Processes biometric data, in Illinois

815 ILCS 530/1 et seq. (P.A. 94-36, eff. 1 January 2006) · Read the law's page

• Notify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual.
• Notify the Illinois Attorney General once a single breach requires you to notify more than 500 Illinois residents, in the most expedient time possible and without unreasonable delay, and in no event later than when you notify those residents.
• If you are a HIPAA covered entity or business associate that notifies the federal Secretary of Health and Human Services of a breach, notify the Illinois Attorney General within 5 business days of notifying the Secretary.
• If you are a State agency, notify the Illinois Attorney General within 45 days of discovering a single breach affecting more than 250 Illinois residents, or when you first notify residents if that is sooner, unless you have good cause for reasonable delay.for a public body
• If you are a State agency directly responsible to the Governor, notify the Chief Information Security Officer of the Department of Innovation and Technology and the Attorney General without delay, and no later than 72 hours after discovering a breach affecting more than 250 Illinois residents or an instance of aggravated computer tampering.for a public body
• If you are a State agency that has had a breach, report it to the General Assembly within 5 business days of discovering or being notified of the breach, listing the breaches and the corrective measures taken.for a public body
• If you are a State agency and you determine who perpetrated a breach, report that to the General Assembly within 5 days after the determination, unless the report would jeopardize the security of Illinois residents or compromise a security investigation.for a public body

815 ILCS 530/40 (P.A. 97-483, eff. 1 January 2012) · Read the law's page

• This binds any person, including a natural person, a corporation, another legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident, except a financial institution regulated under Gramm-Leach-Bliley Act Title V or a person subject to the disposal rule at 15 U.S.C. 1681w.
• Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.
• As a third party contracted by a person to dispose of the materials, implement and monitor compliance with policies and procedures that prohibit unauthorized access to, acquisition of, or use of personal information during collection, transportation, and disposal.
• A violation carries a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard; Section 20 separately deems a violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening the Attorney General's and a private plaintiff's remedies under 815 ILCS 505/7 and 505/10a as well.

815 ILCS 530/45 (P.A. 99-503, eff. 1 January 2017) · Read the law's page

• Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• Require, by contract, that any party to whom personal information is disclosed also implement and maintain reasonable security measures over it.
• This binds any data collector, including a government agency, a public or private university, or a privately or publicly held corporation, that owns, licenses, maintains, or stores records containing personal information about an Illinois resident.
• A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law that requires greater protection, is deemed to comply with this duty.
• There is no dedicated penalty for this section; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to a private action for actual damages and attorneys' fees under 815 ILCS 505/10a and to an Attorney General action for injunctive relief and a civil penalty of up to $50,000, or up to $50,000 per violation where the court finds intent to defraud, under 815 ILCS 505/7.

740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended by P.A. 103-769, eff. Aug. 2, 2024) · Read the law's page

• Do not scrape photographs from the open web to derive facial geometry, or collect voiceprints, without first informing the subject in writing and obtaining a written release; the statute's consent duty attaches to your own act of collection regardless of whether the source page was public.
• A written release now includes an electronic signature under the 2024 amendment, so a properly executed electronic consent flow satisfies section 15(b).
• Even where you collect the same biometric identifier from the same person more than once by the same method, you face at most one statutory recovery per person per method under the 2024 amendment, not a per-scan multiplier.

740 ILCS 14/1, 14/5, 14/10, 14/15, 14/25 (P.A. 95-994, eff. 3 October 2008, as amended by P.A. 103-0769, eff. 2 August 2024) · Read the law's page

• Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.
• Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.
• Never sell, lease, trade, or otherwise profit from a biometric identifier or biometric information, and disclose it only with consent, for a transaction the subject requested, or as required by law or a valid warrant or subpoena.

740 ILCS 14/20, as amended by P.A. 103-0769 (SB 2979), eff. 2 August 2024 · Read the law's page

• Expect a private right of action for any BIPA violation, carrying statutory damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation, or actual damages if greater, plus attorneys' fees and litigation costs.
• Treat repeated collection or disclosure of the same biometric identifier from the same person by the same method as a single violation carrying at most one recovery, including for conduct that predates August 2, 2024.