Bill Text: IL HB3449 | 2017-2018 | 100th General Assembly | Introduced


Bill Title: Creates the Geolocation Privacy Protection Act. Defines "geolocation information", "location-based application", and "private entity". Provides that a private entity may not collect, use, store, or disclose geolocation information from a location-based application on a person's device unless the private entity first receives the person's affirmative express consent after complying with specified notice requirements. Provides exceptions. Provides that a person whose rights are violated may recover: (1) liquidated damages of $1,000 or actual damages, whichever is greater; (2) reasonable attorney's fees and costs; and (3) other relief, including an injunction, as the court may deem appropriate. Provides that authority to seek remedies and impose penalties granted to the Attorney General under the Consumer Fraud and Deceptive Business Practices Act is also granted to the Attorney General for the enforcement of the Geolocation Privacy Protection Act. Provides that in any action brought by the Attorney General to enforce the Act, the court may order that persons who incurred actual damages be awarded 3 times the amount at which actual damages are assessed. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Provides that the provisions of the Act may not be waived. Contains applicability language. Makes a corresponding change in the Consumer Fraud and Deceptive Business Practices Act. Effective immediately.

Spectrum: Partisan Bill (Democrat 28-0)

Status: (Introduced) 2017-04-27 - House Floor Amendment No. 2 Recommends Be Adopted Cybersecurity, Data Analytics, & IT Committee; 006-002-001 [HB3449 Detail]

Download: Illinois-2017-HB3449-Introduced.html


100TH GENERAL ASSEMBLY
State of Illinois
2017 and 2018
HB3449

Introduced , by Rep. Ann M. Williams

SYNOPSIS AS INTRODUCED:
New Act
815 ILCS 505/2Z from Ch. 121 1/2, par. 262Z

Creates the Geolocation Privacy Protection Act. Defines "geolocation information", "location-based application", and "private entity". Provides that a private entity may not collect, use, store, or disclose geolocation information from a location-based application on a person's device unless the private entity first receives the person's affirmative express consent after complying with specified notice requirements. Provides exceptions. Provides that a person whose rights are violated may recover: (1) liquidated damages of $1,000 or actual damages, whichever is greater; (2) reasonable attorney's fees and costs; and (3) other relief, including an injunction, as the court may deem appropriate. Provides that authority to seek remedies and impose penalties granted to the Attorney General under the Consumer Fraud and Deceptive Business Practices Act is also granted to the Attorney General for the enforcement of the Geolocation Privacy Protection Act. Provides that in any action brought by the Attorney General to enforce the Act, the court may order that persons who incurred actual damages be awarded 3 times the amount at which actual damages are assessed. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Provides that the provisions of the Act may not be waived. Contains applicability language. Makes a corresponding change in the Consumer Fraud and Deceptive Business Practices Act. Effective immediately.
LRB100 08543 HEP 18668 b

A BILL FOR

HB3449LRB100 08543 HEP 18668 b
1 AN ACT concerning business.
2 Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
4 Section 1. Short title. This Act may be cited as the
5Geolocation Privacy Protection Act.
6 Section 5. Definitions. As used in this Act:
7 "Geolocation information" means information that: (i) is
8not the contents of a communication; (ii) is generated by or
9derived from, in whole or in part, the operation of a mobile
10device, including, but not limited to, a smart phone, tablet,
11or laptop computer; and (iii) is sufficient to determine or
12infer location of that device. "Geolocation information" does
13not include Internet protocol addresses.
14 "Location-based application" means a software application
15that collects, uses, or stores geolocation information.
16 "Private entity" means any individual, partnership,
17corporation, limited liability company, association, or other
18group, however organized. "Private entity" does not include any
19governmental agency.
20 Section 10. Collection, use, storage, and disclosure of
21geolocation information from location-based applications.
22 (a) A private entity may not collect, use, store, or

HB3449- 2 -LRB100 08543 HEP 18668 b
1disclose geolocation information from a location-based
2application on a person's device unless the private entity
3first receives the person's affirmative express consent after
4providing clear, prominent, and accurate notice that:
5 (1) informs the person that his or her geolocation
6 information will be collected, used, or disclosed;
7 (2) informs the person in writing of the specific
8 purposes for which his or her geolocation information will
9 be collected, used, or disclosed; and
10 (3) provides the person a hyperlink or comparably
11 easily accessible means to access the information
12 specified in this subsection.
13 (b) A private entity may collect, use, or disclose
14geolocation information from a location-based application on a
15person's device without receiving affirmative express consent
16if the collection or disclosure is:
17 (1) to allow a parent or legal guardian to locate an
18 unemancipated minor child;
19 (2) to allow a court-appointed guardian to locate a
20 legally incapacitated person; or
21 (3) for the provision of fire, medical, public safety,
22 or other emergency services.
23 (c) This Section applies to location-based applications
24created or modified after the effective date of this Act.
25 Section 15. Right of action. A person whose rights under

HB3449- 3 -LRB100 08543 HEP 18668 b
1this Act are violated has a right of action against an
2offending party and may recover:
3 (1) liquidated damages of $1,000 or actual damages,
4 whichever is greater;
5 (2) reasonable attorney's fees and costs; and
6 (3) other relief, including an injunction, as the court
7 may deem appropriate.
8 Section 20. Enforcement by Attorney General.
9 (a) Authority to seek remedies and impose penalties granted
10to the Attorney General under the Consumer Fraud and Deceptive
11Business Practices Act is also granted to the Attorney General
12for the enforcement of this Act. In any action brought by the
13Attorney General to enforce this Act, the court may order that
14persons who incurred actual damages be awarded 3 times the
15amount at which actual damages are assessed.
16 (b) A violation of this Act constitutes an unlawful
17practice under the Consumer Fraud and Deceptive Business
18Practices Act.
19 Section 25. Waivers; contracts.
20 (a) Any waiver of the provisions of this Act is void and
21unenforceable.
22 (b) Any contract provision relating to the use of a
23location-based application that does not comply with the
24applicable provisions of this Act is void and unenforceable.

HB3449- 4 -LRB100 08543 HEP 18668 b
1 Section 30. Applicability. This Act does not apply to: (i)
2a health care provider or other covered entity subject to the
3federal Health Insurance Portability and Accountability Act of
41996 and the rules promulgated thereunder; (ii) a financial
5institution or an affiliate of a financial institution that is
6subject to Title V of the federal Gramm-Leach-Bliley Act of
71999 and the rules promulgated thereunder; or (iii) a cable,
8Internet, or telecommunications service provider.
9 Section 90. The Consumer Fraud and Deceptive Business
10Practices Act is amended by changing Section 2Z as follows:
11 (815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)
12 Sec. 2Z. Violations of other Acts. Any person who knowingly
13violates the Automotive Repair Act, the Automotive Collision
14Repair Act, the Home Repair and Remodeling Act, the Dance
15Studio Act, the Geolocation Privacy Protection Act, the
16Physical Fitness Services Act, the Hearing Instrument Consumer
17Protection Act, the Illinois Union Label Act, the Job Referral
18and Job Listing Services Consumer Protection Act, the Travel
19Promotion Consumer Protection Act, the Credit Services
20Organizations Act, the Automatic Telephone Dialers Act, the
21Pay-Per-Call Services Consumer Protection Act, the Telephone
22Solicitations Act, the Illinois Funeral or Burial Funds Act,
23the Cemetery Oversight Act, the Cemetery Care Act, the Safe and

HB3449- 5 -LRB100 08543 HEP 18668 b
1Hygienic Bed Act, the Pre-Need Cemetery Sales Act, the High
2Risk Home Loan Act, the Payday Loan Reform Act, the Mortgage
3Rescue Fraud Act, subsection (a) or (b) of Section 3-10 of the
4Cigarette Tax Act, subsection (a) or (b) of Section 3-10 of the
5Cigarette Use Tax Act, the Electronic Mail Act, the Internet
6Caller Identification Act, paragraph (6) of subsection (k) of
7Section 6-305 of the Illinois Vehicle Code, Section 11-1431,
818d-115, 18d-120, 18d-125, 18d-135, 18d-150, or 18d-153 of the
9Illinois Vehicle Code, Article 3 of the Residential Real
10Property Disclosure Act, the Automatic Contract Renewal Act,
11the Reverse Mortgage Act, Section 25 of the Youth Mental Health
12Protection Act, or the Personal Information Protection Act
13commits an unlawful practice within the meaning of this Act.
14(Source: P.A. 99-331, eff. 1-1-16; 99-411, eff. 1-1-16; 99-642,
15eff. 7-28-16.)
16 Section 99. Effective date. This Act takes effect upon
17becoming law.
feedback