Public Act 103-0769

SB2979 EnrolledLRB103 36771 JRC 66881 b


 AN ACT concerning civil law.

 Be it enacted by the People of the State of Illinois, 
represented in the General Assembly:

 Section 5. The Biometric Information Privacy Act is 
amended by changing Sections 10 and 20 as follows:

 (740 ILCS 14/10)
 Sec. 10. Definitions. In this Act:
 "Biometric identifier" means a retina or iris scan, 
fingerprint, voiceprint, or scan of hand or face geometry. 
Biometric identifiers do not include writing samples, written 
signatures, photographs, human biological samples used for 
valid scientific testing or screening, demographic data, 
tattoo descriptions, or physical descriptions such as height, 
weight, hair color, or eye color. Biometric identifiers do not 
include donated organs, tissues, or parts as defined in the 
Illinois Anatomical Gift Act or blood or serum stored on 
behalf of recipients or potential recipients of living or 
cadaveric transplants and obtained or stored by a federally 
designated organ procurement agency. Biometric identifiers do 
not include biological materials regulated under the Genetic 
Information Privacy Act. Biometric identifiers do not include 
information captured from a patient in a health care setting 
or information collected, used, or stored for health care 
treatment, payment, or operations under the federal Health 
Insurance Portability and Accountability Act of 1996. 
Biometric identifiers do not include an X-ray, roentgen 
process, computed tomography, MRI, PET scan, mammography, or 
other image or film of the human anatomy used to diagnose, 
prognose, or treat an illness or other medical condition or to 
further validate scientific testing or screening.
 "Biometric information" means any information, regardless 
of how it is captured, converted, stored, or shared, based on 
an individual's biometric identifier used to identify an 
individual. Biometric information does not include information 
derived from items or procedures excluded under the definition 
of biometric identifiers.
 "Confidential and sensitive information" means personal 
information that can be used to uniquely identify an 
individual or an individual's account or property. Examples of 
confidential and sensitive information include, but are not 
limited to, a genetic marker, genetic testing information, a 
unique identifier number to locate an account or property, an 
account number, a PIN number, a pass code, a driver's license 
number, or a social security number.
 "Electronic signature" means an electronic sound, symbol, 
or process attached to or logically associated with a record 
and executed or adopted by a person with the intent to sign the 
record.
 "Private entity" means any individual, partnership, 
corporation, limited liability company, association, or other 
group, however organized. A private entity does not include a 
State or local government agency. A private entity does not 
include any court of Illinois, a clerk of the court, or a judge 
or justice thereof.
 "Written release" means informed written consent, 
electronic signature, or, in the context of employment, a 
release executed by an employee as a condition of employment.
(Source: P.A. 95-994, eff. 10-3-08.)

 (740 ILCS 14/20)
 Sec. 20. Right of action. 
 (a) Any person aggrieved by a violation of this Act shall 
have a right of action in a State circuit court or as a 
supplemental claim in federal district court against an 
offending party. A prevailing party may recover for each 
violation:
  (1) against a private entity that negligently violates 
 a provision of this Act, liquidated damages of $1,000 or 
 actual damages, whichever is greater;
  (2) against a private entity that intentionally or 
 recklessly violates a provision of this Act, liquidated 
 damages of $5,000 or actual damages, whichever is greater;
  (3) reasonable attorneys' fees and costs, including 
 expert witness fees and other litigation expenses; and
  (4) other relief, including an injunction, as the 
 State or federal court may deem appropriate.
 (b) For purposes of subsection (b) of Section 15, a 
private entity that, in more than one instance, collects, 
captures, purchases, receives through trade, or otherwise 
obtains the same biometric identifier or biometric information 
from the same person using the same method of collection in 
violation of subsection (b) of Section 15 has committed a 
single violation of subsection (b) of Section 15 for which the 
aggrieved person is entitled to, at most, one recovery under 
this Section.
 (c) For purposes of subsection (d) of Section 15, a 
private entity that, in more than one instance, discloses, 
rediscloses, or otherwise disseminates the same biometric 
identifier or biometric information from the same person to 
the same recipient using the same method of collection in 
violation of subsection (d) of Section 15 has committed a 
single violation of subsection (d) of Section 15 for which the 
aggrieved person is entitled to, at most, one recovery under 
this Section regardless of the number of times the private 
entity disclosed, redisclosed, or otherwise disseminated the 
same biometric identifier or biometric information of the same 
person to the same recipient. 
(Source: P.A. 95-994, eff. 10-3-08.)