101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
SB3299

 

Introduced 2/11/2020, by Sen. Laura Fine

 

SYNOPSIS AS INTRODUCED:
 
See Index

    Creates the Consumer Privacy Act. Provides that a consumer has the right to request that a business that collects the consumer's personal information disclose to that consumer the categories and specific pieces of personal information the business has collected. Requires a business to, at or before the point of collection, inform a consumer as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. Requires the business to provide notice when collecting additional categories of personal information or when using a consumer's personal information for additional purposes. Provides that a consumer has the right to request that a business delete any personal information about the consumer that the business has collected from the consumer, with some exceptions. Requires a business that collects or sells a consumer's personal information to make certain disclosures to the consumer upon receipt of a verifiable consumer request. Provides that a consumer has the right, at any time, to opt out of the sale of his or her personal information to third parties. Prohibits a business from discriminating against a consumer who exercises any of the rights established under the Act by denying goods or services or charging the consumer different prices or rates for goods or services. Permits a business to provide financial incentives to a consumer that authorizes the sale of his or her personal information. Contains provisions concerning deadlines for processing a consumer's disclosure request; categories of personal information that must be disclosed; notice requirements; consumer information that is not subject to the Act's requirements; civil penalties for violations of the Act; and other matters. Amends the State Finance Act. Creates the Consumer Privacy Fund. Effective January 1, 2021.


LRB101 16653 JLS 70232 b

FISCAL NOTE ACT MAY APPLY

 

 

A BILL FOR

 

SB3299LRB101 16653 JLS 70232 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 1. Short title. This Act may be cited as the
5Consumer Privacy Act.
 
6    Section 5. Definitions. As used in this Act:
7    (a) "Aggregate consumer information" means information
8that relates to a group or category of consumers, from which
9individual consumer identities have been removed, that is not
10linked or reasonably linkable to any consumer or household,
11including via a device. "Aggregate consumer information" does
12not mean one or more individual consumer records that have been
13deidentified.
14    (b) "Biometric information" means an individual's
15physiological, biological, or behavioral characteristics that
16can be used, singly or in combination with each other or with
17other identifying data, to establish individual identity.
18"Biometric information" includes, but is not limited to,
19imagery of the iris, retina, fingerprint, face, hand, palm,
20vein patterns, and voice recordings, from which an identifier
21template, such as a faceprint, a minutiae template, or a
22voiceprint, can be extracted, and keystroke patterns or
23rhythms, gait patterns or rhythms, and sleep, health, or

 

 

SB3299- 2 -LRB101 16653 JLS 70232 b

1exercise data that contain identifying information.
2    (c) "Business" means:
3        (1) A sole proprietorship, partnership, limited
4    liability company, corporation, association, or other
5    legal entity that is organized or operated for the profit
6    or financial benefit of its shareholders or other owners,
7    that collects consumers' personal information, or on
8    behalf of which such information is collected and that
9    alone, or jointly with others, determines the purposes and
10    means of the processing of consumers' personal
11    information, that does business in this State, and that
12    satisfies one or more of the following thresholds:
13            (A) Has annual gross revenues in excess of
14        $25,000,000, as adjusted in accordance with paragraph
15        (5) of subsection (a) of Section 75.
16            (B) Alone or in combination, annually buys,
17        receives for the business's commercial purposes,
18        sells, or shares for commercial purposes, alone or in
19        combination, the personal information of 50,000 or
20        more consumers, households, or devices.
21            (C) Derives 50% or more of its annual revenues from
22        selling consumers' personal information.
23        (2) Any entity that controls or is controlled by a
24    business, as defined in paragraph (1), and that shares
25    common branding with the business. "Control" or
26    "controlled" means ownership of, or the power to vote, more

 

 

SB3299- 3 -LRB101 16653 JLS 70232 b

1    than 50% of the outstanding shares of any class of voting
2    security of a business; control in any manner over the
3    election of a majority of the directors, or of individuals
4    exercising similar functions; or the power to exercise a
5    controlling influence over the management of a company.
6    "Common branding" means a shared name, servicemark, or
7    trademark.
8    (d) "Business purpose" means the use of personal
9information for the business's or a service provider's
10operational purposes, or other notified purposes, provided
11that the use of personal information is reasonably necessary
12and proportionate to achieve the operational purpose for which
13the personal information was collected or processed or for
14another operational purpose that is compatible with the context
15in which the personal information was collected. Business
16purposes are:
17        (1) Auditing related to a current interaction with the
18    consumer and concurrent transactions, including, but not
19    limited to, counting ad impressions to unique visitors,
20    verifying positioning and quality of ad impressions, and
21    auditing compliance with this specification and other
22    standards.
23        (2) Detecting security incidents, protecting against
24    malicious, deceptive, fraudulent, or illegal activity, and
25    prosecuting those responsible for that activity.
26        (3) Debugging to identify and repair errors that impair

 

 

SB3299- 4 -LRB101 16653 JLS 70232 b

1    existing intended functionality.
2        (4) Short-term, transient use, provided that the
3    personal information is not disclosed to another third
4    party and is not used to build a profile about a consumer
5    or otherwise alter an individual consumer's experience
6    outside the current interaction, including, but not
7    limited to, the contextual customization of ads shown as
8    part of the same interaction.
9        (5) Performing services on behalf of the business or
10    service provider, including maintaining or servicing
11    accounts, providing customer service, processing or
12    fulfilling orders and transactions, verifying customer
13    information, processing payments, providing financing,
14    providing advertising or marketing services, providing
15    analytic services, or providing similar services on behalf
16    of the business or service provider.
17        (6) Undertaking internal research for technological
18    development and demonstration.
19        (7) Undertaking activities to verify or maintain the
20    quality or safety of a service or device that is owned,
21    manufactured, or controlled by the business, and to
22    improve, upgrade, or enhance the service or device that is
23    owned, manufactured, manufactured for, or controlled by
24    the business.
25    (e) "Collects", "collected", or "collection" means buying,
26renting, gathering, obtaining, receiving, or accessing any

 

 

SB3299- 5 -LRB101 16653 JLS 70232 b

1personal information pertaining to a consumer by any means.
2This includes receiving information from the consumer, either
3actively or passively, or by observing the consumer's behavior.
4    (f) "Commercial purposes" means to advance a person's
5commercial or economic interests, such as by inducing another
6person to buy, rent, lease, join, subscribe to, provide, or
7exchange products, goods, property, information, or services,
8or enabling or effecting, directly or indirectly, a commercial
9transaction. "Commercial purposes" do not include for the
10purpose of engaging in speech that State or federal courts have
11recognized as noncommercial speech, including political speech
12and journalism.
13    (g) "Consumer" means a natural person who is an Illinois
14resident, as defined in Section 5 of the Hospital Uninsured
15Patient Discount Act, however identified, including by any
16unique identifier.
17    (h) "Deidentified" means information that cannot
18reasonably identify, relate to, describe, be capable of being
19associated with, or be linked, directly or indirectly, to a
20particular consumer, provided that a business that uses
21deidentified information:
22        (1) Has implemented technical safeguards that prohibit
23    reidentification of the consumer to whom the information
24    may pertain.
25        (2) Has implemented business processes that
26    specifically prohibit reidentification of the information.

 

 

SB3299- 6 -LRB101 16653 JLS 70232 b

1        (3) Has implemented business processes to prevent
2    inadvertent release of deidentified information.
3        (4) Makes no attempt to reidentify the information.
4    (i) "Designated methods for submitting requests" means a
5mailing address, email address, Internet web page, Internet web
6portal, toll-free telephone number, or other applicable
7contact information whereby consumers may submit a request or
8direction under this Act, and any new, consumer-friendly means
9of contacting a business, as approved by the Attorney General
10under Section 75.
11    (j) "Device" means any physical object that is capable of
12connecting to the Internet, directly or indirectly, or to
13another device.
14    (k) "Homepage" means the introductory page of a website and
15any Internet web page where personal information is collected.
16In the case of an online service, such as a mobile application,
17"homepage" means the application's platform page or download
18page, a link within the application, such as from the
19application configuration, "About", "Information", or settings
20page, and any other location that allows consumers to review
21the notice required by subsection (a) of Section 50, including,
22but not limited to, before downloading the application.
23    (l) "Infer" or "inference" means the derivation of
24information, data, assumptions, or conclusions from facts,
25evidence, or another source of information or data.
26    (m) "Person" means an individual, proprietorship, firm,

 

 

SB3299- 7 -LRB101 16653 JLS 70232 b

1partnership, joint venture, syndicate, business trust,
2company, corporation, limited liability company, association,
3committee, and any other organization or group of persons
4acting in concert.
5    (n)(1) "Personal information" means information that
6identifies, relates to, describes, is capable of being
7associated with, or could reasonably be linked, directly or
8indirectly, with a particular consumer or household. "Personal
9information" includes, but is not limited to, the following if
10it identifies, relates to, describes, is capable of being
11associated with, or could be reasonably linked, directly or
12indirectly, with a particular consumer or household:
13        (A) Identifiers such as a real name, alias, postal
14    address, unique personal identifier, online identifier,
15    Internet Protocol address, email address, account name,
16    social security number, driver's license number, passport
17    number, or other similar identifiers.
18        (B) Any personal information that identifies, relates
19    to, describes, or is capable of being associated with, a
20    particular individual, including, but not limited to, his
21    or her name, signature, social security number, physical
22    characteristics or description, address, telephone number,
23    passport number, driver's license or State identification
24    card number, insurance policy number, education,
25    employment, employment history, bank account number,
26    credit card number, debit card number, or any other

 

 

SB3299- 8 -LRB101 16653 JLS 70232 b

1    financial information, medical information, or health
2    insurance information. "Personal information" does not
3    include publicly available information that is lawfully
4    made available to the general public from federal, State,
5    or local government records.
6        (C) Characteristics of protected classifications under
7    State or federal law.
8        (D) Commercial information, including records of
9    personal property, products or services purchased,
10    obtained, or considered, or other purchasing or consuming
11    histories or tendencies.
12        (E) Biometric information.
13        (F) Internet or other electronic network activity
14    information, including, but not limited to, browsing
15    history, search history, and information regarding a
16    consumer's interaction with an Internet website,
17    application, or advertisement.
18        (G) Geolocation data.
19        (H) Audio, electronic, visual, thermal, olfactory, or
20    similar information.
21        (I) Professional or employment-related information.
22        (J) Education information, defined as information that
23    is not publicly available personally identifiable
24    information as defined in the Family Educational Rights and
25    Privacy Act (20 U.S.C. 1232g; 34 CFR Part 99).
26        (K) Inferences drawn from any of the information

 

 

SB3299- 9 -LRB101 16653 JLS 70232 b

1    identified in this subsection to create a profile about a
2    consumer reflecting the consumer's preferences,
3    characteristics, psychological trends, predispositions,
4    behavior, attitudes, intelligence, abilities, and
5    aptitudes.
6    (2) "Personal information" does not include publicly
7available information. For purposes of this subsection,
8"publicly available" means information that is lawfully made
9available from federal, State, or local government records.
10"Publicly available" does not mean biometric information
11collected by a business about a consumer without the consumer's
12knowledge. Information is not publicly available if that data
13is used for a purpose that is not compatible with the purpose
14for which the data is maintained and made available in the
15government records or for which it is publicly maintained.
16"Personal information" does not include consumer information
17that is deidentified or aggregate consumer information.
18    (o) "Probabilistic identifier" means the identification of
19a consumer or a device to a degree of certainty of more
20probable than not based on any categories of personal
21information included in, or similar to, the categories
22enumerated in the definition of personal information.
23    (p) "Processing" means any operation or set of operations
24that are performed on personal data or on sets of personal
25data, whether or not by automated means.
26    (q) "Pseudonymize" or "pseudonymization" means the

 

 

SB3299- 10 -LRB101 16653 JLS 70232 b

1processing of personal information in a manner that renders the
2personal information no longer attributable to a specific
3consumer without the use of additional information, provided
4that the additional information is kept separately and is
5subject to technical and organizational measures to ensure that
6the personal information is not attributed to an identified or
7identifiable consumer.
8    (r) "Research" means scientific, systematic study and
9observation, including basic research or applied research that
10is in the public interest and that adheres to all other
11applicable ethics and privacy laws or studies conducted in the
12public interest in the area of public health. Research with
13personal information that may have been collected from a
14consumer in the course of the consumer's interactions with a
15business's service or device for other purposes:
16        (1) Shall be compatible with the business purpose for
17    which the personal information was collected.
18        (2) Shall be subsequently pseudonymized and
19    deidentified, or deidentified and in the aggregate, such
20    that the information cannot reasonably identify, relate
21    to, describe, be capable of being associated with, or be
22    linked, directly or indirectly, to a particular consumer.
23        (3) Shall be made subject to technical safeguards that
24    prohibit reidentification of the consumer to whom the
25    information may pertain.
26        (4) Shall be subject to business processes that

 

 

SB3299- 11 -LRB101 16653 JLS 70232 b

1    specifically prohibit reidentification of the information.
2        (5) Shall be made subject to business processes to
3    prevent inadvertent release of deidentified information.
4        (6) Shall be protected from any reidentification
5    attempts.
6        (7) Shall be used solely for research purposes that are
7    compatible with the context in which the personal
8    information was collected.
9        (8) Shall not be used for any commercial purpose.
10        (9) Shall be subjected by the business conducting the
11    research to additional security controls that limit access
12    to the research data to only those individuals in a
13    business as are necessary to carry out the research
14    purpose.
15    (s)(1) "Sell", "selling", "sale", or "sold" means selling,
16renting, releasing, disclosing, disseminating, making
17available, transferring, or otherwise communicating orally, in
18writing, or by electronic or other means, a consumer's personal
19information by the business to another business or a third
20party for monetary or other valuable consideration.
21    (2) For purposes of this Act, a business does not sell
22personal information when:
23        (A) A consumer uses or directs the business to
24    intentionally disclose personal information or uses the
25    business to intentionally interact with a third party,
26    provided the third party does not also sell the personal

 

 

SB3299- 12 -LRB101 16653 JLS 70232 b

1    information, unless that disclosure would be consistent
2    with the provisions of this Act. An intentional interaction
3    occurs when the consumer intends to interact with the third
4    party, via one or more deliberate interactions. Hovering
5    over, muting, pausing, or closing a given piece of content
6    does not constitute a consumer's intent to interact with a
7    third party.
8        (B) The business uses or shares an identifier for a
9    consumer who has opted out of the sale of the consumer's
10    personal information for the purposes of alerting third
11    parties that the consumer has opted out of the sale of the
12    consumer's personal information.
13        (C) The business uses or shares with a service provider
14    personal information of a consumer that is necessary to
15    perform a business purpose if both of the following
16    conditions are met:
17            (i) The business has provided notice of that
18        information being used or shared in its terms and
19        conditions consistent with Section 45.
20            (ii) The service provider does not further
21        collect, sell, or use the personal information of the
22        consumer except as necessary to perform the business
23        purpose.
24        (D) The business transfers to a third party the
25    personal information of a consumer as an asset that is part
26    of a merger, acquisition, bankruptcy, or other transaction

 

 

SB3299- 13 -LRB101 16653 JLS 70232 b

1    in which the third party assumes control of all or part of
2    the business, provided that information is used or shared
3    consistently with Sections 20 and 25. If a third party
4    materially alters how it uses or shares the personal
5    information of a consumer in a manner that is materially
6    inconsistent with the promises made at the time of
7    collection, it shall provide prior notice of the new or
8    changed practice to the consumer. The notice shall be
9    sufficiently prominent and robust to ensure that existing
10    consumers can easily exercise their choices consistently
11    with Section 30. This subparagraph does not authorize a
12    business to make material, retroactive privacy policy
13    changes or make other changes in their privacy policy in a
14    manner that would violate the Uniform Deceptive Trade
15    Practices Act.
16    (t) "Service" or "services" means work, labor, and
17services, including services furnished in connection with the
18sale or repair of goods.
19    (u) "Service provider" means a sole proprietorship,
20partnership, limited liability company, corporation,
21association, or other legal entity that is organized or
22operated for the profit or financial benefit of its
23shareholders or other owners, that processes information on
24behalf of a business and to which the business discloses a
25consumer's personal information for a business purpose in
26accordance with a written contract, provided that the contract

 

 

SB3299- 14 -LRB101 16653 JLS 70232 b

1prohibits the entity receiving the information from retaining,
2using, or disclosing the personal information for any purpose
3other than for the specific purpose of performing the services
4specified in the contract for the business, or as otherwise
5permitted by this Act, including retaining, using, or
6disclosing the personal information for a commercial purpose
7other than providing the services specified in the contract
8with the business.
9    (v) "Third party" means a person who is not any of the
10following:
11        (1) The business that collects personal information
12    from consumers under this Act.
13        (2)(A) A person to whom the business discloses a
14    consumer's personal information for a business purpose in
15    accordance with a written contract, provided that the
16    contract:
17            (i) Prohibits the person receiving the personal
18        information from:
19                (I) Selling the personal information.
20                (II) Retaining, using, or disclosing the
21            personal information for any purpose other than
22            for the specific purpose of performing the
23            services specified in the contract, including
24            retaining, using, or disclosing the personal
25            information for a commercial purpose other than
26            providing the services specified in the contract.

 

 

SB3299- 15 -LRB101 16653 JLS 70232 b

1                (III) Retaining, using, or disclosing the
2            information outside of the direct business
3            relationship between the person and the business.
4            (ii) Includes a certification made by the person
5        receiving the personal information that the person
6        understands the restrictions in subparagraph (A) and
7        will comply with them.
8        (B) A person covered by this paragraph who violates any
9    of the restrictions set forth in this Act shall be liable
10    for the violations. A business that discloses personal
11    information to a person covered by this paragraph in
12    compliance with this paragraph shall not be liable under
13    this Act if the person receiving the personal information
14    uses it in violation of the restrictions set forth in this
15    Act, provided that, at the time of disclosing the personal
16    information, the business does not have actual knowledge,
17    or reason to believe, that the person intends to commit
18    such a violation.
19    (w) "Unique identifier" or "unique personal identifier"
20means a persistent identifier that can be used to recognize a
21consumer, a family, or a device that is linked to a consumer or
22family, over time and across different services, including, but
23not limited to, a device identifier; an Internet Protocol
24address; cookies, beacons, pixel tags, mobile ad identifiers,
25or similar technology; customer number, unique pseudonym, or
26user alias; telephone numbers, or other forms of persistent or

 

 

SB3299- 16 -LRB101 16653 JLS 70232 b

1probabilistic identifiers that can be used to identify a
2particular consumer or device. As used in this subsection,
3"family" means a custodial parent or guardian and any minor
4children over which the parent or guardian has custody.
5    (x) "Verifiable consumer request" means a request that is
6made by a consumer, by a consumer on behalf of the consumer's
7minor child, or by a natural person or a person registered with
8the Secretary of State, authorized by the consumer to act on
9the consumer's behalf, and that the business can reasonably
10verify, in accordance with rules adopted by the Attorney
11General under paragraph (7) of subsection (a) of Section 75 to
12be the consumer about whom the business has collected personal
13information. A business is not obligated to provide information
14to the consumer in accordance with Sections 20 and 25 if the
15business cannot verify, in accordance with this subsection and
16rules adopted by the Attorney General under paragraph (7) of
17subsection (a) of Section 75, that the consumer making the
18request is the consumer about whom the business has collected
19information or is a person authorized by the consumer to act on
20such consumer's behalf.
 
21    Section 10. Personal information; business collection and
22disclosure.
23    (a) A consumer has the right to request that a business
24that collects the consumer's personal information disclose to
25that consumer the categories and specific pieces of personal

 

 

SB3299- 17 -LRB101 16653 JLS 70232 b

1information the business has collected.
2    (b) A business that collects a consumer's personal
3information shall, at or before the point of collection, inform
4the consumer as to the categories of personal information to be
5collected and the purposes for which the categories of personal
6information shall be used. A business shall not collect
7additional categories of personal information or use personal
8information collected for additional purposes without
9providing the consumer with notice consistent with this
10Section.
11    (c) A business shall provide the information specified in
12subsection (a) to a consumer only upon receipt of a verifiable
13consumer request.
14    (d) A business that receives a verifiable consumer request
15from a consumer to access personal information shall promptly
16take steps to disclose and deliver, free of charge to the
17consumer, the personal information required by this Section.
18The information may be delivered by mail or electronically, and
19if provided electronically, the information shall be in a
20portable and, to the extent technically feasible, in a readily
21usable format that allows the consumer to transmit this
22information to another entity without hindrance. A business may
23provide personal information to a consumer at any time, but
24shall not be required to provide personal information to a
25consumer more than twice in a 12-month period.
26    (e) This Section does not require a business to retain any

 

 

SB3299- 18 -LRB101 16653 JLS 70232 b

1personal information collected for a single, one-time
2transaction, if such information is not sold or retained by the
3business or to reidentify or otherwise link information that is
4not maintained in a manner that would be considered personal
5information.
 
6    Section 15. Consumer request to delete personal
7information.
8    (a) A consumer has the right to request that a business
9delete any personal information about the consumer which the
10business has collected from the consumer.
11    (b) A business that collects personal information about
12consumers shall disclose, in accordance with Section 40, the
13consumer's rights to request the deletion of the consumer's
14personal information.
15    (c) A business that receives a verifiable consumer request
16from a consumer to delete the consumer's personal information
17in accordance with subsection (a) shall delete the consumer's
18personal information from its records and direct any service
19providers to delete the consumer's personal information from
20their records.
21    (d) A business or a service provider shall not be required
22to comply with a consumer's request to delete the consumer's
23personal information if it is necessary for the business or
24service provider to maintain the consumer's personal
25information in order to:

 

 

SB3299- 19 -LRB101 16653 JLS 70232 b

1        (1) Complete the transaction for which the personal
2    information was collected; provide a good or service
3    requested by the consumer; or perform actions that are
4    reasonably anticipated within the context of a business's
5    ongoing business relationship with the consumer; or
6    otherwise perform a contract between the business and the
7    consumer.
8        (2) Detect security incidents; protect against
9    malicious, deceptive, fraudulent, or illegal activity; or
10    prosecute those responsible for that activity.
11        (3) Debug to identify and repair errors that impair
12    existing intended functionality.
13        (4) Exercise free speech, ensure the right of another
14    consumer to exercise his or her right of free speech, or
15    exercise another right provided for by law.
16        (5) Engage in public or peer-reviewed scientific,
17    historical, or statistical research in the public interest
18    that adheres to all other applicable ethics and privacy
19    laws, when the businesses' deletion of the information is
20    likely to render impossible or seriously impair the
21    achievement of such research, if the consumer has provided
22    informed consent.
23        (6) Enable solely internal uses that are reasonably
24    aligned with the expectations of the consumer based on the
25    consumer's relationship with the business.
26        (7) Comply with a legal obligation.

 

 

SB3299- 20 -LRB101 16653 JLS 70232 b

1        (8) Otherwise use the consumer's personal information,
2    internally, in a lawful manner that is compatible with the
3    context in which the consumer provided the information.
 
4    Section 20. Consumer request to disclose categories of
5information collected.
6    (a) A consumer has the right to request that a business
7that collects personal information about the consumer disclose
8to the consumer the following:
9        (1) The categories of personal information it has
10    collected about that consumer.
11        (2) The categories of sources from which the personal
12    information is collected.
13        (3) The business or commercial purpose for collecting
14    or selling personal information.
15        (4) The categories of third parties with whom the
16    business shares personal information.
17        (5) The specific pieces of personal information it has
18    collected about that consumer.
19    (b) A business that collects personal information about a
20consumer shall disclose to the consumer, in accordance with
21paragraph (3) of subsection (a) of Section 40, the information
22specified in subsection (a) upon receipt of a verifiable
23consumer request from the consumer.
24    (c) A business that collects personal information about
25consumers shall disclose, in accordance with subparagraph (B)

 

 

SB3299- 21 -LRB101 16653 JLS 70232 b

1of paragraph (5) of subsection (a) of Section 40:
2        (1) The categories of personal information it has
3    collected about that consumer.
4        (2) The categories of sources from which the personal
5    information is collected.
6        (3) The business or commercial purpose for collecting
7    or selling personal information.
8        (4) The categories of third parties with whom the
9    business shares personal information.
 
10    Section 25. Consumer request to disclose categories of
11information sold.
12    (a) A consumer has the right to request that a business
13that sells the consumer's personal information, or that
14discloses it for a business purpose, disclose to that consumer:
15        (1) The categories of personal information that the
16    business collected about the consumer.
17        (2) The categories of personal information that the
18    business sold about the consumer and the categories of
19    third parties to whom the personal information was sold, by
20    category or categories of personal information for each
21    third party to whom the personal information was sold.
22        (3) The categories of personal information that the
23    business disclosed about the consumer for a business
24    purpose.
25    (b) A business that sells personal information about a

 

 

SB3299- 22 -LRB101 16653 JLS 70232 b

1consumer, or that discloses a consumer's personal information
2for a business purpose, shall disclose, in accordance with
3paragraph (4) of subsection (a) of Section 40, the information
4specified in subsection (a) to the consumer upon receipt of a
5verifiable consumer request from the consumer.
6    (c) A business that sells consumers' personal information,
7or that discloses consumers' personal information for a
8business purpose, shall disclose, in accordance with
9subparagraph (C) of paragraph (5) of subsection (a) of Section
1040:
11        (1) The category or categories of personal information
12    it has sold, or if the business has not sold consumers'
13    personal information, it shall disclose that fact.
14        (2) The category or categories of personal information
15    it has disclosed for a business purpose, or if the business
16    has not disclosed consumers' personal information for a
17    business purpose, it shall disclose that fact.
18    (d) A third party shall not sell personal information about
19a consumer that has been sold to the third party by a business
20unless the consumer has received explicit notice and is
21provided an opportunity to exercise the right to opt out under
22Section 30.
 
23    Section 30. Right to opt out.
24    (a) A consumer has the right, at any time, to direct a
25business that sells personal information about the consumer to

 

 

SB3299- 23 -LRB101 16653 JLS 70232 b

1third parties not to sell the consumer's personal information.
2This right may be referred to as the right to opt out.
3    (b) A business that sells consumers' personal information
4to third parties shall provide notice to consumers, in
5accordance with subsection (a) of Section 45, that this
6information may be sold and that consumers have the right to
7opt out of the sale of their personal information.
8    (c) Notwithstanding subsection (a), a business shall not
9sell the personal information of consumers if the business has
10actual knowledge that the consumer is less than 16 years of
11age, unless the consumer, in the case of consumers who are at
12least 13 years of age and not yet 16 years old, or the
13consumer's parent or guardian, in the case of consumers who are
14less than 13 years of age, has affirmatively authorized the
15sale of the consumer's personal information. A business that
16willfully disregards the consumer's age shall be deemed to have
17had actual knowledge of the consumer's age. This right may be
18referred to as the right to opt in.
19    (d) A business that has received direction from a consumer
20not to sell the consumer's personal information, or in the case
21of a minor consumer's personal information has not received
22consent to sell the minor consumer's personal information,
23shall be prohibited, in accordance with paragraph (4) of
24subsection (a) of Section 45, from selling the consumer's
25personal information after its receipt of the consumer's
26direction, unless the consumer subsequently provides express

 

 

SB3299- 24 -LRB101 16653 JLS 70232 b

1authorization for the sale of the consumer's personal
2information.
 
3    Section 35. Prohibited practices.
4    (a)(1) A business shall not discriminate against a consumer
5because the consumer exercised any of the consumer's rights
6under this Act, including, but not limited to, by:
7        (A) Denying goods or services to the consumer.
8        (B) Charging different prices or rates for goods or
9    services, including through the use of discounts or other
10    benefits or imposing penalties.
11        (C) Providing a different level or quality of goods or
12    services to the consumer.
13        (D) Suggesting that the consumer will receive a
14    different price or rate for goods or services or a
15    different level or quality of goods or services.
16    (2) Nothing in this subsection prohibits a business from
17charging a consumer a different price or rate, or from
18providing a different level or quality of goods or services to
19the consumer, if that difference is reasonably related to the
20value provided to the consumer by the consumer's data.
21    (b)(1) A business may offer financial incentives,
22including payments to consumers as compensation, for the
23collection of personal information, the sale of personal
24information, or the deletion of personal information. A
25business may also offer a different price, rate, level, or

 

 

SB3299- 25 -LRB101 16653 JLS 70232 b

1quality of goods or services to the consumer if that price or
2difference is directly related to the value provided to the
3business by the consumer's data.
4    (2) A business that offers any financial incentives in
5accordance with this subsection, shall notify consumers of the
6financial incentives as provided under Section 45.
7    (3) A business may enter a consumer into a financial
8incentive program only if the consumer gives the business prior
9opt-in consent in accordance with Section 45 which clearly
10describes the material terms of the financial incentive program
11and which may be revoked by the consumer at any time.
12    (4) A business shall not use financial incentive practices
13that are unjust, unreasonable, coercive, or usurious in nature.
 
14    Section 40. Processing disclosure requests; deadlines.
15    (a) In order to comply with Sections 10, 15, 20, 25, and
1635, a business shall, in a form that is reasonably accessible
17to consumers:
18        (1) Make available to consumers 2 or more designated
19    methods for submitting requests for information required
20    to be disclosed under Sections 20 and 25, including, at a
21    minimum, a toll-free telephone number, and if the business
22    maintains a website, a website address.
23        (2) Disclose and deliver the required information to a
24    consumer free of charge within 45 days of receiving a
25    verifiable consumer request from the consumer. The

 

 

SB3299- 26 -LRB101 16653 JLS 70232 b

1    business shall promptly take steps to determine whether the
2    request is a verifiable consumer request, but this shall
3    not extend the business's duty to disclose and deliver the
4    information within 45 days of receipt of the consumer's
5    request. The time period to provide the required
6    information may be extended once by an additional 45 days
7    when reasonably necessary, provided the consumer is
8    provided notice of the extension within the first 45-day
9    period. The disclosure shall cover the 12-month period
10    preceding the business's receipt of the verifiable
11    consumer request and shall be made in writing and delivered
12    through the consumer's account with the business, if the
13    consumer maintains an account with the business, or by mail
14    or electronically at the consumer's option if the consumer
15    does not maintain an account with the business, in a
16    readily usable format that allows the consumer to transmit
17    this information from one entity to another entity without
18    hindrance. The business shall not require the consumer to
19    create an account with the business in order to make a
20    verifiable consumer request.
21        (3) For purposes of subsection (b) of Section 20:
22            (A) To identify the consumer, associate the
23        information provided by the consumer in the verifiable
24        consumer request to any personal information
25        previously collected by the business about the
26        consumer.

 

 

SB3299- 27 -LRB101 16653 JLS 70232 b

1            (B) Identify by category or categories the
2        personal information collected about the consumer in
3        the preceding 12 months by reference to the enumerated
4        category or categories in subsection (c) that most
5        closely describes the personal information collected.
6        (4) For purposes of subsection (b) of Section 25:
7            (A) Identify the consumer and associate the
8        information provided by the consumer in the verifiable
9        consumer request to any personal information
10        previously collected by the business about the
11        consumer.
12            (B) Identify by category or categories the
13        personal information of the consumer that the business
14        sold in the preceding 12 months by reference to the
15        enumerated category in subsection (c) that most
16        closely describes the personal information, and
17        provide the categories of third parties to whom the
18        consumer's personal information was sold in the
19        preceding 12 months by reference to the enumerated
20        category or categories in subsection (c) that most
21        closely describes the personal information sold. The
22        business shall disclose the information in a list that
23        is separate from a list generated for the purposes of
24        subparagraph (C).
25            (C) Identify by category or categories the
26        personal information of the consumer that the business

 

 

SB3299- 28 -LRB101 16653 JLS 70232 b

1        disclosed for a business purpose in the preceding 12
2        months by reference to the enumerated category or
3        categories in subsection (c) that most closely
4        describes the personal information, and provide the
5        categories of third parties to whom the consumer's
6        personal information was disclosed for a business
7        purpose in the preceding 12 months by reference to the
8        enumerated category or categories in subsection (c)
9        that most closely describes the personal information
10        disclosed. The business shall disclose the information
11        in a list that is separate from a list generated for
12        the purposes of subparagraph (B).
13        (5) Disclose the following information in its online
14    privacy policy or policies if the business has an online
15    privacy policy or policies and in any Illinois-specific
16    description of consumers' privacy rights, or if the
17    business does not maintain those policies, on its website,
18    and update that information at least once every 12 months:
19            (A) A description of a consumer's rights under
20        Sections 20, 25, and 35 and one or more designated
21        methods for submitting requests.
22            (B) For purposes of subsection (c) of Section 20, a
23        list of the categories of personal information it has
24        collected about consumers in the preceding 12 months by
25        reference to the enumerated category or categories in
26        subsection (c) that most closely describe the personal

 

 

SB3299- 29 -LRB101 16653 JLS 70232 b

1        information collected.
2            (C) For purposes of paragraphs (1) and (2) of
3        subsection (c) of Section 25, 2 separate lists:
4                (i) A list of the categories of personal
5            information it has sold about consumers in the
6            preceding 12 months by reference to the enumerated
7            category or categories in subsection (c) of this
8            Section that most closely describe the personal
9            information sold, or if the business has not sold
10            consumers' personal information in the preceding
11            12 months, the business shall disclose that fact.
12                (ii) A list of the categories of personal
13            information it has disclosed about consumers for a
14            business purpose in the preceding 12 months by
15            reference to the enumerated category or categories
16            in subsection (c) that most closely describe the
17            personal information disclosed, or if the business
18            has not disclosed consumers' personal information
19            for a business purpose in the preceding 12 months,
20            the business shall disclose that fact.
21        (6) Ensure that all individuals responsible for
22    handling consumer inquiries about the business's privacy
23    practices or the business's compliance with this Act are
24    informed of all requirements under Sections 20, 25, and 35,
25    and the requirements under this Section, and how to direct
26    consumers to exercise their rights under Sections 20, 25,

 

 

SB3299- 30 -LRB101 16653 JLS 70232 b

1    and 35 and under this Section.
2        (7) Use any personal information collected from the
3    consumer in connection with the business's verification of
4    the consumer's request solely for the purposes of
5    verification.
6    (b) A business is not obligated to provide the information
7required under Sections 20 and 25 to the same consumer more
8than twice in a 12-month period.
9    (c) The categories of personal information required to be
10disclosed under Sections 20 and 25 shall follow the definition
11of personal information in Section 5.
 
12    Section 45. Informational web page.
13    (a) A business that is required to comply with Section 30
14shall, in a form that is reasonably accessible to consumers:
15        (1) Provide a clear and conspicuous link on the
16    business's Internet homepage, titled "Do Not Sell My
17    Personal Information", to an Internet web page that enables
18    a consumer, or a person authorized by the consumer, to opt
19    out of the sale of the consumer's personal information. A
20    business shall not require a consumer to create an account
21    in order to direct the business not to sell the consumer's
22    personal information.
23        (2) Include a description of a consumer's rights in
24    accordance with Section 30, along with a separate link to
25    the "Do Not Sell My Personal Information" Internet web page

 

 

SB3299- 31 -LRB101 16653 JLS 70232 b

1    in:
2            (A) Its online privacy policy or policies if the
3        business has an online privacy policy or policies.
4            (B) Any Illinois-specific description of
5        consumers' privacy rights.
6        (3) Ensure that all individuals responsible for
7    handling consumer inquiries about the business's privacy
8    practices or the business's compliance with this Act are
9    informed of all requirements under Section 30 and this
10    Section and how to direct consumers to exercise their
11    rights under Section 30 and this Section.
12        (4) For consumers who exercise their right to opt out
13    of the sale of their personal information, refrain from
14    selling personal information collected by the business
15    about the consumer.
16        (5) For a consumer who has opted out of the sale of the
17    consumer's personal information, respect the consumer's
18    decision to opt out for at least 12 months before
19    requesting that the consumer authorize the sale of the
20    consumer's personal information.
21        (6) Use any personal information collected from the
22    consumer in connection with the submission of the
23    consumer's opt-out request solely for the purposes of
24    complying with the opt-out request.
25    (b) Nothing in this Act shall be construed to require a
26business to comply with this Act by including the required

 

 

SB3299- 32 -LRB101 16653 JLS 70232 b

1links and text on the homepage that the business makes
2available to the public generally, if the business maintains a
3separate and additional homepage that is dedicated to Illinois
4consumers and that includes the required links and text, and
5the business takes reasonable steps to ensure that Illinois
6consumers are directed to the homepage for Illinois consumers
7and not the homepage made available to the public generally.
8    (c) A consumer may authorize another person solely to opt
9out of the sale of the consumer's personal information on the
10consumer's behalf, and a business shall comply with an opt-out
11request received from a person authorized by the consumer to
12act on the consumer's behalf, in accordance with rules adopted
13by the Attorney General.
 
14    Section 50. Compliance with other laws or regulations.
15    (a) The obligations imposed on businesses by this Act shall
16not restrict a business's ability to:
17        (1) Comply with federal, State, or local laws.
18        (2) Comply with a civil, criminal, or regulatory
19    inquiry, investigation, subpoena, or summons by federal,
20    State, or local authorities.
21        (3) Cooperate with law enforcement agencies concerning
22    conduct or activity that the business, service provider, or
23    third party reasonably and in good faith believes may
24    violate federal, State, or local law.
25        (4) Exercise or defend legal claims.

 

 

SB3299- 33 -LRB101 16653 JLS 70232 b

1        (5) Collect, use, retain, sell, or disclose consumer
2    information that is deidentified or in the aggregate
3    consumer information.
4        (6) Collect or sell a consumer's personal information
5    if every aspect of that commercial conduct takes place
6    wholly outside of Illinois. For purposes of this Act,
7    commercial conduct takes place wholly outside of Illinois
8    if the business collected that information while the
9    consumer was outside of Illinois, no part of the sale of
10    the consumer's personal information occurred in Illinois,
11    and no personal information collected while the consumer
12    was in Illinois is sold.
13    (b) The obligations imposed on businesses by Sections 20
14through 45 shall not: (i) apply where compliance by the
15business with this Act would violate an evidentiary privilege
16under Illinois law; and (ii) prevent a business from providing
17the personal information of a consumer to a person covered by
18an evidentiary privilege under Illinois law as part of a
19privileged communication.
20    (c)(1) This Act does not apply to any of the following:
21        (A) Medical information protected from disclosure
22    under State confidentiality laws on patient health
23    information or protected health information that is
24    collected by a covered entity or business associate
25    governed by the privacy, security, and breach notification
26    rules issued by the United States Department of Health and

 

 

SB3299- 34 -LRB101 16653 JLS 70232 b

1    Human Services, Parts 160 and 164 of Title 45 of the Code
2    of Federal Regulations, established in accordance with the
3    Health Insurance Portability and Accountability Act of
4    1996 (Public Law 104-191) and the Health Information
5    Technology for Economic and Clinical Health Act (Public Law
6    111-5).
7        (B) A provider of health care governed by State
8    confidentiality laws on patient health information or a
9    covered entity governed by the privacy, security, and
10    breach notification rules issued by the United States
11    Department of Health and Human Services, Parts 160 and 164
12    of Title 45 of the Code of Federal Regulations, established
13    in accordance the Health Insurance Portability and
14    Accountability Act of 1996 (Public Law 104-191), to the
15    extent the provider or covered entity maintains personal
16    information in the same manner as medical information or
17    protected health information as described in subparagraph
18    (A).
19        (C) Information collected as part of a clinical trial
20    subject to the Federal Policy for the Protection of Human
21    Subjects, also known as the Common Rule, in accordance with
22    good clinical practice guidelines issued by the
23    International Council for Harmonisation of Technical
24    Requirements for Pharmaceuticals for Human Use or in
25    accordance with human subject protection requirements of
26    the United States Food and Drug Administration.

 

 

SB3299- 35 -LRB101 16653 JLS 70232 b

1    (2) As used in this Section:
2    "Medical information" means any individually identifiable
3information, in electronic or physical form, in possession of
4or derived from a provider of health care, health care service
5plan, pharmaceutical company, or contractor regarding a
6patient's medical history, mental or physical condition, or
7treatment. "Individually identifiable" means that the medical
8information includes or contains any element of personal
9identifying information sufficient to allow identification of
10the individual, such as the patient's name, address, electronic
11mail address, telephone number, or social security number, or
12other information that, alone or in combination with other
13publicly available information, reveals the individual's
14identity.
15    "Provider of health care" means any physician, hospital
16facility, facility licensed under the Nursing Home Care Act,
17long-term care facility as defined in Section 1-113 of the
18Nursing Home Care Act, or other person that is licensed or
19otherwise authorized to deliver health care services.
20    "Business associate", "covered entity", and "protected
21health information" have the meanings ascribed to those terms
22in Section 160.103 of Title 45 of the Code of Federal
23Regulations.
24    (d) This Act does not apply to the sale of personal
25information to or from a consumer reporting agency if that
26information is to be reported in, or used to generate, a

 

 

SB3299- 36 -LRB101 16653 JLS 70232 b

1consumer report as defined in subsection (d) of Section 1681a
2of Title 15 of the United States Code, and use of that
3information is limited by the federal Fair Credit Reporting Act
4(15 U.S.C. 1681 et seq.).
5    (e) This Act does not apply to personal information
6collected, processed, sold, or disclosed in accordance with the
7federal Gramm-Leach-Bliley Act, Public Law 106-102, and
8implementing regulations, or the Illinois Banking Act. This
9subsection does not apply to Section 55.
10    (f) This Act does not apply to personal information
11collected, processed, sold, or disclosed in accordance with the
12Driver's Privacy Protection Act of 1994 (18 U.S.C. 2721 et
13seq.). This subsection does not apply to Section 55.
14    (g) Notwithstanding a business's obligation to respond to
15and honor consumer rights requests in accordance with this Act:
16        (1) A time period for a business to respond to any
17    verified consumer request may be extended by up to 90
18    additional days where necessary, taking into account the
19    complexity and number of the requests. The business shall
20    inform the consumer of any such extension within 45 days of
21    receipt of the request, together with the reasons for the
22    delay.
23        (2) If the business does not take action on the request
24    of the consumer, the business shall inform the consumer,
25    without delay and at the latest within the time period
26    permitted of response by this Section, of the reasons for

 

 

SB3299- 37 -LRB101 16653 JLS 70232 b

1    not taking action and any rights the consumer may have to
2    appeal the decision to the business.
3        (3) If requests from a consumer are manifestly
4    unfounded or excessive, in particular because of their
5    repetitive character, a business may either charge a
6    reasonable fee, taking into account the administrative
7    costs of providing the information or communication or
8    taking the action requested, or refuse to act on the
9    request and notify the consumer of the reason for refusing
10    the request. The business shall bear the burden of
11    demonstrating that any verified consumer request is
12    manifestly unfounded or excessive.
13    (h) A business that discloses personal information to a
14service provider shall not be liable under this Act if the
15service provider receiving the personal information uses it in
16violation of the restrictions set forth in this Act, provided
17that, at the time of disclosing the personal information, the
18business does not have actual knowledge, or reason to believe,
19that the service provider intends to commit such a violation. A
20service provider shall likewise not be liable under this Act
21for the obligations of a business for which it provides
22services as set forth in this Act.
23    (i) This Act shall not be construed to require a business
24to reidentify or otherwise link information that is not
25maintained in a manner that would be considered personal
26information.

 

 

SB3299- 38 -LRB101 16653 JLS 70232 b

1    (j) The rights afforded to consumers and the obligations
2imposed on the business in this Act shall not adversely affect
3the rights and freedoms of other consumers.
 
4    Section 55. Civil actions.
5    (a)(1) Any consumer whose unencrypted or unredacted
6personal information, as defined in Section 5 of the Personal
7Information Protection Act, is subject to an unauthorized
8access and exfiltration, theft, or disclosure as a result of
9the business's violation of the duty to implement and maintain
10reasonable security procedures and practices appropriate to
11the nature of the information to protect the personal
12information may institute a civil action for any of the
13following:
14        (A) Recovery of damages in an amount not less than $100
15    and not greater than $750 per consumer per incident or
16    actual damages, whichever is greater.
17        (B) Injunctive or declaratory relief.
18        (C) Any other relief the court deems proper.
19    (2) In assessing the amount of statutory damages, the court
20shall consider any one or more of the relevant circumstances
21presented by any of the parties to the case, including, but not
22limited to, the nature and seriousness of the misconduct, the
23number of violations, the persistence of the misconduct, the
24length of time over which the misconduct occurred, the
25willfulness of the defendant's misconduct, and the defendant's

 

 

SB3299- 39 -LRB101 16653 JLS 70232 b

1assets, liabilities, and net worth.
2    (b) Actions under this Section may be brought by a consumer
3if, prior to initiating any action against a business for
4statutory damages on an individual or class-wide basis, a
5consumer provides a business 30 days' written notice
6identifying the specific provisions of this Act the consumer
7alleges have been or are being violated. If a cure is possible,
8if within the 30 days the business actually cures the noticed
9violation and provides the consumer an express written
10statement that the violations have been cured and that no
11further violations shall occur, no action for individual
12statutory damages or class-wide statutory damages may be
13initiated against the business. No notice shall be required
14prior to an individual consumer initiating an action solely for
15actual pecuniary damages suffered as a result of the alleged
16violations of this Act. If a business continues to violate this
17Act in breach of the express written statement provided to the
18consumer under this Section, the consumer may initiate an
19action against the business to enforce the written statement
20and may pursue statutory damages for each breach of the express
21written statement, as well as any other violation of the title
22that postdates the written statement.
23    (c) The cause of action established by this Section applies
24only to violations as defined in subsection (a) and shall not
25be based on violations of any other Section of this Act.
26Nothing in this Act shall be interpreted to serve as the basis

 

 

SB3299- 40 -LRB101 16653 JLS 70232 b

1for a private right of action under any other law. This shall
2not be construed to relieve any party from any duties or
3obligations imposed under other law or the United States or
4Illinois Constitution.
 
5    Section 60. Attorney General enforcement.
6    (a) Any business or third party may seek the opinion of the
7Attorney General for guidance on how to comply with the
8provisions of this Act.
9    (b) A business shall be in violation of this Act if it
10fails to cure any alleged violation within 30 days after being
11notified of alleged noncompliance. Any business, service
12provider, or other person that violates this Act shall be
13subject to an injunction and liable for a civil penalty of not
14more than $2,500 for each violation or $7,500 for each
15intentional violation, which shall be assessed and recovered in
16a civil action brought in the name of the people of the State
17of Illinois by the Attorney General. The civil penalties
18provided for in this Section shall be exclusively assessed and
19recovered in a civil action brought in the name of the people
20of the State of Illinois by the Attorney General.
21    (c) Any civil penalty assessed for a violation of this Act,
22and the proceeds of any settlement of an action brought under
23subsection (b), shall be deposited into the Consumer Privacy
24Fund, created under Section 65, with the intent to fully offset
25any costs incurred by the State courts and the Attorney General

 

 

SB3299- 41 -LRB101 16653 JLS 70232 b

1in connection with this Act.
 
2    Section 65. Consumer Privacy Fund.
3    (a) The Consumer Privacy Fund is created as a special fund
4in the State treasury. The Fund shall consist of any moneys
5deposited into the Fund as provided in subsection (c) of
6Section 60 and any moneys appropriated to the Attorney General
7for the purposes of this Section from the General Revenue Fund.
8    (b) Moneys in the Consumer Privacy Fund shall be used,
9subject to appropriation, to offset any costs incurred by the
10State courts in connection with actions brought to enforce this
11Act and any costs incurred by the Attorney General in carrying
12out the Attorney General's duties under this Act and for no
13other purpose. All interest earned on moneys in the Fund shall
14be deposited into the Fund.
 
15    Section 70. Conflict of laws. The provisions of this Act
16are not limited to information collected electronically or over
17the Internet, but apply to the collection and sale of all
18personal information collected by a business from consumers.
19Wherever possible, law relating to consumers' personal
20information should be construed to harmonize with the
21provisions of this Act, but in the event of a conflict between
22other laws and the provisions of this Act, the provisions of
23the law that afford the greatest privacy protection for
24consumers shall control.
 

 

 

SB3299- 42 -LRB101 16653 JLS 70232 b

1    Section 75. Attorney General; rules.
2    (a) On or before July 1, 2021, the Attorney General shall
3solicit broad public participation and adopt rules to further
4the purposes of this Act, including, but not limited to, the
5following areas:
6        (1) Updating as needed additional categories of
7    personal information to those enumerated in subsection (c)
8    of Section 40 and subsection (n) of Section 5 in order to
9    address changes in technology, data collection practices,
10    obstacles to implementation, and privacy concerns.
11        (2) Updating as needed the definition of unique
12    identifiers to address changes in technology, data
13    collection, obstacles to implementation, and privacy
14    concerns, and additional categories to the definition of
15    designated methods for submitting requests to facilitate a
16    consumer's ability to obtain information from a business in
17    accordance with Section 40.
18        (3) Establishing any exceptions necessary to comply
19    with State or federal law, including, but not limited to,
20    those relating to trade secrets and intellectual property
21    rights, within one year of the effective date of this Act
22    and as needed thereafter.
23        (4) Establishing rules and procedures for the
24    following:
25            (A) To facilitate and govern the submission of a

 

 

SB3299- 43 -LRB101 16653 JLS 70232 b

1        request by a consumer to opt out of the sale of
2        personal information under Section 30.
3            (B) To govern business compliance with a
4        consumer's opt-out request.
5            (C) For the development and use of a recognizable
6        and uniform opt-out logo or button by all businesses to
7        promote consumer awareness of the opportunity to opt
8        out of the sale of personal information.
9        (5) Adjusting the monetary threshold in subparagraph
10    (A) of paragraph (1) of subsection (c) of Section 5 in
11    January of every odd-numbered year to reflect any increase
12    in the Consumer Price Index.
13        (6) Establishing rules, procedures, and any exceptions
14    necessary to ensure that the notices and information that
15    businesses are required to provide in accordance with this
16    Act are provided in a manner that may be easily understood
17    by the average consumer, are accessible to consumers with
18    disabilities, and are available in the language primarily
19    used to interact with the consumer, including establishing
20    rules and guidelines regarding financial incentive
21    offerings, within one year after the effective date of this
22    Act and as needed thereafter.
23        (7) Establishing rules and procedures to further the
24    purposes of Sections 20 and 25 and to facilitate a
25    consumer's or the consumer's authorized agent's ability to
26    obtain information in accordance with Section 40, with the

 

 

SB3299- 44 -LRB101 16653 JLS 70232 b

1    goal of minimizing the administrative burden on consumers,
2    taking into account available technology, security
3    concerns, and the burden on the business, to govern a
4    business's determination that a request for information
5    received by a consumer is a verifiable consumer request,
6    including treating a request submitted through a
7    password-protected account maintained by the consumer with
8    the business while the consumer is logged into the account
9    as a verifiable consumer request and providing a mechanism
10    for a consumer who does not maintain an account with the
11    business to request information through the business's
12    authentication of the consumer's identity, within one year
13    after the effective date of this Act and as needed
14    thereafter.
15    (b) The Attorney General may adopt additional rules as
16necessary to further the purposes of this Act.
17    (c) The Attorney General shall not bring an enforcement
18action under this Act until 6 months after the publication of
19the final rules adopted in accordance with this Section or July
201, 2021, whichever is sooner.
 
21    Section 80. Component parts of a single transaction. If a
22series of steps or transactions were component parts of a
23single transaction intended from the beginning to be taken with
24the intention of avoiding the reach of this Act, including the
25disclosure of information by a business to a third party in

 

 

SB3299- 45 -LRB101 16653 JLS 70232 b

1order to avoid the definition of sell, a court shall disregard
2the intermediate steps or transactions for purposes of
3effectuating the purposes of this Act.
 
4    Section 85. Nonwaiver of Act. Any provision of a contract
5or agreement of any kind that purports to waive or limit in any
6way a consumer's rights under this Act, including, but not
7limited to, any right to a remedy or means of enforcement,
8shall be deemed contrary to public policy and shall be void and
9unenforceable. This Section shall not prevent a consumer from
10declining to request information from a business, declining to
11opt out of a business's sale of the consumer's personal
12information, or authorizing a business to sell the consumer's
13personal information after previously opting out.
 
14    Section 90. Construction. This Act shall be liberally
15construed to effectuate its purposes.
 
16    Section 95. Application. This Act is intended to supplement
17federal and State law, if permissible, but does not apply if
18such application is preempted by, or in conflict with, federal
19law or the United States or Illinois Constitution.
 
20    Section 900. The State Finance Act is amended by adding
21Section 5.930 as follows:
 

 

 

SB3299- 46 -LRB101 16653 JLS 70232 b

1    (30 ILCS 105/5.930 new)
2    Sec. 5.930. The Consumer Privacy Fund.
 
3    Section 999. Effective date. This Act takes effect January
41, 2021.

 

 

SB3299- 47 -LRB101 16653 JLS 70232 b

1 INDEX
2 Statutes amended in order of appearance
3    New Act
4    30 ILCS 105/5.930 new