Technology (Consumer Data Protection)

Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Amends the Biometric Information Privacy Act. Provides that the changes made by Public Act 103-769 apply to pending actions as of August 2, 2024, and any actions commenced and complaints filed on or after August 2, 2024. Effective immediately.

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Amends the Biometric Information Privacy Act. Defines "biometric identifier" to include neural data. Defines "neural data" as information that is generated by the measurement of activity of an individual's central or peripheral nervous system, and that is not inferred from non-neural information.

Creates the Illinois Data Privacy and Protection Act. Provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate. Provides that a covered entity and a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection, processing, and transferring of covered data. Contains provisions concerning retaliation; transparency; individual data rights; consent; data protection for children and minors; civil rights; data security; small business protections; executive responsibility; service providers and third parties; enforcement; severability; and rulemaking. Effective 180 days after becoming law.

Creates the Utility Data Access Act. Requires the Illinois Commerce Commission to enact the following procedures: (1) a utility shall retain all consumption data for a period of not less than 2 years; (2) a qualified utility shall retain monthly consumption data used for billing for a period of not less than 15 years; (3) a utility shall honor an account holder's request to transmit the account holder's covered usage data held by the utility to any entity designated by the account holder; (4) a qualified data recipient with respect to a qualified building or qualified property may request that a qualified utility provide aggregated usage data for the qualified building or qualified property; (5) a utility shall deliver requested data on a schedule set by the Commission; and (6) the account holder request process and utility delivery of requested data shall be convenient and secure. Establishes requirements for: the Commission's participation in a stakeholder process; the form and timeline in which covered usage data is provided to the data recipient; entry of data into the benchmarking tool; and the provision of covered usage data to recipients upon account holder authorization. Provides that, except in cases where the utility has not followed processes established by the Act or the utility is grossly negligent, the utility shall be held harmless for third-party misuse of data shared under the Act and no cause of action may be initiated against the utility for such subsequent misuse. Provides that prior to filing for cost recovery, a qualified utility must first demonstrate good faith efforts to secure federal, State, or other relevant funding options. Sets forth provisions regarding funding for the Commission to carry out its responsibilities under the Act and the Commission selecting and engaging outside consultants with experience in benchmarking and utility data access. States findings. Defines terms.

Creates the Surveillance-Based Price and Wage Discrimination Act. Provides that a person shall not use surveillance data as part of an automated decision system to inform the individualized price assessed to a consumer for goods or services. Provides that a person shall not use surveillance data as part of an automated decision system to inform the individualized wage paid to an employee. Sets forth exemptions to the provisions. Provides that the Attorney General shall enforce the Act. Sets forth provisions concerning private rights of action and penalties for violations.

Amends the Biometric Information Privacy Act. Provides that nothing in the Act may be construed to apply to an entity using vehicle safety technology for a vehicle safety purpose.

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that the owner, licensee, or operator of a generative artificial intelligence system shall conspicuously display a warning on the system's user interface that is reasonably calculated to consistently apprise the user that the outputs of the generative artificial intelligence system may be inaccurate or inappropriate. Provides that a violation of the provision constitutes an unlawful practice within the meaning of the Act.