Public Act 103-0439
 
HB2954 EnrolledLRB103 30878 LNS 57401 b

    AN ACT concerning civil law.
 
    Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
 
    Section 1. Short title. This Act may be cited as the Civil
Liability for Doxing Act.
 
    Section 5. Definitions. As used in this Act:
    "Course of conduct" means a pattern of conduct composed of
2 or more acts, evidencing a continuity of purpose.
    "Electronic communication" means any transfer of signs,
signals, writing, images, sounds, data, or intelligence of any
nature transmitted in whole or in part by a wire, radio,
electromagnetic, photoelectronic, or photo-optical system.
    "Emotional distress" means significant mental suffering,
anxiety, or alarm. "Emotional distress" is limited to
emotional suffering that is protracted and not merely trivial
or transitory.
    "Family or household member" has the meaning given to the
term "family or household members" in Section 103 of the
Illinois Domestic Violence Act of 1986.
    "Personally identifiable information" means any
information that can be used to distinguish or trace a
person's identity, such as name, prior legal name, alias,
mother's maiden name, and date or place of birth in
combination with any other information that is linked or
linkable to a person such as:
        (1) social security number, home address, phone
    number, email address, social media accounts, or biometric
    data;
        (2) medical, financial, education, consumer, or
    employment information, data, or records;
        (3) any other sensitive or private information that is
    linked or linkable to a specific identifiable person, such
    as gender identity, sexual orientation, or any sexually
    intimate visual depiction; or
        (4) any information that provides access to a person's
    teleconferencing, video-teleconferencing, or other
    digital meeting room.
    "Post" means to circulate, deliver, distribute,
disseminate, transmit, or otherwise make available to 2 or
more persons through electronic communication.
    "Publish" means to circulate, deliver, distribute,
disseminate, post, transmit, or otherwise make available to
another person. "Publish" does not include writing or
electronically communicating to one other person in private
communications for which an individual has a reasonable
expectation of privacy.
    "Regularly resides" means residing in the household with
some permanency or regular frequency in the person's living
arrangement.
    "Stalk" or "stalking" has the meaning provided in Section
12-7.3 of the Criminal Code of 2012, except that "stalking"
does not include an activity that is part of a protest that is
protected by the United States Constitution or the Illinois
Constitution.
    "Substantial life disruption" means a material and
significant alteration of an individual's livelihood.
"Substantial life disruption" may include, but is not limited
to, moving from an established residence, changing routes to
and from work, changing employment or work schedule, or losing
time at work or a job.
 
    Section 10. Doxing.
    (a) An individual engages in the act of doxing when that
individual intentionally publishes another person's personally
identifiable information without the consent of the person
whose information is published and:
        (1) the information is published with the intent that
    it be used to harm or harass the person whose information
    is published and with knowledge or reckless disregard that
    the person whose information is published would be
    reasonably likely to suffer death, bodily injury, or
    stalking; and
        (2) the publishing of the information:
            (i) causes the person whose information is
        published to suffer significant economic injury or
        emotional distress or to fear serious bodily injury or
        death of the person or a family or household member of
        the person; or
            (ii) causes the person whose information is
        published to suffer a substantial life disruption; and
        (3) the person whose information is published is
    identifiable from the published personally identifiable
    information itself.
    (b) It is not an offense under this Act for an individual
to:
        (1) provide another person's personally identifiable
    information or sensitive personal information in
    connection with the reporting of criminal activity to an
    employee of a law enforcement agency or in connection with
    any lawfully authorized investigative, protective, or
    intelligence activity of any law enforcement agency or of
    an intelligence agency of the United States and the person
    making the report reasonably believes the alleged criminal
    activity occurred or the existing investigative,
    protective, or intelligence activity is legitimate;
        (2) disseminate the personally identifiable
    information for the purpose of, or in connection with, the
    reporting of conduct reasonably believed to be unlawful;
    or
        (3) provide a person's personally identifiable
    information in connection with activity protected under
    the United States Constitution or the Illinois
    Constitution pertaining to speech, press, assembly,
    protest, and petition, as well as the provision of
    personally identifiable information to the press.
    (c) Nothing in this Act shall be construed in any manner
to:
        (1) conflict with Section 230 of Title II of the
    Communications Act of 1934 (47 U.S.C. 230);
        (2) conflict with 42 U.S.C. 1983; or
        (3) prohibit any activity protected under the
    Constitution of the United States or the Illinois
    Constitution.
 
    Section 15. Civil action.
    (a) A person who is aggrieved by a violation of this Act
may bring a civil action against (i) the individual who
committed the offense of doxing or (ii) any individual or
entity that directs one or more persons to violate this Act and
that knowingly benefits, financially or by receiving anything
of value, from participation in a venture that the individual
or entity knew involved a violation of this Act.
    (b) A person who is aggrieved by a violation of this Act
may recover damages and any other appropriate relief,
including reasonable attorney's fees.
    (c) An individual who is found liable under this Act shall
be jointly and severally liable with each other individual, if
any, who is found liable under this Act for damages arising
from the same violation of this Act.
    (d) When a judgment is entered in favor of an individual
alleged to have committed the offense of doxing, the court may
award reasonable costs and attorney's fees to the defendant
for defending any claim that the court finds was brought by the
plaintiff and that the court finds was frivolous, baseless, or
brought in bad faith.
 
    Section 20. Injunctive relief.
    (a) A court in which a suit is brought under this Act, on
the motion of a party, may issue a temporary restraining
order, emergency order of protection, or preliminary or
permanent injunction to restrain and prevent the disclosure or
continued disclosure of a person's personally identifiable
information or sensitive personal information. Upon a motion
by a party in a civil action brought under this Act, and
following a full evidentiary hearing, a court may issue an
order pursuant to this Section to prevent the publishing of a
person's personally identifiable information or sensitive
personal information if the court finds by clear and
convincing evidence each of the following:
        (1) the individual to be enjoined published personally
    identifiable information or sensitive personal information
    in violation of this Act;
        (2) continued or further publishing of the personally
    identifiable information or sensitive personal information
    poses a present and ongoing risk of death, bodily injury,
    or stalking to another individual; and
        (3) the individual to be enjoined has no lawful or
    constitutional purpose for continued or further publishing
    of the personally identifiable information or sensitive
    personal information.
    (b) Any injunctive relief granted under this Section shall
state the following with sufficient particularity to allow
appellate review:
        (1) the required findings in subsection (a) of Section
    20 and the evidentiary basis and reasoning for the
    findings;
        (2) the expiration date of the injunction, which shall
    be no more than one year from the date of its entry;
        (3) that the enjoined individual may seek relief from
    the injunction, if the court determines, after notice and
    hearing, that one or more of the required findings in
    subsection (a) of Section 20 no longer apply; and
        (4) that the person who sought the injunction may seek
    an extension of the order of no more than one year if the
    court determines, after notice and hearing, that the
    required findings in subsection (a) of Section 20 continue
    to apply.
    (c) If a person violates any order issued under this
Section, the court, in its discretion, may grant any civil
remedy under State law.
 
    Section 25. Venue. A civil action may be brought in any
county in which an element of the offense occurred, or in which
a person resides who is the subject of personally identifiable
information published in violation of this Act.
 
    Section 30. Constitutionality. The General Assembly does
not intend this Act to allow, and this Act shall not allow,
actions to be brought against constitutionally protected
activity.
 
    Section 97. Severability. The provisions of this Act are
severable under Section 1.31 of the Statute on Statutes.

Effective Date: 1/1/2024