HB0112ham001 102ND GENERAL ASSEMBLY

Rep. Joe Sosnowski

Filed: 3/19/2021

10200HB0112ham001 LRB102 04132 RAM 23452 a

AMENDMENT TO HOUSE BILL 112

AMENDMENT NO. ______. Amend House Bill 112 by replacing everything after the enacting clause with the following:

"Section 5. The Toll Highway Act is amended by changing Section 19.1 as follows:

(605 ILCS 10/19.1)

Sec. 19.1. Confidentiality of personally identifiable information obtained through electronic toll collection system.

(a) For purposes of this Section:

"Electronic toll collection system" is a system where a transponder, camera-based vehicle identification system, or other electronic medium is used to deduct payment of a toll from a subscriber's account or to establish an obligation to pay a toll.

"Electronic toll collection system user" means any natural person who subscribes to an electronic toll collection system or any natural person who uses a tolled transportation facility that employs the Authority's electronic toll collection system.

"Personally identifiable information" means any information that identifies or describes an electronic toll collection system user, including but not limited to travel pattern data, address, telephone number, e-mail address, license plate number, photograph, bank account information, or credit card number.

(b) Except as otherwise provided in this Section, the Authority may not sell or otherwise provide to any person or entity personally identifiable information of any electronic toll collection system user that the Authority obtains through the operation of its electronic toll collection system.

(c) The Authority may, within practical business and cost constraints, store personally identifiable information of an electronic toll collection system user only if the information is required to perform account functions such as billing, account settlement, or toll violation enforcement activities. Records identifying a specific instance of travel by a specific person or vehicle shall be used only as required to ensure the payment and enforcement of tolls and for law enforcement purposes.

(d) By no later than December 31, 2011, the Authority shall establish a privacy policy regarding the collection and use of personally identifiable information. Upon its adoption, the policy shall be posted on the Authority's website and a copy shall be included with each transponder transmitted to a user. The policy shall include but need not be limited to the following:

(1) A description of the types of personally identifiable information collected by the Authority.

(2) The categories of third-party persons or entities with whom the Authority may share personally identifiable information and for what purposes that information is shared.

(3) The process by which the Authority notifies electronic toll collection system users of material changes to its privacy policy.

(4) The process by which an electronic toll collection system user may review and request changes to any of his or her personally identifiable information.

(5) The effective date of the privacy policy.

(e) This Section does not prohibit the Authority from:

(1) providing aggregated traveler information derived from collective data relating to a group or category of electronic toll collection system users from which personally identifiable information has been removed;

(2) sharing data with another transportation agency or third-party vendor to comply with interoperability specifications and standards regarding electronic toll collection devices and technologies, provided that the other transportation agency or third-party vendor may not use personally identifiable information obtained under this Section for a purpose other than described in this Section;

(3) performing financial, legal and accounting functions such as billing, account settlement, toll violation enforcement, or other activities required to operate and manage its toll collection system;

(4) communicating about products and services offered by itself, a business partner, or another public agency;

(5) using personally identifiable information in research projects, provided that appropriate confidentiality restrictions are employed to protect against the unauthorized release of such information;

(6) releasing personally identifiable information in response to a warrant, grand jury, subpoena, or lawful order from a court of competent jurisdiction in accordance with the following:

(A) No party to any proceeding, nor his or her attorney, shall serve a subpoena seeking to obtain access to records or communications under this Act unless the subpoena is accompanied by a written order issued by a judge, or by the written consent of the person whose records are being sought, authorizing the disclosure of the records or the issuance of the subpoena.

(B) No such written order shall be issued without written notice of the motion to the person whose personally identifiable information is being sought.

(C) Prior to the issuance of the order, each party or other person entitled to notice shall be permitted an opportunity to be heard.

(D) In the absence of the written consent under this Act of the person whose records are being sought, the Authority shall not comply with a subpoena for records or communications under this Act unless the subpoena is accompanied by a written order authorizing the issuance of the subpoena or the disclosure of the records. Each subpoena issued by a court or administrative agency shall include the following language: "The Authority shall not comply with a subpoena for personally identifiable information unless the subpoena is accompanied by a written order that authorizes the issuance of the subpoena and the disclosure of records or communications or by the written consent under of the person whose records are being sought.";

(7) releasing personally identifiable information to law enforcement agencies if exigent circumstances make in the case of an emergency when obtaining a warrant or subpoena would be impractical; and

(8) releasing personally identifiable information to the Authority's Inspector General or, at the Inspector General's direction, to law enforcement agencies under paragraphs (5) and (6) of subsection (f) of Section 8.5 of this Act.

(f) In any agreement allowing another public entity to use the Authority's toll collection system in a transportation facility, the Authority shall require the other public entity to comply with the requirements of this Section.

(g) Personally identifiable information generated through the Authority's toll collection process that reveals the date, time, location or direction of travel by an electronic toll collection system user shall be exempt from release under the Illinois Freedom of Information Act and the information shall be used for enforcement purposes with respect to toll collections as specified in this Act and any action brought by a prosecutor acting in such a capacity. The exemption in this subsection shall not apply to information that concerns (i) the public duties of public employees and officials; (ii) whether an electronic toll collection system user has paid tolls; (iii) whether the Authority is enforcing toll violation penalties against electronic toll collection users who do not pay tolls; (iv) accidents or other incidents that occur on highways under the jurisdiction of the Authority; or (v) the obligation, receipt, and use of the funds of the Authority. The exemption in this subsection (g) shall not be a limitation or restriction on other Freedom of Information Act exemptions applicable to personally identifiable information or private information.

(h) The Authority shall make personally identifiable information of a person available to any State or local agency, inspector general, or law enforcement agency in response to a grand jury subpoena or pursuant to an investigation.

(i) The Authority shall discard personally identifiable information within 5 years. The Authority shall make every effort, within practical business and cost constraints, to purge the personal account information of an account that is closed or terminated. In no case shall the Authority maintain personal information more than 5 years after the date an account is closed or terminated.

(j) Nothing in this Section precludes compliance with a court order that has been issued or settlement agreement that has been approved on or before January 1, 2022.

(Source: P.A. 97-342, eff. 8-12-11.)

Section 99. Effective date. This Act takes effect upon becoming law.".