Illinois House Passes Data Transparency and Privacy Act; Senate Passes KIDS Act

The Illinois state legislature may be the next state to pass a new privacy law, with the House and Senate separately approving bills to take action on privacy. The House passed HB 3358, the Data Transparency and Privacy Act, by a vote of 72-37. The Senate, by a vote of 39-14, passed the Keep Internet Devices Safe (KIDS) Act. Neither is a “comprehensive” privacy bill like the California Consumer Privacy Act or Washington Privacy Act, but each will require compliance adjustments by covered businesses if adopted.

Illinois Data Transparency and Privacy Act

This bill was initially introduced by Representative Arthur Turner and was passed by the House on a vote of 72-37. It primarily requires additional disclosures to consumers by website operators that meet certain thresholds.

Any private entity that owns an Internet website that collects personal information and satisfies one of three thresholds will be required to comply with the law. The thresholds include annual gross revenue of $25 million; receipt or sharing for commercial purposes of the personal information of 50,000 or more consumers; or derive 50+% of annual revenue from selling consumers’ personal information.

Transparency

The bill requires a number of disclosures in a consumer service agreement, incorporated addendum, or other readily accessible mechanism. The required disclosures, if passed, include:

– Identification of all categories of personal information processes about consumers collected through its website or online service.

– Identification of all categories of third parties with whom the operator may disclose the personal information;

– Disclose whether a third-party may collect PI over time and across different websites;

– If it exists, provide a description of the process to review and correct inaccurate personal information;

– Describe notification process for material changes to the required disclosures;

– State the effective date of the notice;

– Provide a description of the consumer’s rights.

Third-Party Disclosures

Right to Know – After the effective date of the law, an operator that discloses personal information to a third party shall make available free of charge upon receipt of a verified request (1) the categories of personal information disclosed; and (2) the categories of third parties and the approximate number of third parties that received the consumer’s personal information.

Right to Opt Out – If an operator sells personal information collected through the website or online service, it shall clearly and conspicuously post an opt out of the sale of the consumer’s personal information.

Enforcement – The law shall be enforced by the Attorney General and the legislation expressly indicates that there is no private right of action. If passed by the Senate, the law would go into effect on April 1, 2020.

Keep Internet Devices Safe or KIDS Act

The other privacy bill that gained traction in Illinois is the KIDS Act – SB 1719. It was introduced in February by Senator Cristina Castro (D-Elgin) and passed the Senate by a vote of 39-14 last week.

The Keep Internet Devices Safe Act requires a consumer to agree to a consumer agreement or privacy notice with certain requirements prior to an entity turning on or enabling the microphone on a digital device. The agreement must specify that the microphone will be enabled; the command to turn on or enable the microphone; the categories of sounds the microphone will be listening for, recording, or disclosing; and the categories of third parties to which the sounds may be disclosed.

The bill also requires a private entity that records and transmits personally identifiable information collected through the microphone to implement and maintain reasonable security measures.

Enforcement of the KIDS Act, if passed by the Illinois House, would be exclusively by the Illinois Attorney General.

Other Relevant Posts:

Maine Considering LD 946 to Protect Privacy of ISP Customers
Texas Considers Consumer Privacy Act and Privacy Protection Act
Update: Special Session of Appropriations Committee Saves Washington Privacy Act for Another Week
No Washington Privacy Act This Year?
Washington Privacy Act – Initial Look at the Current House Version
Summary of Connecticut SB 1108 on Data Privacy
Summary of Public Hearings on Maryland Online Consumer Protection Act
Summary of Washington Privacy Act After State Senate Passes
Florida Legislature Considers Biometric Information Privacy Act
Maryland Considering SB613 / HB0901 – Online Consumer Protection Act
With SD341, Massachusetts Joins States Considering CCPA-like Data Privacy Laws
Public Hearing on Washington Privacy Act (SSB 5376) in Senate Ways & Means – More Work to Be Done?
State CCPA Privacy Bills in Rhode Island, Hawaii and New Jersey
North Dakota Considers Study on Privacy Practices of Data Brokers

More Resources:

Read the resources Clarip has posted on the California Consumer Privacy Act (CCPA) and contact us to see a demo of the Clarip privacy management platform used by Fortune 500 clients.