HB2880 102ND GENERAL ASSEMBLY

LRB102 13250 JLS 18594 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
HB2880

Introduced 2/19/2021, by Rep. Deanne M. Mazzochi

SYNOPSIS AS INTRODUCED:

815 ILCS 530/22 new

Amends the Personal Information Protection Act. Provides that individuals and entities have intellectual property rights in their digital identity assets. Provides for the payment of royalties to individuals and entities for access, for the purpose of commercial advertising, to their digital assets. Authorizes civil actions for actual damages and statutory damages. Limits liability of State and local government. Defines terms.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Personal Information Protection Act is amended by adding Section 22 as follows:

(815 ILCS 530/22 new)

Sec. 22. Digital Identity Assets and Royalties.

(a) This Section may be referred to as the Digital Identity Assets and Royalties Act or the DIARies Law.

(b) Findings.

(1) There is a considerable amount of information about an individual that renders that individual unique. This includes, but is not limited to, information involving one's family, partner and social relationships, education, medical history, personal tastes, preferences, travel history, associations, and interests.

(2) In an earlier age, information about an individual would have been known to a personal diary and to a comparatively limited few relative to the rest of the population. The information would have been recorded in paper documents that could not readily be accessed without the author's knowledge. The process of creating a "picture" of someone's life, including for advertising purposes, would have involved considerable time, laborious efforts, and individual effort to cultivate this information involving knowledge and networks.

(3) In the digital age, participation in modern life and devices requires an individual to surrender, often without the person's active, knowledgeable, and fully willing consent, detailed information about an individual's life. "Consent" is given in the form of adhesion contracts, where the individual is powerless to negotiate and take action to protect personal privacy interests. Particularly where the party demanding consent has its own disproportionate market power, such as online search engines, social media companies, or payment processors, to not participate is to itself deny participation in modern life, or the public square. It similarly provides disproportionate power to demand adherence to their terms at risk of "deplatforming".

(4) Thus, access to a person's individualized digital "footprint", in an age where data collection and storage can be of virtually unlimited size, scope, and scale, by use of computer algorithms and machine learning, and digital computing technologies that allow advertisers to record and track highly granular, individualized information, has considerably changed the dynamics that ordinarily worked to more generally protect an individual's personal privacy from access, intrusion, or abuse of informational power by unknown third parties.

(5) The General Assembly finds that, just as State laws have been put in place to protect the value of intangible assets such as goodwill, brand recognition, trademarks, trade secrets, and the like, it is also necessary for states to protect an individual's intellectual property rights to their digital identity assets.

(6) The General Assembly further finds that, in view of the unrelenting ability of digital computing power to gather, process, and store data and to target persons or entities at will, individuals, even if efforts are made to assemble them together in a class action lawsuit, will have difficulty assembling the resources to combat unwanted or unauthorized access to the details of each individual's life and to protect their data and lived experiences from intrusion.

(7) The General Assembly further finds that current government efforts to ensure enforcement of abusive powers through the public sector legal process is slow, inefficient, and insufficient to provide individuals with adequate relief.

(8) Thus, the General Assembly finds that both statutory damages and a royalty system is necessary to protect an individual's digital identity and assets.

(c) An individual or entity that is a lawful resident of the State of Illinois for a period of at least 30 days is covered by this Act.

(d) Individuals and entities have an intellectual property right to exclusively make, use, or sell their digital assets. "Digital assets" include, but are not limited to, information accumulated regarding an individual's or entity's personal information, which includes, but is not limited to, the individual's or entity's family lists, friends lists, associates lists, relationship histories, customer lists, writings, photographs, personal interests, personal history, educational history, employment history, medical history (including RNA and DNA profiles and genetic history), purchase history, voter history, and the like. The concept of a digital asset exclusive to an individual or entity should be construed broadly to encompass any information that could have commercial value to a third-party data mining or advertising company for purposes of creating a digital identity for that individual or entity.

(e) After December 31, 2022, any access of an individual's digital assets for purposes of commercial advertising to that individual requires the digital search engine or advertising platform that is accessing the individual's device to pay the individual a royalty for access to that device. Unless the individual sets a higher royalty threshold, which amount may not to exceed $1 per advertisement per day for passive advertisements, for his or her device, the presumptive royalty shall be $0.01 per advertisement displayed. These amounts shall be re-indexed and adjusted to account for inflation or deflation on January 1, 2030, and every 10 years thereafter.

(f) Any access of an individual's or entity's digital assets by a third party that is seeking to gather information from the individual or entity for purposes of database collection, without the express written consent of an individual, is a presumptive infringement on an individual's or entity's digital assets. In the event of such infringement:

(1) The affected individual or entity is entitled to recover (A) the actual damages suffered by the individual or entity as a result of the continued infringement of the individual's or entity's intellectual property right and any profits of the infringer that are attributable to the infringement from the breach and (B) statutory damages in the amount of $3,000 per year per breach for a period of 5 years.

(2) The burden of proof is on the owner of the digital assets to present evidence only of the infringer's gross profits. The infringer is required to prove his or her deductible expenses and elements of profit not attributable to factors associated with the breach and infringement of the digital assets or privacy rights.

(3) It is a separate act of unfair competition for a third-party platform that has accessed digital assets of an individual or entity to threaten to or actually deplatform an individual or entity, absent notice and a one-year period within which to transition to another third-party platform site. If no other comparable third-party platform sites are available, the third-party platform shall continue to host the individual or entity on the same terms offered to comparable individuals or entities.

(4) If the perpetrator of an unauthorized acquisition cannot be found, any entity holding or transmitting the breached digital asset may be responsible for such liability.

(5) Nothing in this Section may be construed as imposing liability on a unit of State or local government that is required or otherwise permitted by law to collect, record, or access data of a personal nature in accordance with carrying out its ordinary governmental functions, unless such unit of State or local government intentionally, or with gross negligence, allows its databases holding information about individuals or entities to be breached to the damage and harm of an individual or entity.

(g) Interactive computer services civil action.

(1) As used in this Section:

(A) "Deplatform" means efforts by an interactive computer servicer, or employees thereof, to restrict, censor, suppress, shadowban, modify computer algorithms, or otherwise prohibit access to the Internet, educational resources, or a social media site.

(B) "Interactive computer service" means any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including a computer server that provides access to the Internet, or that is offered by libraries or educational institutions, that has claimed immunity from civil liability under federal law, that does not call itself a publisher, or that has taken the position in the public record that it is not a publisher, and has over 1,000,000 users.

(C) "Social media site" means a website through which users are able to share and generate content and find and connect with other users of common interests.

(2) If an interactive computer service seeks to deplatform an individual or entity that is a legal resident of this State at the time the deplatforming activity occurs and had or held digital assets with the interactive computer service or had or held digital assets accessed by the interactive computer service, then the individual or entity may bring an action for civil damages in the circuit court in the county where the individual being deplatformed resides or in a jurisdiction where an individual who reasonably would have otherwise received the writing, speech, or publication of the deplatformed individual or entity resides. Attorney's fees shall be awarded to a prevailing plaintiff.

(3) It is an affirmative defense by the interactive computer service that the restricted access was reasonable because:

(A) The deplatformed writing, speech, or publication was due to a good faith, objectively reasonable belief that the deplatformed material was obscene, lewd, lascivious, filthy, or excessively violent in violation of law; or, if permitted, would have violated State or federal law.

(B) The interactive computer service is a publisher.