SB1607sam001 102ND GENERAL ASSEMBLY

Sen. Bill Cunningham

Filed: 3/16/2021

10200SB1607sam001 LRB102 15852 LNS 23379 a

AMENDMENT TO SENATE BILL 1607

AMENDMENT NO. ______. Amend Senate Bill 1607 by replacing everything after the enacting clause with the following:

"Section 5. The Biometric Information Privacy Act is amended by changing Section 10 and by adding Sections 35 and 40 as follows:

(740 ILCS 14/10)

Sec. 10. Definitions. In this Act:

"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.

"Biometric information" means any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.

"Confidential and sensitive information" means personal information that can be used to uniquely identify an individual or an individual's account or property. Examples of confidential and sensitive information include, but are not limited to, a genetic marker, genetic testing information, a unique identifier number to locate an account or property, an account number, a PIN number, a pass code, a driver's license number, or a social security number.

"Private entity" means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A private entity does not include a State or local government agency. A private entity does not include any court of Illinois, a clerk of the court, or a judge or justice thereof.

"Security purpose" means for the purpose of preventing shoplifting, fraud, or any other misappropriation or theft of a thing of value, including tangible and intangible goods and services, and other purposes in furtherance of protecting the security or integrity of software, accounts, applications, online services, property, or any person, including, but not limited to, protecting property from trespass, controlling access to property, and protecting any person from stalking, violence, or harassment.

"Written release" means informed written or electronic consent or, in the context of employment, a written or electronic release executed by an employee as a condition of employment.

(Source: P.A. 95-994, eff. 10-3-08.)

(740 ILCS 14/35 new)

Sec. 35. Violation of Act. The Attorney General and State's Attorneys have the sole authority to enforce this Act. An action may be brought to enforce this Act only if a violation of this Act causes actual harm.

(740 ILCS 14/40 new)

Sec. 40. Exemptions.

(a) A private entity is exempt under this Act if the private entity collects, captures, obtains, or otherwise uses biometric identifiers and biometric information for:

(1) keeping record of an employee's work hours;

(2) a security purpose;

(3) facility access, including, but not limited to, the restriction of access to certain locations; or

(4) use by the human resource department or human resource employees of the private entity.

(b) Notwithstanding subsection (a) of Section 15, a private entity is exempt under this Act if the private entity retains the biometric identifier or information no longer than is reasonably necessary to satisfy a security purpose.".