SB2978 103RD GENERAL ASSEMBLY

LRB103 37104 MXP 67223 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB2978

Introduced 1/31/2024, by Sen. Sara Feigenholtz

SYNOPSIS AS INTRODUCED:

See Index

Amends the Illinois Vehicle Code. Creates the Driver and Motor Vehicle Records Data Privacy Law. Provides that the purpose is to comply with the federal Driver's Privacy Protection Act of 1994 in order to protect the interest of individuals in their personal privacy by prohibiting the disclosure and use of personal information contained in their motor vehicle record, except as authorized by the individual or by law. Adds provisions concerning: disclosure of social security number; confidentiality of captured photographs, signatures, and images; confidentiality of documents submitted with applications for driver's licenses and vehicle transactions; restrictions on use of information for immigration enforcement; disclosure with consent; permitted disclosures; fees; commercial requesters; access agreements; audits; redisclosures; prohibitions and violations; data system security breaches; procedural safeguards; and rules. Repeals provisions of the Illinois Vehicle Code regarding confidentiality of captured photographs and images; confidentiality of documents submitted with an application for a driver's license; restrictions on use of information; and sale and distribution of information.

A BILL FOR

AN ACT concerning transportation.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Illinois Vehicle Code is by changing Section 1-100 and adding Article 2A as follows:

(625 ILCS 5/1-100) (from Ch. 95 1/2, par. 1-100)

Sec. 1-100. Short Title. This Act may be cited as the Illinois Vehicle Code.

Portions of this Act may likewise be cited by a short title as follows:

Chapters 2, 3, 4 and 5: the Illinois Vehicle Title & Registration Law.

Chapter 2A: the Driver and Motor Vehicle Record Data Privacy Law.

Chapter 6: the Illinois Driver Licensing Law.

Chapter 7: the Illinois Safety and Family Financial Responsibility Law.

Chapter 11: the Illinois Rules of the Road.

Chapter 12: the Illinois Vehicle Equipment Law.

Chapter 13: the Illinois Vehicle Inspection Law.

Chapter 14: the Illinois Vehicle Equipment Safety Compact.

Chapter 15: the Illinois Size and Weight Law.

Chapter 17: the Illinois Highway Safety Law.

Chapter 18a: the Illinois Commercial Relocation of Trespassing Vehicles Law.

Chapter 18b: the Illinois Motor Carrier Safety Law.

Chapter 18c: the Illinois Commercial Transportation Law.

Chapter 18d: The Illinois Commercial Safety Towing Law.

(Source: P.A. 95-562, eff. 7-1-08.)

(625 ILCS 5/Ch. 2A heading new)

CHAPTER 2A. DRIVER AND MOTOR VEHICLE RECORD PRIVACY

(625 ILCS 5/2A-101 new)

Sec. 2A-101. Statement of intent and purpose. The purpose of this Chapter is to comply with the federal Driver's Privacy Protection Act of 1994 in order to protect the interest of individuals in their personal privacy by prohibiting the disclosure and use of personal information contained in their motor vehicle record, except as authorized by the individual or by law.

(625 ILCS 5/2A-102 new)

Sec. 2A-102. Definitions. As used in this Chapter:

"Access agreement" means an agreement between the Secretary and any person, governmental entity, or private party for access to the Secretary of State's electronic motor vehicle records.

"Breach of the security of the system data" or "breach" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personally identifying information maintained by an authorized recipient. "Breach of the security of the system data" does not include good faith acquisition of personally identifying information by an employee or agent of the authorized recipient for an authorized purpose under this Chapter if the personally identifying information is not used for a purpose unrelated to the authorized purpose for which the personal identifying information as obtained or subject to further unauthorized disclosure.

"Disclose" means to engage in any practice or conduct to make available and make known personal information contained in a motor vehicle record about a person to any person, organization, or entity, by any means of communication.

"Motor vehicle record" means any record that pertains to a motor vehicle operator's permit, including, but not limited to, a commercial learner's permit, driver's license, instruction permit, monitoring device driving permit, probationary license or restricted driving permit, motor vehicle title, motor vehicle registration, or identification card issued by the Secretary of State.

"Private party" means any natural person, firm, co-partnership, association, or business entity other than a governmental entity.

"Private toll transportation facility" means any toll operated or maintained on the roads, highways, or interstates by a nongovernmental entity.

"Requester" means a person, private party, or governmental entity requesting motor vehicle records or other information from the Secretary of State.

(625 ILCS 5/2A-103 new)

Sec. 2A-103. Prohibition on disclosure of social security number.

(a) The Secretary shall not disclose a social security number provided to the Secretary of State in connection with a motor vehicle record, whether an applicant provided a social security number, or any associated information obtained from the Social Security Administration except pursuant to a written request by, or with the prior written consent of, the individual, except:

(1) to officers and employees of the Secretary who have a need to know the social security numbers in performance of their official duties;

(2) to law enforcement officials for a civil or criminal law enforcement investigation, and if an officer of the law enforcement agency has made a written request to the Secretary specifying the law enforcement investigation for which the social security numbers are being sought, though the Secretary retains the right to require additional verification regarding the validity of the request;

(3) to the United States Department of Transportation or any other state, pursuant to the administration and enforcement of the Commercial Motor Vehicle Safety Act of 1986 or participation in state-to-state verification service;

(4) pursuant to the order of a court of or a subpoena issued by a court;

(5) to the Department of Healthcare and Family Services for utilization in the child support enforcement duties assigned to that Department under provisions of the Illinois Public Aid Code after the individual has received advanced notification of what redisclosure is sought by the Secretary in accordance with the federal Privacy Act;

(6) to the Department of Healthcare and Family Services and the Department of Human Services solely for the purpose of verifying identity and Illinois residency where such residency is an eligibility requirement for benefits under the Illinois Public Aid Code or any other health benefit program administered by the Department of Healthcare and Family Services or the Department of Human Services;

(7) to the Illinois Department of Revenue solely for use by the Department in the collection of any tax or debt that the Department of Revenue is authorized or required by law to collect, provided that the Department shall not disclose the social security number to any person or entity outside the Department;

(8) to the Illinois Department of Veterans' Affairs for the purpose of confirming veteran status;

(9) the last 4 digits to the Illinois State Board of Elections for purposes of voter registration and as may be required pursuant to an agreement for a multi-state voter registration list maintenance system. If social security information is disclosed by the Secretary in accordance with this Section, no liability shall rest with the Office of the Secretary of State or any of its officers or employees, as the information is released for official purposes only; or

(10) to the United States Selective Service for purposes of Selective Service registration.

(b) An Illinois governmental agency that receives an individual's social security number under subsection (a) of this Section may not redisclose the social security number except as required by law. An Illinois governmental agency that rediscloses a social security number as authorized by this subsection shall maintain records for a minimum of 5 years that identify every entity to which the government agency provided the social security number. Records kept in accordance with this subsection must be made available to the Secretary upon request.

(c) Nothing in this Section prohibits an individual from having access to that individual's own social security number that was provided to the Secretary in connection with a motor vehicle record.

(d) Knowingly obtaining or using a social security number from a motor vehicle record in violation of this Section is a Class A misdemeanor.

(e) Any person who uses or acquires a social security number in violation of this Section that subjects the Secretary to any liability or claim shall indemnify and hold harmless the Secretary from all such liabilities and claims, including attorney fees and court costs, incurred in any action.

(625 ILCS 5/2A-104 new)

Sec. 2A-104. Confidentiality of captured photographs, signatures, or images.

(a) The Secretary of State shall maintain all photographs, signatures and images obtained in the process of issuing a driver's license, permit, identification card, or in connection to a Certificate of Title or vehicle registration. Except as otherwise provided in this Section, the photographs, signatures, and images shall be confidential and shall not be disclosed except to the following persons:

(1) the individual upon written request;

(2) officers and employees of the Secretary of State who have a need to have access to the stored photographs, signatures, and images for purposes of issuing and controlling driver's licenses, permits, or identification cards and investigation of fraud or misconduct;

(3) law enforcement officials for a civil or criminal law enforcement investigation;

(4) the State Board of Elections for the sole purpose of providing the signatures required by a local election authority to register a voter through an online voter registration system;

(5) officers and employees of the Secretary of State who have a need to have access to the stored photographs, signatures, and images for purposes of issuing and controlling notary public commissions and for the purpose of providing the signatures required to process online applications for appointment and commission as notaries public; or

(6) other entities that the Secretary may authorize by rule.

(b) The Secretary of State shall not provide facial recognition search services or photographs obtained in the process of issuing a driver's license or permit to any federal, state, or local law enforcement agency or other governmental entity for the purpose of enforcing federal immigration laws and in accordance with Section 2A-106. This subsection shall not apply to requests from federal, state, or local law enforcement agencies or other governmental entities for facial recognition search services or photographs obtained in the process of issuing a driver's license or permit when the purpose of the request relates to criminal activity other than violations of immigration laws.

(625 ILCS 5/2A-105 new)

Sec. 2A-105. Confidentiality of documents submitted with an application for driver's licenses and vehicle transactions. Documents required to be submitted with an application for a Certificate of Title, vehicle registration, or driver's license to prove the applicant's identity (name and date of birth), social security number or lack of a social security number, written signature, residency, and, as applicable, citizenship or immigration status and country of citizenship shall be confidential and shall not be disclosed except to the following persons:

(1) the individual to whom the Certificate of Title, vehicle registration, or driver's license or permit was issued, upon written request;

(2) officers and employees of the Secretary of State who have a need to access the stored photographs, signatures, and images for purposes of issuing and controlling vehicle titling or vehicle registration, driver's licenses, permits, or identification cards and investigation of fraud or misconduct;

(3) law enforcement officials for a civil or criminal law enforcement investigation, except as restricted by this Chapter;

(4) other entities that the Secretary may authorize by rule.

(625 ILCS 5/2A-106 new)

Sec. 2A-106. Restrictions on use of information for immigration enforcement.

(a) Notwithstanding any other provision of law, the Secretary may not release or make accessible in any manner any highly restricted personal information as defined in Section 1-125.9 or personally identifying information as defined in Section 1-159.2, provide images, photos, or facial recognition services as described in Section 2A-104 or disclose documents as described in Section 2A-105 to any immigration agent as defined in Section 10 of the Illinois TRUST Act, unless necessary to comply with the following, to the extent that production of such information or documents is specifically required:

(1) a lawful court order;

(2) a judicial warrant signed by a judge appointed pursuant to Article III of the Constitution of the United States; or

(3) a subpoena for individual records issued by a federal or State court.

When responding to such a court order, warrant, or subpoena, the Secretary shall disclose only those documents or information specifically requested. Within 3 business days after receiving such a court order, warrant, or subpoena, the Secretary shall send a notification to the individual about whom such information was requested that a court order, warrant, or subpoena was received and the identity of the entity that presented the court order, warrant, or subpoena.

(b) The Secretary shall not enter into or maintain any agreement regarding the sharing of any highly restricted personal information as defined in Section 1-125.9, personally identifying information as defined in Section 1-159.2, images or photos described in Section 6-110.1, or documents described in Section 6-110.2 unless all other parties to such agreement certify that the information obtained will not be used for civil immigration purposes or knowingly disseminated to any third party for any purpose related to civil immigration enforcement.

(625 ILCS 5/2A-107 new)

Sec. 2A-107. Confidentiality of documents submitted with an application for a driver's license. Documents required to be submitted with an application for a driver's license to prove the applicant's identity (name and date of birth), social security number or lack of a social security number, written signature, residency, and, as applicable, citizenship or immigration status and country of citizenship shall be confidential and shall not be disclosed except to the following persons:

(1) the individual to whom the driver's license or permit was issued, upon written request;

(2) officers and employees of the Secretary of State who have a need to have access to the stored photographs, signatures and images for purposes of issuing and controlling driver's licenses, permits, or identification cards and investigation of fraud or misconduct;

(3) law enforcement officials for a civil or criminal law enforcement investigation, except as restricted by Section 2A-106;

(4) other entities that the Secretary may authorize by rule.

(625 ILCS 5/2A-108 new)

Sec. 2A-108. Disclosure with consent. Personally identifying information as defined in this Code may be disclosed upon request if the person making the request is the subject of the information or the person making the request demonstrates in such form and manner as the Secretary prescribes that the person has obtained the written consent of the person who is the subject of the information.

(625 ILCS 5/2A-109 new)

Sec. 2A-109. Permitted disclosures.

(a) Except as otherwise provided in this Section, the Secretary may make the driver's license, vehicle and title registration lists, in part or in whole, and any statistical information derived from these lists available to local governments, elected State officials, State educational institutions, and all other governmental units of the State or federal government requesting them for governmental purposes. The Secretary shall require any such applicant for services to pay for the costs of furnishing such services and in addition is empowered to establish prices and charges for the services so furnished.

(b) The Secretary is further empowered to and may, in the Secretary's discretion, furnish to any applicant other than listed in subsection (a) of this Section, vehicle or driver data via digital transmission at a fixed fee of $500, in advance, and a charge of $50, per 1,000 motor vehicle records or part thereof. This service shall not be in lieu of an abstract of a driver's record nor of a title or registration search. This information sold pursuant to this subsection may be the entire vehicle or driver data list, or part thereof. The information sold pursuant to this subsection shall not contain personally identifying information unless the information is to be used for one of the purposes identified in subsection (d-5) of this Section and may not be used for solicitation in any form or manner. Commercial purchasers of driver and vehicle record databases shall enter into a written access agreement with the Secretary that includes disclosure of the commercial use of the information to be purchased.

(c) The Secretary may compile a list of all registered vehicles. Each list of registered vehicles shall be arranged serially according to the registration numbers assigned to registered vehicles and may contain in addition the names and addresses of registered owners and a brief description of each vehicle including the serial or other identifying number thereof. Such compilation may be in such form as in the discretion of the Secretary may deem best for the purposes intended.

(d) The Secretary shall make a title or registration search of the records of his office and a written report on the same for any person, upon written application of such person, accompanied by a fee of $5 for each registration or title search. The written application shall set forth the intended use of the requested information. No fee shall be charged for a title or registration search, or for the certification thereof, requested by a government agency. The report of the title or registration search shall not contain personally identifying information unless the request for a search was made for one of the purposes identified in subsection (e) of this Section. The report of the title or registration search shall not contain highly restricted personal information unless specifically authorized by this Chapter.

The Secretary shall certify a title or registration record upon written request. The fee for certification shall be $5 in addition to the fee required for a title or registration search. Certification shall be made under the signature of the Secretary and shall be authenticated by Seal of the Secretary.

The Secretary may notify the vehicle owner or registrant of the request for purchase of his title or registration information as the Secretary deems appropriate. No information shall be released to the requester until expiration of a 10-day period. This 10-day period shall not apply to requests for information made by law enforcement officials, government agencies, financial institutions, attorneys, insurers, employers, automobile associated businesses, the vehicle owner or registrant or other entities as the Secretary may deem by rule and regulation.

(e) The Secretary shall not disclose or otherwise make available to any person or entity any personally identifying information obtained by the Secretary in connection with a motor vehicle record unless the information is disclosed for one of the following purposes and the disclosure is not further limited by this Code:

(1) For use by any governmental agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a federal, State, or local agency in carrying out its functions.

(2) For use in connection with matters of motor vehicle or driver safety or theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of the motor vehicles, motor vehicle parts, and dealers; and removal of non-owner records from the original owner records of motor vehicle manufacturers.

(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only if:

(A) to verify the accuracy of personal information submitted by an individual to the business or its agents, employees, or contractors; and

(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest, against the individual.

(4) For use in research activities and for use in producing statistical reports, if the personally identifying information is not published, redisclosed, or used to contact individuals.

(5) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, State, or local court.

(6) For use by any insurer or insurance support organization or by a self-insured entity or its agents, employees, or contractors in connection with claims investigation activities, antifraud activities, rating, or underwriting.

(7) For use in providing notice to the owners of towed or impounded vehicles.

(8) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under Chapter 313 of Title 49 of the United States Code.

(9) For use in connection with the operation of private toll transportation facilities.

(10) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.

(11) For use by members of the news media, as defined in Section 1-148.5 for the purpose of newsgathering when the request relates to the operation of a motor vehicle or public safety. Requests made by the news media for motor vehicle record information may be furnished without charge or at a reduced charge, as determined by the Secretary, when the specific purpose for requesting the documents is deemed to be in the public interest. Waiver or reduction of the fee is in the public interest if the principal purpose of the request is to access and disseminate information regarding the health, safety, and welfare or the legal rights of the general public and is not for the principal purpose of gaining a personal or commercial benefit.

(12) For any other use specifically authorized by law, if that use is related to the operation of a motor vehicle or public safety.

(f) The Secretary shall not disclose or otherwise make available to any person or entity any highly restricted personal information obtained by the Secretary in connection with a motor vehicle record unless specifically authorized by this Code.

(g)(1) The Secretary may, in accordance with this Code, furnish to the person or agency so requesting a driver's record or data contained therein. Such document may include a record of: current driver's license issuance information, except that the information on judicial permits or monitoring device driving permits shall be available only as otherwise provided by this Code; convictions, orders entered revoking suspending or canceling a driver's license or privilege; and notations of crash involvement. All other information, unless otherwise permitted by this Code, shall remain confidential. Information released pursuant to a request for a driver's record shall not contain personally identifying information, unless the request for the driver's record was made for one of the purposes set forth in subsection (e) of this Section. The Secretary may, without fee, allow a parent or guardian of a person under the age of 18 years, who holds an instruction permit or graduated driver's license, to view that person's driving record online, through a computer connection. The parent or guardian's online access to the driving record will terminate when the instruction permit or graduated driver's license holder reaches the age of 18.

(2) The Secretary of State may certify an abstract of a driver's record upon written request therefor. Such certification shall be made under the signature of the Secretary and shall be authenticated by the Seal of his office.

(3) All requests for driving record information shall be made in a manner prescribed by the Secretary and shall set forth the intended use of the requested information.

The Secretary may notify the affected driver of the request for purchase of his driver's record as the Secretary deems appropriate.

No information shall be released to the requester until expiration of a 10-day period. This 10-day period shall not apply to requests for information made by law enforcement officials, government agencies, financial institutions, attorneys, insurers, employers, automobile associated businesses, the affected driver or other entities as the Secretary may exempt by rule or regulation.

(4) The Secretary may furnish without fee, upon the written request of a law enforcement agency, any information from a driver's record on file with the Secretary when such information is required in the enforcement of this Code or any other law relating to the operation of motor vehicles, including records of dispositions; documented information involving the use of a motor vehicle; whether such individual has, or previously had, a driver's license; and the address and personal description as reflected on said driver's record.

(5) Except as otherwise provided in this Section, the Secretary may furnish, without fee, information from an individual driver's record on file, if a written request therefor is submitted by any public transit system or authority, public defender, law enforcement agency, a state or federal agency, or an Illinois local intergovernmental association, if the request is for the purpose of a background check of applicants for employment with the requesting agency, or the purpose of an official investigation conducted by the agency, or to determine a current address for the driver so public funds can be recovered or paid to the driver, or for any other purpose set forth in subsection (e) of this Section.

The Secretary may also furnish the courts a copy of an abstract of a driver's record, without fee, subsequent to an arrest or issuance of a Uniform Citation and Complaint for any violation of a provision of this Code or a similar provision of a local ordinance. Such abstract may include records of dispositions; documented information involving the use of a motor vehicle as contained in the current file; whether such individual has, or previously had, a driver's license; and the address and personal description as reflected on said driver's record.

(6) Any certified abstract issued by the Secretary or transmitted electronically by the Secretary pursuant to this Section, to a court or on request of a law enforcement agency, for the record of a named person as to the status of the person's driver's license shall be prima facie evidence of the facts therein stated and if the name appearing in such abstract is the same as that of a person named in an information or warrant, such abstract shall be prima facie evidence that the person named in such information or warrant is the same person as the person named in such abstract and shall be admissible for any prosecution under this Code and be admitted as proof of any prior conviction or proof of records, notices, or orders recorded on individual driving records maintained by the Secretary.

(7) Subject to any restrictions contained in the Juvenile Court Act of 1987, and upon receipt of a proper request and a fee as set forth in Section 6-118, the Secretary shall provide a driver's record or data contained therein to the affected driver, or the affected driver's attorney, upon verification. Such record shall contain all the information referred to in paragraph (1) of this subsection, plus: any recorded crash involvement as a driver; information recorded pursuant to subsection (e) of Section 6-117 and paragraph (4) of subsection (a) of Section 6-204. All other information, unless otherwise permitted by this Code, shall remain confidential.

(h) Medical statements or medical reports received by the Secretary of State's Office shall be confidential. Except as provided in this Section, no confidential information may be open to public inspection or the contents disclosed to anyone, except officers and employees of the Secretary who have a need to know the information contained in the medical reports and the Driver License Medical Advisory Board, unless so directed by an order of a court of competent jurisdiction, or in response to a civil action filed pursuant to the Administrative Procedure Act as it relates to an order of cancellation, suspension, or revocation. If the Secretary receives a medical report regarding a driver that does not address a medical condition contained in a previous medical report, the Secretary may disclose the unaddressed medical condition to the driver or his or her physician, or both, solely for the purpose of submission of a medical report that addresses the condition.

(i) Notations of crash involvement that may be disclosed under this Section shall not include notations relating to damage to a vehicle or other property being transported by a tow truck. The information shall remain confidential, provided that nothing in this subsection shall limit disclosure of any notification of crash involvement to any law enforcement agency or official.

(j) Pursuant to the Uniform Anatomical Gift Act and pursuant to an access agreement as set forth in Section 2A-108, the Secretary shall allow organ procurement organizations, as defined by the Uniform Anatomical Gift Act, access to the name, address, gender, date of birth, driver's license or identification card number, and date of consent a person joined the First Person Consent organ and donor registry for the purpose of determining whether a potential organ and tissue donor is included in the First Person Consent organ and tissue donor registry.

(625 ILCS 5/2A-110 new)

Sec. 2A-110. Fees. Disbursement of fees collected under this Chapter shall be as follows:

(1) of the $20 fee for a driver's record, $11 shall be paid into the Secretary of State Special Services Fund, and $6 shall be paid into the General Revenue Fund;

(2) 50% of the amounts collected under this Chapter shall be paid into the General Revenue Fund; and

(3) all remaining fees shall be disbursed under subsection (g) of Section 2-119 of this Code.

(625 ILCS 5/2A-111 new)

Sec. 2A-111. Commercial requesters; access agreements; electronic access; data security; procedural safeguards.

(a) The Secretary may grant access to the electronic motor vehicle records as provided in this Section or Section 5-47 of the Anatomical Gift Act, for commercial use if the Secretary determines there is a legitimate business need to grant access and access is in the best interests of the State of Illinois.

(b) The Secretary may limit the number of persons authorized to obtain direct electronic access and may restrict, or establish priority for, access to motor vehicle records as the Secretary deems necessary to avoid disruption to the Secretary's normal operations, or as the Secretary deems is in the best interests of the public.

(c) A request for electronic access to motor vehicle records must be submitted in writing and include:

(1) a signed and notarized certified statement of use that sets forth the purpose of the request and the specific information or type of information sought. If personally identifying information is requested, the statement shall include the basis under which such information may be disclosed under the Driver's Privacy Protection Act, 18 U.S.C. 2721 et seq., and subsection (e) of Section 2A-108 or that the requester has obtained the consent of the person whose information has been requested and that the data will not be used for any other purpose; and

(2) the requester's identity, including name, job title and business address, and the name and address of any organization associated with the request.

(d) Every requester must execute an access agreement and agree to be responsible for:

(1) obtaining and maintaining access to the Internet that is capable of Virtual Private Network (VPN) traffic and preventing unauthorized use, access, or misuse of the VPN;

(2) ensuring that any technology used by the requester is compatible with Secretary of State technology; this includes, but is not limited to, VPN tunnels, firewalls, and routers;

(3) maintaining security procedures in the requester's network and procedures deemed appropriate in the sole discretion of the Secretary;

(4) maintaining reasonable measures in accordance with industry-recognized leading cybersecurity practices, necessary to prevent the unauthorized uses, access, misuse, and disclosure of motor vehicle records and to prevent unauthorized persons or entities from obtaining, accessing, or using motor vehicle records;

(5) providing quarterly written certifications through the duration of the access agreement confirming that the requester has no evidence or other reason to believe that the information systems have been breached or otherwise compromised in the preceding quarter;

(6) providing the requester's latest Service Organization Control SOC 2, Type II report completed by a certified auditing agency, as well as any gap letters required to cover stated controls for the applicable annual period not to exceed 3 months, if required in the sole discretion of the Secretary;

(7) providing to the Secretary the names, work addresses, and work phone numbers of all persons responsible for maintaining motor vehicle record files provided by the Secretary or otherwise executing the provisions of an access agreement on behalf of the requester. The names on the list are considered the users on behalf of the requester;

(8) providing a written certification that Secretary of State motor vehicle records or any portion thereof shall not be transferred, nor accessed outside of the United States, electronically or otherwise;

(9) certifying that the requester adheres to the most current ISO NIST CSF or NIST Special Publication standards available;

(10) agreeing to complete the Secretary of State security assessment, if required by the Secretary, prior to the execution of the access agreement;

(11) certifying that no employee nor officer of the requester accessing motor vehicle records has been convicted of a felony, or that at least 5 years have passed since the completion of the sentence;

(12) indemnifying and holding the Secretary of State harmless from any data breach or unauthorized use of data.

(e) The Secretary may establish minimum security standards and technological requirements and any terms and conditions as he deems necessary for the agreement and the direct electronic access to motor vehicle records, including, but not limited to, requiring a comprehensive data security program and designing, implementing, and regular tests of its safeguards. If required by the Secretary of State, the requester shall be required to perform penetrative testing of its data security system at least semi-annually and shall promptly provide the results of the testing upon request by the Secretary.

(f) An access agreement shall be for a term to be determined by the Secretary.

(g) All users granted direct access are prohibited from any type of data mining or web mining of Secretary of State data. Prohibited data mining or web mining includes, but is not limited to, use of website copying software, web data pre-processing, creation of web metrics and mathematical models, web log analysis, static and dynamic visitor profiling, intelligent information retrieval, hyperlink analysis, use of spider, crawl or both programs (vertical search engines), web usage mining, web structure mining, web content mining, data/information extraction, web information integration and schema matching, knowledge synthesis, segmenting, noise detection, use of topic-sensitive PageRank software, use of filtering techniques, meta-search engines, or any other type of automated search of information that goes beyond keyword extraction. Violation of this Section is considered a material breach and may result in termination of an access agreement and access to motor vehicle records. Data or web mining is further considered computer tampering under Section 17-51 of the Criminal Code of 2012.

(h)(1) The requester shall properly and timely dispose of the materials containing personally identifiable information in a manner that renders the personal information unreadable and undecipherable, in accordance with the Personal Information Protection Act.

(2) The requester shall not make any information from motor vehicle records available to other persons, firms, corporations, partnerships, members of the public, persons outside the employ or direct control of the requester, or other entities without the prior express written consent of the Secretary, except as provided in an approved Certified Statement of Use(s).

(3) A requester who sells or discloses any personally identifying information obtained from the Secretary in any manner allowed under the access agreement shall enter into a written agreement with the party receiving the personally identifying information that, at a minimum:

(A) prohibits the redisclosure of the information;

(B) sets forth the authorized use as provided in Section 2A-109 for which the receiving party acquired the information;

(C) requires the person or entity receiving the personally identifying information to acknowledge the terms and conditions of the authorized recipient's access agreement with the Secretary of State and to be subject to the laws of the State of Illinois, including this Code; and

(D) indemnifies and holds the Secretary of State harmless from any data breach or unauthorized use of data.

(4) A requester who sells or discloses any personally identifying information obtained from the Secretary in any manner allowed under the access agreement shall maintain records of the redisclosure and the written agreement required by paragraph (5) of subsection (k) for a minimum of 5 years, The requester shall make the records available to the Secretary within 5 days upon request of the Secretary.

(5) The requester shall not sell or repackage any information from motor vehicle records under the name of the Secretary of State or use the State seal with respect to any data obtained through an access agreement.

(6) The requester shall adhere to the Data Processing Confidentiality Act. The requester agrees not to use, sell, furnish, or otherwise make available any motor vehicle record accessed pursuant to an access agreement for any prohibited reason, including, but not limited to, commercial solicitation purposes, to contact individuals for advertising, offering for sale, marketing or sale of products or services; or identifying potential employees. A violation of this subsection shall result in the denial of information for a term of 5 years.

(7) The requester shall carry insurance coverage in amounts sufficient to cover requester's potential liabilities arising out of the provision of services under an access agreement. The requester shall provide an insurance certificate naming the Secretary as an additional insured on the general liability, professional liability, and cyber liability coverages and shall provide the insurance certificates with evidence of additional insured status and all required coverages prior to the execution of additional insured status and all required coverages prior to the execution of the access agreement. Insurance shall not limit the requester's obligations to indemnify, defend, or settle any and all claims. Requesters shall procure and maintain the following insurance coverage throughout the term of an access agreement and any renewals thereof:

(A) professional liability (errors and omissions) insurance covering errors, omissions, or negligence in the provision of services under an access agreement with limits determined by the Secretary in an amount commiserate with the volume of records purchased by the requester and necessary to protect the constituents of the State of Illinois;

(B) cyber liability or data/privacy protection insurance with limits determined by the Secretary in an amount commiserate with the volume of records purchased by the requester and necessary to protect the constituents of the State of Illinois.

(i) The Secretary may require an agreement that a requester seeking to obtain motor vehicle records shall hold harmless and indemnify the Secretary for any money damages, criminal fines, civil penalties, court costs, and attorney's fees awarded to any person or entity by any state or federal court resulting from any disclosure by the requester or by any person to whom the requester provided information from a motor vehicle record that is contrary to state or federal law.

(j) A breach of any provision contained within this Chapter or the access agreement may be deemed a material breach of the access agreement and result in the immediate revocation of the access agreement.

(k) The Secretary may terminate an access agreement immediately, if:

(1) the requested information is used for a purpose other than the purpose identified in the written application or in violation of any provision of Section 2A-114;

(2) the requester violates any provision of the access agreement; or

(3) the requester violates any provision of this Chapter.

(625 ILCS 5/2A-112 new)

Sec. 2A-112. Random audit. The Secretary may, at any time, conduct a random audit of applications for access agreements, requests for information, or certified statements of use(s) submitted and processed pursuant to this Chapter to verify the authenticity of the documents and information submitted in support of those applications.

Any person or entity receiving information from a motor vehicle record or electronic access to motor vehicle records pursuant to this Chapter shall have an affirmative duty to cooperate with the audit and provide any information or supporting documentation requested by the Secretary.

(625 ILCS 5/2A-113 new)

Sec. 2A-113. Redisclosure.

(a) If the Secretary discovers that personally identifying information from a motor vehicle record has been wrongfully disclosed by a requester, the requester shall notify the entity or person to whom the personally identifying information was wrongfully disclosed that the personally identifying information may not be used, resold, or redisclosed in any way and must be immediately destroyed. The Secretary shall notify the subject of the personally identifying information that the personally identifying information was wrongly disclosed.

(b) A requester who has access to motor vehicle records and who rediscloses any personally identifying information connected with a motor vehicle record must notify each entity or person to whom the personally identifying information is redisclosed that the personally identifying information may not be further disclosed unless the redisclosure is authorized by the Driver's Privacy Protection Act and this Code.

(625 ILCS 5/2A-114 new)

Sec. 2A-114. Prohibitions and violations of this Chapter.

(a) It is unlawful for any person to:

(1) knowingly misrepresent the person's identity or to make a false statement to obtain any information associated with a motor vehicle record;

(2) knowingly disclose, sell, or otherwise provide personally identifying information from a motor vehicle record to any person who is not authorized under this Chapter to receive personally identifying information;

(3) knowingly obtain or use a motor vehicle record for a reason other than authorized by this Code.

(b) A violation of this Section is a Class A misdemeanor. Each unauthorized disclosure, unauthorized use, or false representation shall be a separate offense.

(c) Neither the Secretary nor its departments or employees shall be civilly liable for any improper use or release of motor vehicle records to any person obtaining such records as provided in this Section.

(d) Any person convicted of a violation of this Chapter shall be permanently barred from receiving motor vehicle records.

(e) The Secretary shall forward any violations of this Chapter to the appropriate prosecuting authority for prosecution.

(f) The Secretary may refuse to disclose data under this Chapter if the Secretary concludes that the requester is likely to use the data for a purpose not authorized by this Chapter.

(625 ILCS 5/2A-115 new)

Sec. 2A-115. Data system security breach. Any person who has access to motor vehicle records who experiences a breach of the security of the data system as defined in this Chapter or has any reason to believe that Secretary of State data has been compromised must comply with the Personal Information Protection Act and provide the required notices to all persons whose personally identifying information has been exposed. If notices are not required by the Personal Information Protection Act, the Secretary of State may, at its discretion, require notice be sent to persons whose data was obtained in a data breach or by an unauthorized user.

(625 ILCS 5/2A-116 new)

Sec. 2A-116. Procedural safeguards to protect confidentiality. Any person who has access to personally identifying information from motor vehicle records shall establish procedures to protect the confidentiality of those records. If any personally identifying information is redisclosed as allowed by this Chapter, the person receiving the personally identifying information must also take all steps necessary to ensure confidentiality and to prevent the release of the personally identifying information.

(625 ILCS 5/2A-117 new)

Sec. 2A-117. Rules. The Secretary may adopt rules to administer and enforce this Chapter.

(625 ILCS 5/2-123 rep.)

(625 ILCS 5/6-110.1 rep.)

(625 ILCS 5/6-110.2 rep.)

(625 ILCS 5/6-110.3 rep.)

Section 10. The Illinois Vehicle Code is amended by repealing Sections 2-123, 6-110.1, 6-110.2, and 6-110.3.