SB1607 102ND GENERAL ASSEMBLY

LRB102 15852 LNS 21221 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
SB1607

Introduced 2/26/2021, by Sen. Bill Cunningham

SYNOPSIS AS INTRODUCED:

740 ILCS 14/10
740 ILCS 14/35 new
740 ILCS 14/40 new

Amends the Biometric Information Privacy Act. Defines "security purpose". Changes the definition of "written release" to include electronic consent and electronic release. Provides that the Attorney General and State's Attorneys have the sole authority to enforce the Act. Provides that an action may be brought to enforce the Act only if a violation of the Act causes actual harm. Provides that an employer is exempt under the Act if the employer collects, captures, obtains, or otherwise uses biometric identifiers and biometric information for: (1) keeping record of an employee's work hours; (2) a security purpose; (3) facility access; or (4) use by the human resource department or human resource employees of the employer. Provides that an employer is exempt under the Act if the employer retains the biometric identifier or information no longer than is reasonably necessary to satisfy a security purpose.

A BILL FOR

AN ACT concerning civil law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Biometric Information Privacy Act is amended by changing Section 10 and by adding Sections 35 and 40 as follows:

(740 ILCS 14/10)

Sec. 10. Definitions. In this Act:

"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.

"Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.

"Confidential and sensitive information" means personal information that can be used to uniquely identify an individual or an individual's account or property. Examples of confidential and sensitive information include, but are not limited to, a genetic marker, genetic testing information, a unique identifier number to locate an account or property, an account number, a PIN number, a pass code, a driver's license number, or a social security number.

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A private entity does not include a State or local government agency. A private entity does not include any court of Illinois, a clerk of the court, or a judge or justice thereof.

"Security purpose" means for the purpose of preventing shoplifting, fraud, or any other misappropriation or theft of a thing of value, including tangible and intangible goods and services, and other purposes in furtherance of protecting the security or integrity of software, accounts, applications, online services, property, or any person, including, but not limited to, protecting property from trespass, controlling access to property, and protecting any person from stalking, violence, or harassment.

"Written release" means informed written or electronic consent or, in the context of employment, a written or electronic release executed by an employee as a condition of employment.

(Source: P.A. 95-994, eff. 10-3-08.)

(740 ILCS 14/35 new)

Sec. 35. Violation of Act. The Attorney General and State's Attorneys have the sole authority to enforce this Act. An action may be brought to enforce this Act only if a violation of this Act causes actual harm.

(740 ILCS 14/40 new)

Sec. 40. Exemptions.

(a) An employer is exempt under this Act if the employer collects, captures, obtains, or otherwise uses biometric identifiers and biometric information for:

(1) keeping record of an employee's work hours;

(2) a security purpose;

(3) facility access, including, but not limited to, the restriction of access to certain locations; or

(4) use by the human resource department or human resource employees of the employer.

(b) Notwithstanding subsection (a) of Section 15, an employer is exempt under this Act if the employer retains the biometric identifier or information no longer than is reasonably necessary to satisfy a security purpose.