Bill Text: IL SB2897 | 2025-2026 | 104th General Assembly | Introduced

---

Bill Title: Amends the Personal Information Protection Act. Provides that a data collector shall not own, maintain, license, store, or disclose records that contain immigration or citizenship status information concerning an Illinois resident. Provides that the provision shall not apply to government agencies, public and private universities, or financial institutions. Provides that the definition of "personal information" includes immigration or citizenship status information. Defines "immigration or citizenship status information".

Sponsorship: Partisan Bill (Democrat 1)

Status: (Introduced - Dead) 2026-05-22 - Rule 3-9(a) / Re-referred to Assignments [SB2897 Detail]

Download: Illinois-2025-SB2897-Introduced.html

---

104TH GENERAL ASSEMBLY State of Illinois 2025 and 2026SB2897 Introduced 1/27/2026, by Sen. Celina Villanueva SYNOPSIS AS INTRODUCED:
815 ILCS 530/5
815 ILCS 530/45
Amends the Personal Information Protection Act. Provides that a data collector shall not own, maintain, license, store, or disclose records that contain immigration or citizenship status information concerning an Illinois resident. Provides that the provision shall not apply to government agencies, public and private universities, or financial institutions. Provides that the definition of "personal information" includes immigration or citizenship status information. Defines "immigration or citizenship status information".
LRB104 16891 SPS 30302 b
A BILL FOR
SB2897 LRB104 16891 SPS 30302 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Personal Information Protection Act is
amended by changing Sections 5 and 45 as follows:
(815 ILCS 530/5)
Sec. 5. Definitions. In this Act:
"Data collector" may include, but is not limited to,
government agencies, public and private universities,
privately and publicly held corporations, financial
institutions, retail operators, and any other entity that, for
any purpose, handles, collects, disseminates, or otherwise
deals with nonpublic personal information.
"Breach of the security of the system data" or "breach"
means unauthorized acquisition of computerized data that
compromises the security, confidentiality, or integrity of
personal information maintained by the data collector. "Breach
of the security of the system data" does not include good faith
acquisition of personal information by an employee or agent of
the data collector for a legitimate purpose of the data
collector, provided that the personal information is not used
for a purpose unrelated to the data collector's business or
subject to further unauthorized disclosure.

SB2897 - 2 - LRB104 16891 SPS 30302 b
"Health insurance information" means an individual's
health insurance policy number or subscriber identification
number, any unique identifier used by a health insurer to
identify the individual, or any medical information in an
individual's health insurance application and claims history,
including any appeals records.
"Immigration or citizenship status information" means any
information concerning: (i) the status of an individual's
citizenship of the United States or any other country; or (ii)
the legal right, or lack thereof, of an individual to reside in
or otherwise to be present in the United States. "Immigration
or citizenship status information" includes an individual's
nationality and country of origin.
"Medical information" means any information regarding an
individual's medical history, mental or physical condition, or
medical treatment or diagnosis by a healthcare professional,
including such information provided to a website or mobile
application.
"Personal information" means either of the following:
(1) An individual's first name or first initial and
last name in combination with any one or more of the
following data elements, when either the name or the data
elements are not encrypted or redacted or are encrypted or
redacted but the keys to unencrypt or unredact or
otherwise read the name or data elements have been
acquired without authorization through the breach of

SB2897 - 3 - LRB104 16891 SPS 30302 b
security:
(A) Social Security number.
(B) Driver's license number or State
identification card number.
(C) Account number or credit or debit card number,
or an account number or credit card number in
combination with any required security code, access
code, or password that would permit access to an
individual's financial account.
(D) Medical information.
(E) Health insurance information.
(F) Unique biometric data generated from
measurements or technical analysis of human body
characteristics used by the owner or licensee to
authenticate an individual, such as a fingerprint,
retina or iris image, or other unique physical
representation or digital representation of biometric
data.
(G) Immigration or citizenship status information.
(2) User name or email address, in combination with a
password or security question and answer that would permit
access to an online account, when either the user name or
email address or password or security question and answer
are not encrypted or redacted or are encrypted or redacted
but the keys to unencrypt or unredact or otherwise read
the data elements have been obtained through the breach of

SB2897 - 4 - LRB104 16891 SPS 30302 b
security.
"Personal information" does not include publicly available
information that is lawfully made available to the general
public from federal, State, or local government records.
(Source: P.A. 99-503, eff. 1-1-17.)
(815 ILCS 530/45)
Sec. 45. Data security.
(a) A data collector that owns or licenses, or maintains
or stores but does not own or license, records that contain
personal information concerning an Illinois resident shall
implement and maintain reasonable security measures to protect
those records from unauthorized access, acquisition,
destruction, use, modification, or disclosure.
(a-5) A data collector shall not own, maintain, license,
store, or disclose records that contain immigration or
citizenship status information concerning an Illinois
resident. This subsection shall not apply to government
agencies, public and private universities, or financial
institutions.
(b) A contract for the disclosure of personal information
concerning an Illinois resident that is maintained by a data
collector must include a provision requiring the person to
whom the information is disclosed to implement and maintain
reasonable security measures to protect those records from
unauthorized access, acquisition, destruction, use,

SB2897 - 5 - LRB104 16891 SPS 30302 b
modification, or disclosure.
(c) If a state or federal law requires a data collector to
provide greater protection to records that contain personal
information concerning an Illinois resident that are
maintained by the data collector and the data collector is in
compliance with the provisions of that state or federal law,
the data collector shall be deemed to be in compliance with the
provisions of this Section.
(d) A data collector that is subject to and in compliance
with the standards established pursuant to Section 501(b) of
the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. Section 6801,
shall be deemed to be in compliance with the provisions of this
Section.
(Source: P.A. 99-503, eff. 1-1-17.)