HB4447ham003 103RD GENERAL ASSEMBLY

Rep. John M. Cabello

Filed: 3/22/2024

10300HB4447ham003 LRB103 34729 SPS 71326 a

AMENDMENT TO HOUSE BILL 4447

AMENDMENT NO. ______. Amend House Bill 4447 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Data Broker Registration Act.

Section 5. Definitions. As used in this Act:

"Brokered personal information" means one or more of the following computerized data elements about an individual, if categorized or organized for dissemination to third parties:

(1) name;

(2) address;

(3) date of birth;

(4) place of birth;

(5) mother's maiden name;

(6) unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the individual, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data;

(7) name or address of a member of the individual's immediate family or household;

(8) social Security number or other government-issued identification number; and

(9) other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the individual with reasonable certainty.

"Brokered personal information" does not include publicly available information.

"Data broker" means a business or a unit of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of an individual with whom the business does not have a direct relationship. A direct relationship with a business includes if the individual is a past or present: (i) customer, client, subscriber, user, or registered user of the business's goods or services; (ii) employee, contractor, or agent of the business; (iii) investor in the business; or (iv) donor to the business.

"Data broker" does not include a business that conducts the following activities and the collection, sale, or licensing of brokered personal information incidental to conducting the activities:

(1) developing or maintaining third-party e-commerce or application platforms;

(2) providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier;

(3) collecting or transmitting information to be submitted to a State or federal agency for the purpose of performing a lawful check of criminal history record information using fingerprints or receiving the results of that check;

(4) collecting, maintaining, disclosing, selling, communicating, or using any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.;

(5) collecting, processing, selling, or disclosing personal data in compliance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq.; or

(6) preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserving the integrity or security of systems; or investigating, reporting, or prosecuting individuals responsible for any such action.

"Data broker" also does not include:

(1) financial institutions, affiliates of financial institutions, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.;

(2) insurance companies and insurance support organizations; or

(3) law enforcement agencies, law enforcement support organizations, and law enforcement vendors.

"Publicly available information" means information that is lawfully made available through federal, State, or local government records or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

Section 10. Annual registration.

(a) Annually, on or before January 31, a data broker operating in this State shall:

(1) register with the Secretary of State;

(2) pay a registration fee of $100 for use by the Secretary of State to administer and enforce this Section; and

(3) provide the following information:

(A) the name and primary physical, e-mail, and Internet addresses of the data broker;

(B) if the data broker permits an individual to opt out of the data broker's collection of brokered personal information, opt out of its databases, or opt out of certain sales of data:

(i) the method for requesting an opt-out;

(ii) which activities or sales the opt-out applies to; and

(iii) whether the data broker permits an individual to authorize a third party to perform the opt-out on the individual's behalf;

(C) a statement specifying the data collection, databases or sales activities from which an individual may not opt out;

(D) a statement whether the data broker implements a purchaser credentialing process;

(E) the number of data broker security breaches that the data broker has experienced during the prior year and, if known, the total number of individuals affected by the breaches;

(F) if the data broker has actual knowledge that it possesses the brokered personal information of minors, a separate statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the brokered personal information of minors; and

(G) any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(b) The Secretary of State shall publish on its website a list of registered data brokers and update the list annually.

(c) A data broker that fails to register as required under this Section shall pay a civil penalty of $50 for each day, not to exceed a total of $10,000 for each year, it fails to register; (2) an amount equal to the fees due under this Section during the period it failed to register as required under this Section; and (3) other penalties imposed by law.

(d) The Secretary of State may revoke or suspend the registration of an individual or entity for a period of up to one year, or bar an individual or entity from applying for registration for a period of up to one year, for failure to register or to pay any fee, fine, or penalty under this Act. All fees, fines, and penalties shall be paid prior to reinstatement or registration of any individual or entity required to register as a data broker.

(e) The Secretary of State may adopt rules to implement and administer this Section.

Section 15. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to him or her for the enforcement of this Act.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2EEEE and 2FFFF as follows:

(815 ILCS 505/2EEEE new)

Sec. 2EEEE. Motor vehicle extended warranty.

(a) As used in this Section, "extended warranty" means any contract or agreement indemnifying the service agreement holder for the motor vehicle listed on the service agreement and arising out of the ownership, operation, and use of the motor vehicle against loss caused by failure of any mechanical or other component part, or any mechanical or other component part that does not function as it was originally intended. "Extended warranty" does not include the usual performance guarantees by manufacturers or dealers in connection with the sale of motor vehicles.

(b) It is an unlawful practice within the meaning of this Act for any person to solicit the purchase of an extended warranty through the mail.

(c) This Section does not apply to the seller of a motor vehicle who solicits the purchase of an extended warranty for that motor vehicle.

(815 ILCS 505/2FFFF new)

Sec. 2FFFF. Violations of the Data Broker Registration Act. Any person who violates the Data Broker Registration Act commits an unlawful practice within the meaning of this Act.

Section 95. The Personal Information Protection Act is amended by changing Section 5 as follows:

(815 ILCS 530/5)

Sec. 5. Definitions. In this Act:

"Data collector" may include, but is not limited to, government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information.

"Breach of the security of the system data" or "breach" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector. "Breach of the security of the system data" does not include good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, provided that the personal information is not used for a purpose unrelated to the data collector's business or subject to further unauthorized disclosure.

"Health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any medical information in an individual's health insurance application and claims history, including any appeals records.

"Medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional, including such information provided to a website or mobile application.

"Personal information" means either of the following:

(1) An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the name or data elements have been acquired without authorization through the breach of security:

(A) Social Security number.

(B) Driver's license number or State identification card number.

(C) Account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account.

(D) Medical information.

(E) Health insurance information.

(F) Unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee to authenticate an individual, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data.

(G) Home purchasing information.

(2) User name or email address, in combination with a password or security question and answer that would permit access to an online account, when either the user name or email address or password or security question and answer are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the data elements have been obtained through the breach of security.

"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

(Source: P.A. 99-503, eff. 1-1-17.)".