Bill Text: IL HB2411 | 2017-2018 | 100th General Assembly | Introduced

---

Bill Title: Amends the Biometric Information Privacy Act. Provides that except to the extent necessary for an employer to conduct background checks or implement employee security protocols, a private entity may not require a person or customer to provide his or her biometric identifier or biometric information as a condition for the provision of goods or services. Provides that the new provisions do not apply to: (i) companies that provide medical services; (ii) law enforcement agencies; or (iii) governmental entities.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Failed) 2019-01-08 - Session Sine Die [HB2411 Detail]

Download: Illinois-2017-HB2411-Introduced.html

---

100TH GENERAL ASSEMBLY State of Illinois 2017 and 2018 HB2411 Introduced , by Rep. Sam Yingling SYNOPSIS AS INTRODUCED:
740 ILCS 14/15
Amends the Biometric Information Privacy Act. Provides that except to the extent necessary for an employer to conduct background checks or implement employee security protocols, a private entity may not require a person or customer to provide his or her biometric identifier or biometric information as a condition for the provision of goods or services. Provides that the new provisions do not apply to: (i) companies that provide medical services; (ii) law enforcement agencies; or (iii) governmental entities.
LRB100 07957 HEP 18031 b
A BILL FOR
HB2411 LRB100 07957 HEP 18031 b
AN ACT concerning civil law.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Biometric Information Privacy Act is amended
by changing Section 15 as follows:
(740 ILCS 14/15)
Sec. 15. Retention; collection; disclosure; destruction.
(a) A private entity in possession of biometric identifiers
or biometric information must develop a written policy, made
available to the public, establishing a retention schedule and
guidelines for permanently destroying biometric identifiers
and biometric information when the initial purpose for
collecting or obtaining such identifiers or information has
been satisfied or within 3 years of the individual's last
interaction with the private entity, whichever occurs first.
Absent a valid warrant or subpoena issued by a court of
competent jurisdiction, a private entity in possession of
biometric identifiers or biometric information must comply
with its established retention schedule and destruction
guidelines.
(a-5) Except to the extent necessary for an employer to
conduct background checks or implement employee security
protocols, a private entity may not require a person or

HB2411 - 2 - LRB100 07957 HEP 18031 b
customer to provide his or her biometric identifier or
biometric information as a condition for the provision of goods
or services. This subsection (a-5) does not apply to: (i)
companies that provide medical services; (ii) law enforcement
agencies; or (iii) governmental entities.
(b) No private entity may collect, capture, purchase,
receive through trade, or otherwise obtain a person's or a
customer's biometric identifier or biometric information,
unless it first:
(1) informs the subject or the subject's legally
authorized representative in writing that a biometric
identifier or biometric information is being collected or
stored;
(2) informs the subject or the subject's legally
authorized representative in writing of the specific
purpose and length of term for which a biometric identifier
or biometric information is being collected, stored, and
used; and
(3) receives a written release executed by the subject
of the biometric identifier or biometric information or the
subject's legally authorized representative.
(c) No private entity in possession of a biometric
identifier or biometric information may sell, lease, trade, or
otherwise profit from a person's or a customer's biometric
identifier or biometric information.
(d) No private entity in possession of a biometric

HB2411 - 3 - LRB100 07957 HEP 18031 b
identifier or biometric information may disclose, redisclose,
or otherwise disseminate a person's or a customer's biometric
identifier or biometric information unless:
(1) the subject of the biometric identifier or
biometric information or the subject's legally authorized
representative consents to the disclosure or redisclosure;
(2) the disclosure or redisclosure completes a
financial transaction requested or authorized by the
subject of the biometric identifier or the biometric
information or the subject's legally authorized
representative;
(3) the disclosure or redisclosure is required by State
or federal law or municipal ordinance; or
(4) the disclosure is required pursuant to a valid
warrant or subpoena issued by a court of competent
jurisdiction.
(e) A private entity in possession of a biometric
identifier or biometric information shall:
(1) store, transmit, and protect from disclosure all
biometric identifiers and biometric information using the
reasonable standard of care within the private entity's
industry; and
(2) store, transmit, and protect from disclosure all
biometric identifiers and biometric information in a
manner that is the same as or more protective than the
manner in which the private entity stores, transmits, and

HB2411 - 4 - LRB100 07957 HEP 18031 b
protects other confidential and sensitive information.
(Source: P.A. 95-994, eff. 10-3-08.)