Bill Amendment: IL SB1502 | 2017-2018 | 100th General Assembly

NOTE: For additional amemendments please see the Bill Drafting List

---

Bill Title: RIGHT TO KNOW ACT

Status: 2019-01-09 - Session Sine Die [SB1502 Detail]

Download: Illinois-2017-SB1502-Senate_Amendment_001.html

---

Sen. Michael E. Hastings

Filed: 2/22/2017

10000SB1502sam001 LRB100 08019 RJF 22357 a
AMENDMENT TO SENATE BILL 1502
AMENDMENT NO. ______. Amend Senate Bill 1502 by replacing
everything after the enacting clause with the following:
"Section 1. Short title. This Act may be cited as the Right
to Know Act.
Section 5. Findings and purpose.
The General Assembly hereby finds and declares that the
right to privacy is a personal and fundamental right protected
by the United States Constitution. As such, all individuals
have a right to privacy in information pertaining to them. This
State recognizes the importance of providing consumers with
transparency about how their personal information, especially
information relating to their children, is shared by
businesses. This transparency is crucial for Illinois citizens
to protect themselves and their families from cyber-crimes and
identity thieves. Furthermore, for free market forces to have a

10000SB1502sam001 - 2 - LRB100 08019 RJF 22357 a
role in shaping the privacy practices and for "opt-in" and
"opt-out" remedies to be effective, consumers must be more than
vaguely informed that a business might share personal
information with third parties. Consumers must be better
informed about what kinds of personal information are shared
with other businesses. With these specifics, consumers can
knowledgeably choose to opt-in, opt-out, or choose among
businesses that disclose information to third parties on the
basis of how protective the business is of consumers' privacy.
Businesses are now collecting personal information and
sharing and selling it in ways not contemplated or properly
covered by the current law. Some websites are installing
tracking tools that record when consumers visit web pages, and
sending very personal information, such as age, gender, race,
income, health concerns, religion, and recent purchases to
third party marketers and data brokers. Third party data broker
companies are buying, selling, and trading personal
information obtained from mobile phones, financial
institutions, social media sites, and other online and brick
and mortar companies. Some mobile applications are sharing
personal information, such as location information, unique
phone identification numbers, and age, gender, and other
personal details with third party companies. As such, consumers
need to know the ways that their personal information is being
collected by companies and then shared or sold to third parties
in order to properly protect their privacy, personal safety,

10000SB1502sam001 - 3 - LRB100 08019 RJF 22357 a
and financial security.
Section 10. Definitions. As used in this Act:
"Categories of personal information" includes, but is not
limited to, the following:
(a) Identity information including, but not limited
to, real name, alias, nickname, and user name.
(b) Address information, including, but not limited
to, postal or e-mail.
(c) Telephone number.
(d) Account name.
(e) Social security number or other government-issued
identification number, including, but not limited to,
social security number, driver's license number,
identification card number, and passport number.
(f) Birthdate or age.
(g) Physical characteristic information, including,
but not limited to, height and weight.
(h) Sexual information, including, but not limited to,
sexual orientation, sex, gender status, gender identity,
and gender expression.
(i) Race or ethnicity.
(j) Religious affiliation or activity.
(k) Political affiliation or activity.
(l) Professional or employment-related information.
(m) Educational information.

10000SB1502sam001 - 4 - LRB100 08019 RJF 22357 a
(n) Medical information, including, but not limited
to, medical conditions or drugs, therapies, mental health,
or medical products or equipment used.
(o) Financial information, including, but not limited
to, credit, debit, or account numbers, account balances,
payment history, or information related to assets,
liabilities, or general creditworthiness.
(p) Commercial information, including, but not limited
to, records of property, products or services provided,
obtained, or considered, or other purchasing or consumer
histories or tendencies.
(q) Location information.
(r) Internet or mobile activity information,
including, but not limited to, Internet protocol addresses
or information concerning the access or use of any Internet
or mobile-based site or service.
(s) Content, including text, photographs, audio or
video recordings, or other material generated by or
provided by the customer.
(t) Any of the above categories of information as they
pertain to the children of the customer.
"Customer" means an individual residing in Illinois who
provides, either knowingly or unknowingly, personal
information to a private entity, with or without an exchange of
consideration, in the course of purchasing, viewing,
accessing, renting, leasing, or otherwise using real or

10000SB1502sam001 - 5 - LRB100 08019 RJF 22357 a
personal property, or any interest therein, or obtaining a
product or service from the private entity, including
advertising or any other content.
"Designated request address" means an e-mail address or
toll-free telephone number whereby customers may request or
obtain the information required to be provided under Section 15
of this Act.
"Disclose" means to disclose, release, transfer, share,
disseminate, make available, or otherwise communicate orally,
in writing, or by electronic or any other means to any third
party. "Disclose" does not include the following:
(a) Disclosure of personal information by a private
entity to a third party under a written contract
authorizing the third party to utilize the personal
information to perform services on behalf of the private
entity, including maintaining or servicing accounts,
providing customer service, processing or fulfilling
orders and transactions, verifying customer information,
processing payments, providing financing, or similar
services, but only if (i) the contract prohibits the third
party from using the personal information for any reason
other than performing the specified service or services on
behalf of the private entity and from disclosing any such
personal information to additional third parties; and (ii)
the private entity effectively enforces these
prohibitions.

10000SB1502sam001 - 6 - LRB100 08019 RJF 22357 a
(b) Disclosure of personal information by a business to
a third party based on a good-faith belief that disclosure
is required to comply with applicable law, regulation,
legal process, or court order.
(c) Disclosure of personal information by a private
entity to a third party that is reasonably necessary to
address fraud, security, or technical issues; to protect
the disclosing private entity's rights or property; or to
protect customers or the public from illegal activities as
required or permitted by law.
"Operator" means any person or entity that owns a website
located on the Internet or an online service that collects and
maintains personal information from a customer residing in
Illinois who uses or visits the website or online service if
the website or online service is operated for commercial
purposes. It does not include any third party that operates,
hosts, or manages, but does not own, a website or online
service on the owner's behalf or by processing information on
behalf of the owner.
"Personal information" means any information that
identifies, relates to, describes, or is capable of being
associated with, a particular individual, including, but not
limited to, his or her name, signature, physical
characteristics or description, address, telephone number,
passport number, driver's license or State identification card
number, insurance policy number, education, employment,

10000SB1502sam001 - 7 - LRB100 08019 RJF 22357 a
employment history, bank account number, credit card number,
debit card number, or any other financial information.
"Personal information" also means any data or information
pertaining to an individual's income, assets, liabilities,
purchases, leases, or rentals of goods, services, or real
property, if that information is disclosed, or is intended to
be disclosed, with any identifying information, such as the
individual's name, address, telephone number, or social
security number.
"Third party" or "third parties" means (i) a private entity
that is a separate legal entity from the private entity that
has disclosed personal information; (ii) a private entity that
does not share common ownership or common corporate control
with the private entity that has disclosed personal
information; or (iii) a private entity that does not share a
brand name or common branding with the private entity that has
disclosed personal information such that the affiliate
relationship is clear to the customer.
Section 15. Notification of information sharing practices.
An operator of a commercial website or online service that
collects personal information through the Internet about
individual customers residing in Illinois who use or visit its
commercial website or online service shall, in its customer
agreement or incorporated addendum: (i) identify all
categories of personal information that the operator collects

10000SB1502sam001 - 8 - LRB100 08019 RJF 22357 a
through the website or online service about individual
customers who use or visit its commercial website or online
service; (ii) identify all categories of third party persons or
entities with whom the operator may disclose that personal
information; and (iii) provide a description of a customer's
rights, as required under Section 25 of this Act, accompanied
by one or more designated request addresses.
Section 20. Disclosure of a customer's personal
information to a third party.
(a) An operator that discloses a customer's personal
information to a third party shall make the following
information available to the customer free of charge:
(1) all categories of personal information that were
disclosed; and
(2) the names of all third parties that received the
customer's personal information.
(b) This Section applies only to personal information
disclosed after the effective date of this Act.
Section 25. Information availability service.
(a) An operator required to comply with Section 20 shall
make the required information available by providing a
designated request address in its customer agreement or
incorporated addendum, and, upon receipt of a request under
this Section, shall provide the customer with the information

10000SB1502sam001 - 9 - LRB100 08019 RJF 22357 a
required under Section 20 for all disclosures occurring in the
prior 12 months.
(b) An operator that receives a request from a customer
under this Section at one of the designated addresses shall
provide a response to the customer within 30 days.
(c) The parent or legal guardian of a customer under the
age of 18 may submit a request under this Section on behalf of
that customer.
(d) An operator shall not be required to respond to a
request made by the same customer more than once within a given
12-month period.
Section 30. Right of action. Any person whose rights under
this Act are violated shall have a right of action against an
offending party, and shall recover: (i) liquidated damages of
$10 or actual damages, whichever is greater; (ii) injunctive
relief, if appropriate; and (iii) reasonable attorneys' fees,
costs, and expenses.
Section 35. Waivers; contracts. Any waiver of the
provisions of this Act shall be void and unenforceable. Any
agreement that does not comply with the applicable provisions
of this Act shall be void and unenforceable.
Section 40. Construction.
(a) Nothing in this Act shall be construed to conflict with

10000SB1502sam001 - 10 - LRB100 08019 RJF 22357 a
the federal Health Insurance Portability and Accountability
Act of 1996 and the rules promulgated under that Act.
(b) Nothing in this Act shall be deemed to apply in any
manner to a financial institution or an affiliate of a
financial institution that is subject to Title V of the federal
Gramm-Leach-Bliley Act of 1999 and the rules promulgated under
that Act.
(c) Nothing in this Act shall be deemed to apply to the
activities of an individual or entity to the extent that those
activities are subject to Section 222 or 631 of the federal
Communications Act of 1934.
(d) Nothing in this Act shall be construed to apply to a
contractor, subcontractor, or agent of a State agency or local
unit of government when working for that State agency or local
unit of government.".