HB4447 103RD GENERAL ASSEMBLY

LRB103 34729 SPS 64577 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB4447

Introduced 1/16/2024, by Rep. John M. Cabello

SYNOPSIS AS INTRODUCED:

815 ILCS 505/2EEEE new
815 ILCS 530/5
815 ILCS 530/55 new

Amends the Consumer Fraud and Deceptive Business Practices Act. Provides that it is an unlawful practice within the meaning of the Act for any person to solicit the purchase of an extended warranty through the mail. Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State shall: (1) register with the Secretary of State; (2) pay a registration fee of $100; and (3) provide specified information. Provides penalties for data brokers that fail to register with the Secretary of State. Provides that the Attorney General may maintain an action in circuit court to collect penalties and to seek injunctive relief. Defines "data broker" and "brokered personal information".

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2EEEE as follows:

(815 ILCS 505/2EEEE new)

Sec. 2EEEE. Motor vehicle extended warranty.

(a) As used in this Section, "extended warranty" means any contract or agreement indemnifying the service agreement holder for the motor vehicle listed on the service agreement and arising out of the ownership, operation, and use of the motor vehicle against loss caused by failure of any mechanical or other component part, or any mechanical or other component part that does not function as it was originally intended. "Extended warranty" does not include the usual performance guarantees by manufacturers or dealers in connection with the sale of motor vehicles.

(b) It is an unlawful practice within the meaning of this Act for any person to solicit the purchase of an extended warranty through the mail.

Section 10. The Personal Information Protection Act is amended by changing Section 5 and by adding Section 55 as follows:

(815 ILCS 530/5)

Sec. 5. Definitions. In this Act:

"Brokered personal information" means one or more of the following computerized data elements about an individual, if categorized or organized for dissemination to third parties:

(1) Name.

(2) Address.

(3) Date of birth.

(4) Place of birth.

(5) Mother's maiden name.

(6) Unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the individual, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data;

(7) name or address of a member of the individual's immediate family or household.

(8) Social Security number or other government-issued identification number.

(9) Other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the individual with reasonable certainty.

"Brokered personal information" does not include publicly available information to the extent that it is related to an individual's business or profession.

"Data broker" means a business or a unit of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of an individual with whom the business does not have a direct relationship. A direct relationship with a business includes if the individual is a past or present: (i) customer, client, subscriber, user, or registered user of the business's goods or services; (ii) employee, contractor, or agent of the business; (iii) investor in the business; or (iv) donor to the business.

"Data broker" does not include a business that conducts the following activities and the collection, sale, or licensing of brokered personal information incidental to conducting the activities:

(1) developing or maintaining third-party e-commerce or application platforms; or

(2) providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier;

"Data collector" may include, but is not limited to, government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information.

"Breach of the security of the system data" or "breach" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. "Breach of the security of the system data" does not include good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, provided that the personal information is not used for a purpose unrelated to the data collector's business or subject to further unauthorized disclosure.

"Health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any medical information in an individual's health insurance application and claims history, including any appeals records.

"Medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional, including such information provided to a website or mobile application.

"Personal information" means either of the following:

(1) An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the name or data elements have been acquired without authorization through the breach of security:

(A) Social Security number.

(B) Driver's license number or State identification card number.

(C) Account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account.

(D) Medical information.

(E) Health insurance information.

(F) Unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee to authenticate an individual, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data.

(G) Motor vehicle purchasing information.

(H) Home purchasing information.

(2) User name or email address, in combination with a password or security question and answer that would permit access to an online account, when either the user name or email address or password or security question and answer are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the data elements have been obtained through the breach of security.

"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

(Source: P.A. 99-503, eff. 1-1-17.)

(815 ILCS 530/55 new)

Sec. 55. Annual registration.

(a) Annually, on or before January 31, a data broker operating in this State shall:

(1) register with the Secretary of State;

(2) pay a registration fee of $100; and

(3) provide the following information:

(A) the name and primary physical, e-mail, and Internet addresses of the data broker;

(B) if the data broker permits an individual to opt out of the data broker's collection of brokered personal information, opt out of its databases, or opt out of certain sales of data:

(i) the method for requesting an opt-out;

(ii) which activities or sales the opt-out applies to; and

(iii) whether the data broker permits an individual to authorize a third party to perform the opt-out on the individual's behalf;

(C) a statement specifying the data collection, databases or sales activities from which an individual may not opt out;

(D) a statement whether the data broker implements a purchaser credentialing process;

(E) the number of data broker security breaches that the data broker has experienced during the prior year and, if known, the total number of individuals affected by the breaches;

(F) if the data broker has actual knowledge that it possesses the brokered personal information of minors, a separate statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the brokered personal information of minors; and

(G) any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(b) The Secretary of State shall publish on its website a list of registered data brokers and update the list annually.

(c) A data broker that fails to register as required under this Section shall pay a civil penalty of $50 for each day, not to exceed a total of $10,000 for each year, it fails to register; (2) an amount equal to the fees due under this Section during the period it failed to register as required under this Section; and (3) other penalties imposed by law.

(d) The Attorney General may maintain an action in circuit court to collect the penalties imposed by this Section and to seek injunctive relief.