	19 (b-5) A private entity may collect, capture, or otherwise
203	203	20 obtain a person's or a customer's biometric identifier or
204	204	21 biometric information without satisfying the requirements of
205	205	22 subsection (b) if:
206	206	23 (1) the private entity collects, captures, or
207	207	24 otherwise obtains a person's or a customer's biometric
208	208	25 identifier or biometric information for a security
209	209	26 purpose;
210	210
211	211
212	212
213	213
214	214
215	215	HB2838 - 5 - LRB104 08099 JRC 18145 b
216	216
217	217
218	218	HB2838- 6 -LRB104 08099 JRC 18145 b HB2838 - 6 - LRB104 08099 JRC 18145 b
219	219	HB2838 - 6 - LRB104 08099 JRC 18145 b
220	220	1 (2) the private entity uses the biometric identifier
221	221	2 or biometric information only for a security purpose;
222	222	3 (3) the private entity retains the biometric
223	223	4 identifier or biometric information no longer than is
224	224	5 reasonably necessary to satisfy a security purpose; and
225	225	6 (4) the private entity documents a process and time
226	226	7 frame to delete any biometric information used for the
227	227	8 purposes identified in this subsection.
228	228	9 (c) No private entity in possession of a biometric
229	229	10 identifier or biometric information may sell, lease, trade, or
230	230	11 otherwise profit from a person's or a customer's biometric
231	231	12 identifier or biometric information.
232	232	13 (d) No private entity in possession of a biometric
233	233	14 identifier or biometric information may disclose, redisclose,
234	234	15 or otherwise disseminate a person's or a customer's biometric
235	235	16 identifier or biometric information unless:
236	236	17 (1) the subject of the biometric identifier or
237	237	18 biometric information or the subject's legally authorized
238	238	19 representative consents to the disclosure or redisclosure;
239	239	20 (2) the disclosure or redisclosure completes a
240	240	21 financial transaction requested or authorized by the
241	241	22 subject of the biometric identifier or the biometric
242	242	23 information or the subject's legally authorized
243	243	24 representative;
244	244	25 (3) the disclosure or redisclosure is required by
245	245	26 State or federal law or municipal ordinance; or
246	246
247	247
248	248
249	249
250	250
251	251	HB2838 - 6 - LRB104 08099 JRC 18145 b
252	252
253	253
254	254	HB2838- 7 -LRB104 08099 JRC 18145 b HB2838 - 7 - LRB104 08099 JRC 18145 b
255	255	HB2838 - 7 - LRB104 08099 JRC 18145 b
256	256	1 (4) the disclosure is required pursuant to a valid
257	257	2 warrant or subpoena issued by a court of competent
258	258	3 jurisdiction.
259	259	4 (e) A private entity in possession of a biometric
260	260	5 identifier or biometric information shall:
261	261	6 (1) store, transmit, and protect from disclosure all
262	262	7 biometric identifiers and biometric information using the
263	263	8 reasonable standard of care within the private entity's
264	264	9 industry; and
265	265	10 (2) store, transmit, and protect from disclosure all
266	266	11 biometric identifiers and biometric information in a
267	267	12 manner that is the same as or more protective than the
268	268	13 manner in which the private entity stores, transmits, and
269	269	14 protects other confidential and sensitive information.
270	270	15 (Source: P.A. 95-994, eff. 10-3-08.)
271	271	16 (740 ILCS 14/20)
272	272	17 Sec. 20. Right of action.
273	273	18 (a) Any person aggrieved by a violation of this Act shall
274	274	19 have a right of action in a State circuit court or as a
275	275	20 supplemental claim in federal district court against an
276	276	21 offending party, which shall be commenced within one year
277	277	22 after the cause of action accrued if, prior to initiating any
278	278	23 action against a private entity, the aggrieved person provides
279	279	24 a private entity 30 days' written notice identifying the
280	280	25 specific provisions of this Act the aggrieved person alleges
281	281
282	282
283	283
284	284
285	285
286	286	HB2838 - 7 - LRB104 08099 JRC 18145 b
287	287
288	288
289	289	HB2838- 8 -LRB104 08099 JRC 18145 b HB2838 - 8 - LRB104 08099 JRC 18145 b
290	290	HB2838 - 8 - LRB104 08099 JRC 18145 b
291	291	1 have been or are being violated. If, within the 30 days, the
292	292	2 private entity actually cures the noticed violation and
293	293	3 provides the aggrieved person an express written statement
294	294	4 that the violation has been cured and that no further
295	295	5 violations shall occur, no action for individual statutory
296	296	6 damages or class-wide statutory damages may be initiated
297	297	7 against the private entity. If a private entity continues to
298	298	8 violate this Act in breach of the express written statement
299	299	9 provided to the aggrieved person under this Section, the
300	300	10 aggrieved person may initiate an action against the private
301	301	11 entity to enforce the written statement and may pursue
302	302	12 statutory damages for each breach of the express written
303	303	13 statement and any other violation that postdates the written
304	304	14 statement.
305	305	15 (b) A prevailing party may recover for each violation:
306	306	16 (1) against a private entity that negligently violates
307	307	17 a provision of this Act, liquidated damages of $1,000 or
308	308	18 actual damages, whichever is greater;
309	309	19 (2) against a private entity that intentionally or
310	310	20 recklessly violates a provision of this Act, liquidated
311	311	21 damages of $5,000 or actual damages, whichever is greater;
312	312	22 (3) reasonable attorneys' fees and costs, including
313	313	23 expert witness fees and other litigation expenses; and
314	314	24 (4) other relief, including an injunction, as the
315	315	25 State or federal court may deem appropriate.
316	316	26 (b) For purposes of subsection (b) of Section 15, a
317	317
318	318
319	319
320	320
321	321
322	322	HB2838 - 8 - LRB104 08099 JRC 18145 b
323	323
324	324
325	325	HB2838- 9 -LRB104 08099 JRC 18145 b HB2838 - 9 - LRB104 08099 JRC 18145 b
326	326	HB2838 - 9 - LRB104 08099 JRC 18145 b
327	327	1 private entity that, in more than one instance, collects,
328	328	2 captures, purchases, receives through trade, or otherwise
329	329	3 obtains the same biometric identifier or biometric information
330	330	4 from the same person using the same method of collection in
331	331	5 violation of subsection (b) of Section 15 has committed a
332	332	6 single violation of subsection (b) of Section 15 for which the
333	333	7 aggrieved person is entitled to, at most, one recovery under
334	334	8 this Section.
335	335	9 (c) For purposes of subsection (d) of Section 15, a
336	336	10 private entity that, in more than one instance, discloses,
337	337	11 rediscloses, or otherwise disseminates the same biometric
338	338	12 identifier or biometric information from the same person to
339	339	13 the same recipient using the same method of collection in
340	340	14 violation of subsection (d) of Section 15 has committed a
341	341	15 single violation of subsection (d) of Section 15 for which the
342	342	16 aggrieved person is entitled to, at most, one recovery under
343	343	17 this Section regardless of the number of times the private
344	344	18 entity disclosed, redisclosed, or otherwise disseminated the
345	345	19 same biometric identifier or biometric information of the same
346	346	20 person to the same recipient.
347	347	21 (Source: P.A. 103-769, eff. 8-2-24.)
348	348	22 (740 ILCS 14/25)
349	349	23 Sec. 25. Construction.
350	350	24 (a) Nothing in this Act shall be construed to impact the
351	351	25 admission or discovery of biometric identifiers and biometric
352	352
353	353
354	354
355	355
356	356
357	357	HB2838 - 9 - LRB104 08099 JRC 18145 b
358	358
359	359
360	360	HB2838- 10 -LRB104 08099 JRC 18145 b HB2838 - 10 - LRB104 08099 JRC 18145 b
361	361	HB2838 - 10 - LRB104 08099 JRC 18145 b
362	362	1 information in any action of any kind in any court, or before
363	363	2 any tribunal, board, agency, or person.
364	364	3 (b) Nothing in this Act shall be construed to conflict
365	365	4 with the X-Ray Retention Act, the federal Health Insurance
366	366	5 Portability and Accountability Act of 1996, and the rules
367	367	6 promulgated under either Act.
368	368	7 (c) Nothing in this Act shall be deemed to apply in any
369	369	8 manner to a financial institution or an affiliate of a
370	370	9 financial institution that is subject to Title V of the
371	371	10 federal Gramm-Leach-Bliley Act of 1999 and the rules
372	372	11 promulgated thereunder.
373	373	12 (d) Nothing in this Act shall be construed to conflict
374	374	13 with the Private Detective, Private Alarm, Private Security,
375	375	14 Fingerprint Vendor, and Locksmith Act of 2004 and the rules
376	376	15 promulgated thereunder or information captured by an alarm
377	377	16 system as defined by that Act installed by a person licensed
378	378	17 under that Act and the rules adopted thereunder.
379	379	18 (e) Nothing in this Act shall be construed to apply to a
380	380	19 contractor, subcontractor, or agent of a State or federal
381	381	20 agency or local unit of government when working for that State
382	382	21 or federal agency or local unit of government.
383	383	22 (f) Nothing in this Act shall be construed to apply to
384	384	23 information captured by a biometric time clock or biometric
385	385	24 lock that converts a person's biometric identifier or
386	386	25 biometric information to a mathematical representation,
387	387	26 including, but not limited to, a numeric string or similar
388	388
389	389
390	390
391	391
392	392
393	393	HB2838 - 10 - LRB104 08099 JRC 18145 b
394	394
395	395
396	396	HB2838- 11 -LRB104 08099 JRC 18145 b HB2838 - 11 - LRB104 08099 JRC 18145 b
397	397	HB2838 - 11 - LRB104 08099 JRC 18145 b
398	398	1 method that cannot be used to recreate the person's biometric
399	399	2 identifier or biometric information.
400	400	3 (g) Nothing in this Act shall be construed to apply to a
401	401	4 private entity if the private entity's employees are covered
402	402	5 by a collective bargaining agreement that provides for
403	403	6 different policies regarding the retention, collection,
404	404	7 disclosure, and destruction of biometric information.
405	405	8 (Source: P.A. 95-994, eff. 10-3-08.)
406	406
407	407
408	408
409	409
410	410
411	411	HB2838 - 11 - LRB104 08099 JRC 18145 b