Technology (Data Privacy)

Creates the General Assembly Privacy Act. Provides that government agencies shall not publicly post or display publicly available content that includes a member of the General Assembly's personal information, provided that the government agency has received a written request from the member. Prohibits a person, business, or association from soliciting, selling, or trading on the Internet a members's personal information with the intent to pose an imminent and serious threat to the health and safety of the member's immediate family. Allows for civil damages of not less than $10,000. Makes it a Class 3 felony to knowingly post personal information of the member's immediate family, if the person knows or reasonably should know the posting poses an imminent and serious threat to the health and safety of the member or the member's immediate family, and the posting is a proximate cause of bodily injury or death of the member or the member's immediate family.

Creates the Privacy Rights Act. Sets forth duties and obligations of businesses that collected consumers' personal information and sensitive personal information to keep such information private. Sets forth consumer rights in relation to the collected personal information and sensitive personal information, including the right to: delete personal information; correct inaccurate personal information; know what personal information is sold or shared and to whom; opt out of the sale or sharing of personal information; limit use and disclosure of sensitive personal information; and no retaliation for exercising any rights. Sets forth enforcement provisions. Creates the Consumer Privacy Fund. Allows the Attorney General to create rules to implement the Act. Establishes the Privacy Protection Agency. Includes provisions regarding remedies and fines for violations of the Act. Makes a conforming change in the State Finance Act.

Creates the Public Safety and Justice Privacy Act. Defines terms. Provides that government agencies, persons, businesses, and associations shall not publicly post or display publicly available content that includes a law enforcement officer's, prosecutor's, public defender's, or probation officer's ("officials") personal information, provided that the government agency, person, business, or association has received a written request from the person that it refrain from disclosing the person's personal information. Provides injunctive or declaratory relief if the Act is violated. Includes procedures for a written request. Provides that it is a Class 3 felony for any person to knowingly publicly post on the Internet the personal information of an official or an official's immediate family under specified circumstances. Excludes criminal penalties for employees of government agencies who publish information in good faith during the ordinary course of carrying out public functions. Provides that the Act and any rules adopted to implement the Act shall be construed broadly to favor the protection of the personal information of officials. Amends various Acts and Codes allowing an official to list a business address rather than a home address and makes conforming changes. Effective immediately.

Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

Creates the Anti-Click Gambling Data Analytics Collection Act. Provides that no entity that operates a remote gambling platform or a subsidiary of the entity shall collect data from a participant with the intent to predict how the participant will gamble in a particular gambling or betting scenario. Effective immediately.

Amends the Personal Information Protection Act. Provides that a data collector shall not own, maintain, license, store, or disclose records that contain immigration or citizenship status information concerning an Illinois resident. Provides that the provision shall not apply to government agencies, public and private universities, or financial institutions. Provides that the definition of "personal information" includes immigration or citizenship status information. Defines "immigration or citizenship status information".

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Creates the Protect Health Data Privacy Act. Provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information. Sets forth provisions concerning health data privacy policies. Provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances. Provides that it is unlawful for any person to sell or offer to sell health data concerning an individual without first obtaining valid authorization from the individual. Provides that a valid authorization to sell individual health data must contain specified information; a copy of the signed valid authorization must be provided to the individual; and the seller and purchaser of health data must retain a copy of all valid authorizations for sale of health data for 6 years after the date of its signature or the date when it was last in effect, whichever is later. Sets forth provisions concerning the consent required for collection, sharing, and storage of health data. Provides that an individual has the right to withdraw consent from the processing of the individual's health data. Provides that it is unlawful for a regulated entity to engage in discriminatory practices against individuals solely because they have not provided consent to the processing of their health data or have exercised any other rights provided by the provisions or guaranteed by law. Sets forth provisions concerning an individual's right to confirm whether a regulated entity is collecting, selling, sharing, or storing any of the individual's health data; an individual's right to have the individual's health data that is collected by a regulated entity deleted; prohibitions regarding geofencing; and individual health data security. Provides that any person aggrieved by a violation of the provisions shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. Provides that the Attorney General may enforce a violation of the provisions as an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Defines terms. Makes a conforming change in the Consumer Fraud and Deceptive Business Practices Act.

Amends the Biometric Information Privacy Act. Defines "biometric identifier" to include neural data. Defines "neural data" as information that is generated by the measurement of activity of an individual's central or peripheral nervous system, and that is not inferred from non-neural information.

Creates the Illinois Data Privacy and Protection Act. Provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate. Provides that a covered entity and a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection, processing, and transferring of covered data. Contains provisions concerning retaliation; transparency; individual data rights; consent; data protection for children and minors; civil rights; data security; small business protections; executive responsibility; service providers and third parties; enforcement; severability; and rulemaking. Effective 180 days after becoming law.