Amends the Personal Information Protection Act. Provides that a data collector shall not own, maintain, license, store, or disclose records that contain immigration or citizenship status information concerning an Illinois resident. Provides that the provision shall not apply to government agencies, public and private universities, or financial institutions. Provides that the definition of "personal information" includes immigration or citizenship status information. Defines "immigration or citizenship status information".
Creates the Preventing Algorithmic Pricing Discrimination Act. Requires any person who knowingly advertises, promotes, labels, or publishes a statement, display, image, offer, or announcement of personalized algorithmic pricing using consumer data specific to a particular individual must disclose that this price was set by an algorithm using the individual's personal data. Prohibits the use of algorithmic pricing under certain conditions. Provides that if there is a violation of the Act, the Attorney General may file a civil action requesting that an injunction be issued against the defendant to enjoin and restrain the continuance of the violation. Provides that notice must be given to the defendant of not less than 5 days, and the court may issue an injunction enjoining and restraining any further violation without requiring proof that any person has, in fact, been injured or damaged. Authorizes the court to impose a civil penalty of not more than $1,000 for each violation. Exempts any insurer licensed, regulated, or otherwise authorized to do business in the State or any excess lines insurer, including any persons, agents, or affiliates acting on behalf of the insurer. Exempts financial services, including, but not limited to, financial institutions, financial institution affiliates, broker-dealers, registered investment advisors, and entities that provide consumer credit products such as credit cards, personal loans, and mortgages. Amends the Consumer Fraud and Deceptive Business Practices Act. Makes a violation of the Preventing Algorithmic Pricing Discrimination Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Limits home rule.
Creates the Illinois Consumer Data Privacy Act. Applies to legal entities that conduct business in Illinois or produce products or services that are targeted to Illinois residents and that satisfy one or more of the following thresholds: during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or derives over 25% of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more. "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person but does not include deidentified data or publicly available information. Requires a controller who, alone or jointly with others, to consider the purposes and means of the processing of personal data in protecting the security of consumers while processing personal data and in notifying consumers of a breach of the security of the system. Authorizes rights to consumers under the Act to include, but not be limited to, the right to access their personal data, obtain a list of third parties to whom their data has been disclosed, request corrections to inaccurate data, and question the profiling of their information. Creates an appeal process for a consumer to gather more information on the actions of a covered entity. Exempts the State, a political subdivision of the State, and units of local government, a federally recognized Indian tribe, nonprofits established to prevent insurance fraud, and data already covered by federal law. Authorizes the Attorney General to enforce the Act. Makes definitions. Makes other changes. Limits the concurrent exercise of home rule powers. Contains a severability provision.
Amends the Genetic Information Privacy Act. Adds legislative findings. Defines "neurotechnology" and "neurotechnology data". Prohibits insurers from using genetic testing or neurotechnology data (rather than only genetic testing) for nontherapeutic purposes or underwriting, with limited exceptions. Prohibits employers, employment agencies, labor organizations, and licensing agencies from requesting, requiring, or using neurotechnology data in employment decisions, subject to specified exceptions. Adds new provisions governing confidentiality, consent, privacy policies, and security requirements for entities collecting neurotechnology data. Regulates disclosure to government agencies and sets conditions for clinical research. Makes conforming changes. Effective January 1, 2027.
Creates the Algorithmic Pricing Transparency Act. Provides that any person or entity that sells or offers to sell goods or services through an online platform to consumers in this State shall provide a clear and conspicuous disclosure if the price displayed to a consumer is generated using surveillance pricing. Provides that a consumer may opt out of surveillance pricing and a covered entity shall provide the consumer with a non-personalized baseline price for the goods or services. Prohibits a covered entity from using specified personal information to generate algorithmic pricing. Provides that a violation of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective one year after becoming law.
Creates the Public Safety and Justice Privacy Act. Defines terms. Provides that governmental agencies, persons, businesses, and associations shall not publicly post or display publicly available content that includes a first responder's, member or former member of the Illinois General Assembly's, prosecutor's, public defender's, or probation officer's ("officials") personal information, provided that the governmental agency, person, business, or association has received a written request from the person that it refrain from disclosing the person's personal information. Provides injunctive or declaratory relief if the Act is violated. Includes procedures for a written request. Provides that it is a Class 3 felony for any person to knowingly and publicly post on the Internet the personal information of an official or an official's immediate family under specified circumstances. Excludes criminal penalties for employees of governmental agencies who publish information in good faith during the ordinary course of carrying out public functions. Provides that the Act and any rules adopted to implement the Act shall be construed broadly to favor the protection of the personal information of officials. Amends various Acts and Codes allowing an official to list a business address rather than a home address. Makes conforming changes. Effective immediately.
Creates the Behavioral Health Workforce Data Collection Act. Requires The Department of Financial and Professional Regulation to collect data, as specified, from behavioral health professionals at the time of initial application for licensure and renewal of an active license. Requires the Department to ensure the data collection process is secure and adheres to State and federal privacy laws, including de-identification of personal data. Provides that the Department shall make the collected data publicly available in an aggregated, de-identified format. Requires the data to be published in a format that allows policy groups, advocates, and other stakeholders to monitor the diversity, linguistic capacity, and availability of the behavioral health workforce; identify regions and specialties with severe shortages; and forecast future workforce needs. Requires the Department to publish the aggregated data annually by January 31 on its website and through other accessible formats. Grants the Department rulemaking authority to implement the Act. Requires the Department to comply with applicable data privacy and confidentiality laws. Provides that, for a period of 2 years following the effective date of the Act, the Department shall submit to the Illinois Behavioral Health Workforce Center a list of email addresses or email communications, subject to data privacy and confidentiality laws, of all licensed behavioral health professionals exclusively for purposes of collecting data related to the behavioral health workforce in Illinois. Effective immediately.
Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its Internet website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund to offset all reasonable costs of enforcing the registration requirements and establishing and maintaining the Internet website. Amends the State Finance Act to create the Data Broker Registry Fund.
Creates the State's Attorney and Peace Officer Privacy Act. Provides that government agencies shall not publicly post or display publicly available content that includes the personal information of a State's Attorney, Assistant State's Attorney, or peace officer if the government agency has received a written request in accordance with the Act that it refrain from disclosing the personal information of a State's Attorney, Assistant State's Attorney, or peace officer. Provides that if a government agency fails to comply with a written request to refrain from disclosing personal information, the State's Attorney, Assistant State's Attorney, or peace officer may bring an action seeking injunctive or declaratory relief in any court of competent jurisdiction. Provides that it is unlawful for any person to knowingly publicly post on the Internet the personal information of a State's Attorney, Assistant State's Attorney, or peace officer or of the immediate family of a State's Attorney, Assistant State's Attorney, or peace officer if the person knows or reasonably should know that publicly posting the personal information poses an imminent and serious threat to the health and safety of the State's Attorney, Assistant State's Attorney, or peace officer or the immediate family of the State's Attorney, Assistant State's Attorney, or peace officer, and the violation is a proximate cause of bodily injury or death of the State's Attorney, Assistant State's Attorney, or peace officer or the immediate family of the State's Attorney, Assistant State's Attorney, or peace officer. Provides that a person who violates this provision is guilty of a Class 3 felony. Provides exemptions. Defines terms. Effective immediately.
Amends the Personal Information Protection Act. Provides that no data collector shall routinely collect the social security number of an Illinois resident without a specific and immediate need. Defines "specific and immediate need".
