SB0575sam001 100TH GENERAL ASSEMBLY

Sen. Kwame Raoul

Filed: 4/20/2018

10000SB0575sam001 LRB100 04833 HEP 39116 a

AMENDMENT TO SENATE BILL 575

AMENDMENT NO. ______. Amend Senate Bill 575 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Keep Internet Devices Safe Act.

Section 5. Legislative findings; intent. The General Assembly finds the following:

(a) An increasing number of everyday household devices, such as smartphones, televisions, cars, toys, and home appliances, are being enhanced by speech recognition and other technologies that use microphones to listen for environmental triggers. As a result, private companies are gaining unprecedented and near constant access to Illinois citizens and their families' private lives, including what they do in their homes and their daily habits.

(b) While there are tremendous benefits from these technologies, the collection of personal information from Internet connected devices pose serious privacy and physical safety risks to Illinois citizens and children. Children's toys now have microphones that can record and collect personal information from conversations within earshot of the device.

(c) The increasing prevalence of these technologies in everyday devices enables companies to collect, store, analyze, and share increasing amounts of personal data, often without Illinois families ever knowing. Illinois citizens have a right to their personal data and the public welfare, security, and safety will be served by requiring companies to be transparent about their data collection and sharing practices.

(d) It is the public policy of the State of Illinois to ensure that Illinois citizens be aware of and have control over whether a private entity records, collects, stores, or discloses their personal information and to ensure that their personal information is maintained in a secure manner.

Section 10. Definitions. In this Act:

"Digital device" means a smartphone, tablet, television, computer, car, toy, home appliance, or any other device that may be used for personal, family, or household purposes that contains a microphone.

"Microphone" means an instrument capable of listening for, collecting, recording, storing, analyzing, transmitting, interpreting, or otherwise using spoken words or other audible or inaudible sounds.

"Private entity" means any partnership, corporation, limited liability company, association, organization or other group, regardless of organizational structure, or any agent thereof. "Private entity" does not include a state or local government agency.

"Minor" means a person who is between the ages of 13 and 17 years old.

"User" means a person who purchases, leases, or otherwise uses a digital device.

"Verifiable parental consent" means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a minor receives notice of the private entity's personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that minor.

Section 15. Collection, use, storage, or disclosure of information from a digital device's microphone.

(a) No private entity may turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to listen for or collect information, including spoken words or other audible or inaudible sounds, unless a user first agrees to a written policy, made available to the public, informing the user:

(1) that the microphone in his or her digital device will be turned on, enabled, or used;

(2) of the frequency and length of time the microphone will be turned on, enabled, or used;

(3) of the specific categories of information, such as spoken words or audible or inaudible sounds, the microphone will be listening for, collecting, storing, and disclosing; and

(4) of the specific purpose for which the information will be collected, used, stored, and disclosed.

(b) In addition to any other requirement under this Section, no private entity may turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to knowingly listen for or collect information about a minor, including spoken words or other audible or inaudible sounds, unless the private entity first obtains verifiable parental consent.

(c) A private entity need not obtain a user's affirmative express consent after initial consent as described in subsection (a) has been properly obtained, unless the terms previously agreed to under paragraph (1), (2), (3), or (4) of subsection (a) are materially changed.

Section 20. Security measures.

(a) A private entity that collects, stores, or transmits any information collected through a digital device's microphone concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, and disclosure.

(b) A contract for the disclosure of information collected through a digital device's microphone concerning an Illinois resident that is maintained by a private entity subject to this Act must include a provision requiring the person or private entity to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Section 25. Unlawful practice. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Section 30. General provisions.

(a) Any waiver of the provisions of this Act is void and unenforceable.

(b) Any agreement created or modified after the effective date of this Act that does not comply with this Act is void and unenforceable.

Section 35. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2Z as follows:

(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)

Sec. 2Z. Violations of other Acts. Any person who knowingly violates the Automotive Repair Act, the Automotive Collision Repair Act, the Home Repair and Remodeling Act, the Dance Studio Act, the Physical Fitness Services Act, the Hearing Instrument Consumer Protection Act, the Illinois Union Label Act, the Installment Sales Contract Act, the Job Referral and Job Listing Services Consumer Protection Act, the Travel Promotion Consumer Protection Act, the Credit Services Organizations Act, the Automatic Telephone Dialers Act, the Pay-Per-Call Services Consumer Protection Act, the Telephone Solicitations Act, the Illinois Funeral or Burial Funds Act, the Cemetery Oversight Act, the Cemetery Care Act, the Safe and Hygienic Bed Act, the Illinois Pre-Need Cemetery Sales Act, the High Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, the Internet Caller Identification Act, paragraph (6) of subsection (k) of Section 6-305 of the Illinois Vehicle Code, Section 11-1431, 18d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the Illinois Vehicle Code, Article 3 of the Residential Real Property Disclosure Act, the Automatic Contract Renewal Act, the Reverse Mortgage Act, Section 25 of the Youth Mental Health Protection Act, the Personal Information Protection Act, or the Student Online Personal Protection Act, or the Keep Internet Devices Safe Act commits an unlawful practice within the meaning of this Act.

(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642, eff. 7-28-16; 100-315, eff. 8-24-17; 100-416, eff. 1-1-18; revised 10-6-17.)".