101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
HB5497

 

Introduced , by Rep. Ann M. Williams

 

SYNOPSIS AS INTRODUCED:
 
New Act

    Creates the Geolocation Privacy Protection Act. Provides that a private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing a specified notice to the user. Sets forth the purposes for which disclosure may be made. Provides that a violation of the Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Provides that the Act does not modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure. Provides that waiver of the provisions of the Act is void and unenforceable and an agreement that does not comply with the Act is void and unenforceable. Providers that the Act does not apply to certain entities.


LRB101 17462 JLS 66872 b

 

 

A BILL FOR

 

HB5497LRB101 17462 JLS 66872 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 1. Short title. This Act may be cited as the
5Geolocation Privacy Protection Act.
 
6    Section 5. Definitions. As used in this Act:
7    "Consent" means a clear affirmative act signifying a
8specific, informed, and unambiguous indication of a person's
9agreement, including through a written agreement or other clear
10affirmative action, that shall be valid only after all
11information as required by Section 10 has been disclosed to
12that person. "Consent" does not include only the continued use
13of a website or online service.
14    "Consumer transaction" means the disclosure of geolocation
15information for the purpose of moving or delivering tangible
16personal property made by a private entity or, with the private
17entity's authorization, the private entity's affiliate or
18service provider to process a consumer transaction.
19    "Disclose" means to disclose, release, transfer, share,
20disseminate, make available, sell, or otherwise communicate
21orally, in writing, or by electronic or any other means a
22consumer's geolocation information to any third party.
23    "Geolocation information" means information that: (i) is

 

 

HB5497- 2 -LRB101 17462 JLS 66872 b

1not the contents of a communication; (ii) is generated by or
2derived from, in whole or in part, the operation of a mobile
3device, including, but not limited to, a smart phone, tablet,
4or laptop computer; and (iii) is sufficient to determine or
5infer the precise geolocation of that device. "Geolocation
6information" does not include Internet protocol addresses.
7    "Location-based application" means a software application
8that is downloaded or installed onto a device and collects,
9uses, or stores geolocation information.
10    "Private entity" means any individual, partnership,
11corporation, limited liability company, association, or other
12group, however organized. "Private entity" does not include any
13governmental agency.
14    "User" means a resident of this State who purchases or
15leases a device.
 
16    Section 10. Disclosure of geolocation information from
17location-based applications.
18    (a) A private entity that owns, operates, or controls a
19location-based application on a user's device may not disclose
20geolocation information from a location-based application to a
21third party unless the private entity first receives the user's
22affirmative express consent after providing clear and accurate
23notice that:
24        (1) informs the user that his or her geolocation
25    information will be disclosed;

 

 

HB5497- 3 -LRB101 17462 JLS 66872 b

1        (2) informs the user of the purpose or purposes for
2    which his or her geolocation information will be disclosed;
3    and
4        (3) identifies the names and categories of private
5    entities to which geolocation information may be
6    disclosed.
7    (b) A private entity may disclose geolocation information
8from a location-based application on a user's device without
9receiving affirmative express consent if the disclosure is:
10        (1) to allow a parent or legal guardian to locate an
11    unemancipated minor child;
12        (2) to allow a court-appointed guardian to locate a
13    legally incapacitated person;
14        (3) in connection with fire, medical, public safety, or
15    other emergency services;
16        (4) to comply with a subpoena or court order; or
17        (5) made in connection with a consumer transaction
18    entered into by a consumer where a reasonable consumer
19    would expect the geolocation information to be disclosed.
20    (c) This Section does not apply to geolocation information
21that is stored locally and is not removed from a user's device.
22    (d) A private entity need not obtain a user's affirmative
23express consent after the user's initial consent as described
24in subsection (a) has been obtained unless the terms previously
25agreed to under items (1), (2), and (3) of subsection (a) are
26materially changed.

 

 

HB5497- 4 -LRB101 17462 JLS 66872 b

1    (e) This Section applies only to location-based
2applications created or modified after the effective date of
3this Act.
 
4    Section 15. Violations and enforcement. A violation of this
5Act constitutes an unlawful practice for which the Attorney
6General may take appropriate action under the Consumer Fraud
7and Deceptive Business Practices Act. All remedies, penalties,
8and authority granted to the Attorney General by that Act shall
9be available to the Attorney General for the enforcement of
10this Act. There shall be no private right of action to enforce
11violations under this Act.
 
12    Section 20. Compliance; contracts; waivers.
13    (a) Nothing in this Act shall be construed to modify,
14limit, or supersede the operation of any other Illinois law or
15prevent a party from otherwise seeking relief under the Code of
16Civil Procedure.
17    (b) Any waiver of the provisions of this Act is void and
18unenforceable. Any agreement created or modified after the
19effective date of this Act that does not comply with this Act
20is void and unenforceable.
 
21    Section 25. Applicability. This Act does not apply to:
22        (1) a health care provider or other covered entity that
23    is subject to the Federal Health Insurance Portability and

 

 

HB5497- 5 -LRB101 17462 JLS 66872 b

1    Accountability Act of 1996 and the rules promulgated
2    thereunder and that is disclosing geolocation information
3    in accordance with that Act;
4        (2) a financial institution or an affiliate of a
5    financial institution that is subject to Title V of the
6    federal Gramm-Leach-Bliley Act and the rules promulgated
7    thereunder and that is disclosing geolocation information
8    in accordance with that Act; or
9        (3) entities regulated under the Transportation
10    Network Providers Act or any of their subsidiaries that
11    own, operate, or control a location-based application, the
12    sole function of which is to provide transportation
13    services based on geolocation information, to the extent
14    that these entities or their subsidiaries disclose the
15    geolocation information for the sole purpose of providing a
16    service requested by the individual or the use is otherwise
17    consistent with that individual's reasonable expectations
18    considering the context in which the individual provided
19    the geolocation information to these entities.