SB3516 103RD GENERAL ASSEMBLY

LRB103 36578 SPS 66687 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB3516

Introduced 2/9/2024, by Sen. Sue Rezin

SYNOPSIS AS INTRODUCED:

30 ILCS 105/5.1015 new
815 ILCS 530/55 new

Amends the Personal Information Protection Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its Internet website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund to offset all reasonable costs of enforcing the registration requirements and establishing and maintaining the Internet website. Amends the State Finance Act to create the Data Broker Registry Fund.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The State Finance Act is amended by adding Section 5.1015 as follows:

(30 ILCS 105/5.1015 new)

Sec. 5.1015. The Data Broker Registry Fund.

Section 10. The Personal Information Protection Act is amended by adding Section 55 as follows:

(815 ILCS 530/55 new)

Sec. 55. Data broker registry.

(a) As used in this Section, "data broker" means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. "Data broker" does not include:

(1) an entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); and

(2) an entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and its implementing regulations.

(b) Annually, on or before January 31, a data broker operating in this State shall register with the Attorney General.

(c) In registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational Internet website described in Section 60. A data broker shall also provide the following information:

(1) the name of the data broker and its primary physical, email, and Internet website addresses;

(2) whether the data broker collects the personal information of minors;

(3) whether the data broker collects consumers' precise geolocation;

(4) whether the data broker collects consumers' reproductive health care data;

(5) a link to a page on the data broker's Internet website that does not make use of any dark patterns;

(6) whether, and to what extent, the data broker or any of its subsidiaries is regulated by any of the following:

(A) the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); and

(B) the Gramm-Leach-Bliley Act (Public Law 106-102) and its implementing regulations; and

(7) any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(d) The Attorney General shall create a page on its Internet website where the registration information provided in subsection (c) shall be made accessible to the public.

(e) A data broker that fails to register as required by this Section shall be liable for civil penalties and costs in an action brought by the Attorney General as follows:

(1) a civil penalty of $200 for each day the data broker fails to register as required by this Section;

(2) an amount equal to the fees that were due during the period it failed to register; and

(3) expenses incurred by the Attorney General in the investigation and administration of the action as the court deems appropriate.

(f) All moneys received by the Attorney General under this Section shall be deposited into the Data Broker Registry Fund, a special fund created in the State treasury, and shall be used, subject to appropriation and as directed by the Attorney General, to offset all reasonable costs of enforcing the registration requirements described in subsection (c) and establishing and maintaining the Internet website in subsection (d).