HB3453 102ND GENERAL ASSEMBLY

LRB102 11785 JLS 17120 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
HB3453

Introduced 2/22/2021, by Rep. Ann M. Williams

SYNOPSIS AS INTRODUCED:

New Act

Creates the Geolocation Privacy Protection Act. Provides that a private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing a specified notice to the user. Sets forth the purposes for which disclosure may be made. Provides that a violation of the Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Provides that the Act does not modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure. Provides that waiver of the provisions of the Act is void and unenforceable and an agreement that does not comply with the Act is void and unenforceable. Providers that the Act does not apply to certain entities.

FISCAL NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Geolocation Privacy Protection Act.

Section 5. Definitions. As used in this Act:

"Consent" means a clear affirmative act signifying a specific, informed, and unambiguous indication of a person's agreement, including through a written agreement or other clear affirmative action, that shall be valid only after all information as required by Section 10 has been disclosed to that person. "Consent" does not include only the continued use of a website or online service.

"Consumer transaction" means the disclosure of geolocation information for the purpose of moving or delivering tangible personal property made by a private entity or, with the private entity's authorization, the private entity's affiliate or service provider to process a consumer transaction.

"Disclose" means to disclose, release, transfer, share, disseminate, make available, sell, or otherwise communicate orally, in writing, or by electronic or any other means a consumer's geolocation information to any third party.

"Geolocation information" means information that: (i) is not the contents of a communication; (ii) is generated by or derived from, in whole or in part, the operation of a mobile device, including, but not limited to, a smart phone, tablet, or laptop computer; and (iii) is sufficient to determine or infer the precise geolocation of that device. "Geolocation information" does not include Internet protocol addresses.

"Location-based application" means a software application that is downloaded or installed onto a device and collects, uses, or stores geolocation information.

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. "Private entity" does not include any governmental agency.

"User" means a resident of this State who purchases or leases a device.

Section 10. Disclosure of geolocation information from location-based applications.

(a) A private entity that owns, operates, or controls a location-based application on a user's device may not disclose geolocation information from a location-based application to a third party unless the private entity first receives the user's affirmative express consent after providing clear and accurate notice that:

(1) informs the user that his or her geolocation information will be disclosed;

(2) informs the user of the purpose or purposes for which his or her geolocation information will be disclosed; and

(3) identifies the names and categories of private entities to which geolocation information may be disclosed.

(b) A private entity may disclose geolocation information from a location-based application on a user's device without receiving affirmative express consent if the disclosure is:

(1) to allow a parent or legal guardian to locate an unemancipated minor child;

(2) to allow a court-appointed guardian to locate a legally incapacitated person;

(3) in connection with fire, medical, public safety, or other emergency services;

(4) to comply with a subpoena or court order; or

(5) made in connection with a consumer transaction entered into by a consumer where a reasonable consumer would expect the geolocation information to be disclosed.

(c) This Section does not apply to geolocation information that is stored locally and is not removed from a user's device.

(d) A private entity need not obtain a user's affirmative express consent after the user's initial consent as described in subsection (a) has been obtained unless the terms previously agreed to under items (1), (2), and (3) of subsection (a) are materially changed.

(e) This Section applies only to location-based applications created or modified after the effective date of this Act.

Section 15. Violations and enforcement. A violation of this Act constitutes an unlawful practice for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by that Act shall be available to the Attorney General for the enforcement of this Act. There shall be no private right of action to enforce violations under this Act.

Section 20. Compliance; contracts; waivers.

(a) Nothing in this Act shall be construed to modify, limit, or supersede the operation of any other Illinois law or prevent a party from otherwise seeking relief under the Code of Civil Procedure.

(b) Any waiver of the provisions of this Act is void and unenforceable. Any agreement created or modified after the effective date of this Act that does not comply with this Act is void and unenforceable.

Section 25. Applicability. This Act does not apply to:

(1) a health care provider or other covered entity that is subject to the Federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated thereunder and that is disclosing geolocation information in accordance with that Act;

(2) a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act and the rules promulgated thereunder and that is disclosing geolocation information in accordance with that Act; or

(3) entities regulated under the Transportation Network Providers Act or any of their subsidiaries that own, operate, or control a location-based application, the sole function of which is to provide transportation services based on geolocation information, to the extent that these entities or their subsidiaries disclose the geolocation information for the sole purpose of providing a service requested by the individual or the use is otherwise consistent with that individual's reasonable expectations considering the context in which the individual provided the geolocation information to these entities.