HB2913 104TH GENERAL ASSEMBLY

LRB104 10750 SPS 20829 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB2913

Introduced 2/6/2025, by Rep. Daniel Didech

SYNOPSIS AS INTRODUCED:

New Act
30 ILCS 105/5.1030 new
815 ILCS 505/2HHHH new

Creates the Data Broker Registration and Accessible Deletion Mechanism Act. Provides that, annually, on or before January 31, a data broker operating in the State shall register with the Attorney General. Provides that, in registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General and shall also provide specified information. Provides that the Attorney General shall create a page on its website where the registration information shall be made accessible to the public. Provides for civil penalties. Provides that all moneys received by the Attorney General under the provisions shall be deposited into the Data Broker Registry Fund. Provides that, no later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker. Amends the State Finance Act and the Consumer Fraud and Deceptive Business Practices Act to make conforming changes.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Data Broker Registration and Accessible Deletion Mechanism Act.

Section 5. Definition. As used in this Act, "data broker" means a business that knowingly collects and sells or licenses to third parties the brokered personal information of an individual with whom the business does not have a direct relationship. "Data broker" does not include a business that conducts the following activities and the collection, sale, or licensing of brokered personal information incidental to conducting the activities:

(1) developing or maintaining third-party e-commerce or application platforms;

(2) providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier;

(3) collecting or transmitting information to be submitted to a State or federal agency for the purpose of performing a lawful check of criminal history record information using fingerprints or receiving the results of that check;

(4) collecting, maintaining, disclosing, selling, communicating, or using any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.

Section 10. Annual registration.

(a) Annually, on or before January 31, a data broker operating in this State shall register with the Attorney General.

(b) In registering with the Attorney General, a data broker shall pay a registration fee in an amount determined by the Attorney General, not to exceed the reasonable costs of establishing and maintaining the informational website described in Section 60. A data broker shall also provide the following information:

(1) the name of the data broker and its primary physical, email, and website addresses;

(2) whether the data broker collects the personal information of minors;

(3) whether the data broker collects consumers' precise geolocation;

(4) whether the data broker collects consumers' reproductive health care data;

(5) a link to a page on the data broker's website that does not make use of any dark patterns;

(6) whether, and to what extent, the data broker or any of its subsidiaries is regulated by any of the following:

(A) the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); and

(B) the Gramm-Leach-Bliley Act (Public Law 106-102) and its implementing regulations; and

(7) any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(d) The Attorney General shall create a page on its website where the registration information provided in subsection (c) shall be made accessible to the public.

(e) A data broker that fails to register as required by this Section shall be liable for civil penalties and costs in an action brought by the Attorney General as follows:

(1) a civil penalty of $200 for each day the data broker fails to register as required by this Section;

(2) an amount equal to the fees that were due during the period it failed to register; and

(3) expenses incurred by the Attorney General in the investigation and administration of the action as the court deems appropriate.

(f) All moneys received by the Attorney General under this Section shall be deposited into the Data Broker Registry Fund, a special fund created in the State treasury, and shall be used to administer and enforce this Act.

Section 15. Accessible deletion mechanism.

(a) No later than January 1, 2027, the Attorney General shall establish an accessible deletion mechanism that does the following:

(1) implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used and to protect consumers' personal information from unauthorized use, disclosure, access, destruction, or modification;

(2) allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor;

(3) allows a consumer to selectively exclude specific data brokers from a request made under paragraph (2); and

(4) allows a consumer to make a request to alter a previous request made under this subsection after at least 45 days have passed since the consumer last made a request under this Section.

(b) The accessible deletion mechanism established under subsection (a) shall meet the following requirements:

(1) allow a consumer to request the deletion of all personal information related to that consumer through a single deletion request;

(2) permit a consumer to securely submit information in one or more privacy-protecting ways determined by the Attorney General to aid in the deletion request;

(3) allow data brokers registered with the Attorney General to determine whether an individual has submitted a verifiable consumer request to delete the personal information related to that consumer as described in paragraph (1) and shall not allow the disclosure of any additional personal information when the data broker accesses the accessible deletion mechanism unless otherwise specified in this Act;

(4) allow a consumer to make a request described in paragraph (1) using an Internet service operated by the Attorney General;

(5) be accessible free of charge for a consumer to make a request described in paragraph (1);

(6) allow a consumer to make a request described in paragraph (1) in any language spoken by any consumer for whom personal information has been collected by data brokers;

(7) be readily accessible and usable by consumers with disabilities;

(8) support the ability of a consumer's authorized agents to aid in the deletion request;

(9) allow the consumer, or their authorized agent, to verify the status of the consumer's deletion request; and

(10) provide a description of the following:

(A) the deletion permitted by this Section;

(B) the process for submitting a deletion request under this Section; and

(C) examples of the types of information that may be deleted.

(c) Beginning on August 1, 2027, a data broker shall access the accessible deletion mechanism established under subsection (a) at least once every 45 days and do the following:

(1) within 45 days after receiving a request made under this Section, process all deletion requests made under this Section and delete all personal information related to the consumers making the requests consistent with the requirements of this Section;

(2) in cases where a data broker denies a consumer request to delete under this title because the request cannot be verified, process the request as an opt-out of the sale or sharing of the consumer's personal information;

(3) direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests described in paragraph (1); and

(4) direct all service providers or contractors associated with the data broker to process a request described by paragraph (2) as an opt-out of the sale or sharing of the consumer's personal information.

(d) Beginning on August 1, 2027, after a consumer has submitted a deletion request and a data broker has deleted the consumer's data as described in subsection (c), the data broker shall delete all personal information of the consumer at least once every 45 days unless the consumer requests otherwise or the deletion is not required.

(e) Beginning on August 1, 2027, after a consumer has submitted a deletion request and a data broker has deleted the consumer's data as described in subsection (c), the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or selling or sharing the personal information is permitted.

(e) Beginning on January 1, 2029, and every 3 years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with this Section. The data broker shall submit a report resulting from the audit and any related materials to the Attorney General within 5 business days after receiving a written request from the Attorney General. A data broker shall maintain the report resulting from the audit for at least 6 years.

(f) The Attorney General may charge an access fee to a data broker when the data broker accesses the accessible deletion mechanism that does not exceed the reasonable costs of providing that access to the accessible deletion mechanism.

Section 20. Enforcement. A violation of Section 15 of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to him or her for the enforcement of this Act.

Section 25. Enforcement. The Attorney General may adopt rules to implement and administer this Act.

Section 90. The State Finance Act is amended by adding Section 5.1030 as follows:

(30 ILCS 105/5.1030 new)

Sec. 5.1030. The Data Broker Registry Fund.

Section 95. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2HHHH as follows:

(815 ILCS 505/2HHHH new)

Sec. 2HHHH. Violations of the Data Broker Registration and Accessible Deletion Mechanism Act. A person who violates Section 15 of the Data Broker Registration and Accessible Deletion Mechanism Act commits an unlawful practice within the meaning of this Act.