SB2977 94TH GENERAL ASSEMBLY

LRB094 19079 MKM 54587 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
SB2977

Introduced 1/20/2006, by Sen. Don Harmon

SYNOPSIS AS INTRODUCED:

220 ILCS 5/13-910 new
220 ILCS 5/13-911 new
225 ILCS 447/40-10
720 ILCS 110/2	from Ch. 38, par. 87-2
720 ILCS 110/4 new
815 ILCS 505/2Z	from Ch. 121 1/2, par. 262Z

Amends the Telecommunications Article of the Public Utilities Act. Prohibits any telecommunications carrier from releasing the customer proprietary network information or personal identifying information of any end user with an Illinois billing address or an Illinois area code, except under specified circumstances. Requires the Illinois Commerce Commission to adopt rules to regulate the security of customer proprietary network information and personal identifying information. Requires a telecommunications carrier to provide notice to an Illinois resident (i) in the event of a breach of customer property network information or personal identifying information concerning an Illinois resident or (ii) if the carrier discovers or has reason to believe that customer proprietary network information or personal identifying information concerning the Illinois resident was acquired by an unauthorized person. Sets forth penalties for failure to comply with the provisions. Amends the Private Detective, Private Alarm, Private Security, and Locksmith Act of 2004 to authorize the Department of Financial and Professional Regulation to impose disciplinary sanctions against any licensee for purchasing, acquiring, selling, or releasing the customer proprietary network information or personal identifying information of an Illinois resident. Amends the Communications Consumer Privacy Act. Provides that it is an unlawful business offense for a customer proprietary network information broker to purchase, acquire, sell, or release customer proprietary network information or personal identifying information of an Illinois resident. Sets forth penalties for violations. Amends the Consumer Fraud and Deceptive Business Practices Act to provide that any person who knowingly violates certain provisions of the Public Utilities Act prohibiting the release of the customer proprietary network information or personal identifying information of any end user commits an unlawful practice within the meaning of the Act. Effective immediately.

FISCAL NOTE ACT MAY APPLY

A BILL FOR

AN ACT concerning telecommunications.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Findings.

(a) The General Assembly finds and declares that unauthorized access and use of customer proprietary network information and personal identifying information endanger the safety, security, and privacy of Illinois telecommunications end users and Illinois residents and it is therefore in the public interest to ensure that this information is not released without the express consent of the end user or the end user's authorized representative.

(b) The General Assembly further finds and declares that the widespread availability of and unauthorized access to customer proprietary network information and personal identifying information have led to and will continue to lead to a substantial increase in identity theft-related crimes and other crimes.

Section 5. The Public Utilities Act is amended by adding Sections 13-910 and 13-911 as follows:

(220 ILCS 5/13-910 new)

Sec. 13-910. Customer proprietary network information.

(a) As used in this Section:

"Customer proprietary network information" means: (i) information maintained by a telecommunications carrier that relates to the quantity, technical configuration, type, destination, and amount of use of any telecommunications service subscribed to by an end user of the telecommunications carrier and that is made available to the carrier by the end user solely by virtue of its relationship with the carrier; (ii) information contained in the end user's billing statement pertaining to telecommunications services received by the end user from a telecommunications carrier; and (iii) information identifying the location of the end user or that may be used to identify the location of an end user.

"End user" means that term as it is defined in Section 13-217 of this Act.

"Personal identifying information" means that term as it is defined in subsection (b) of Section 16G-10 of the Criminal Code of 1961.

(b) No telecommunications carrier may release the customer proprietary network information or personal identifying information of any end user with an Illinois billing address or an Illinois area code without the express consent of the end user, except with proper law enforcement or court order documentation.

(c) Within one year after the effective date of this amendatory Act of the 94th General Assembly, the Commission must adopt rules to regulate the security of customer proprietary network information and personal identifying information including, but not limited to, all of the following provisions:

(1) Security standards to protect the confidentiality of data records containing customer proprietary network information and personal identifying information.

(2) Authentication procedures necessary to provide access by the end user or the end user's authorized representative to the end user's customer proprietary network information and personal identifying information.

(3) Reporting requirements for telecommunications carriers, remedies, and other enforcement mechanisms to ensure compliance with this Section.

The rules may allow for an implementation period of up to one year for a telecommunications carrier to implement the rules adopted by the Commission in accordance with this Section if the Commission determines that immediate and full compliance with the rules would be unduly economically burdensome or technically infeasible for the telecommunications carrier.

(d) No provision of this Section shall be construed to prohibit a telecommunications carrier from obtaining, using, releasing, or permitting access to any customer proprietary network information or personal identifying information of any end user with an Illinois billing address or an Illinois area code as follows:

(1) as otherwise authorized by law;

(2) with the lawful consent of the end user or the end user's designated representative;

(3) as necessary for the provision of services, for the protection of the rights or property of the provider, for the protection of end users, and for the protection of other telecommunications carriers from fraudulent, abusive, or unlawful use of or subscription to services;

(4) to a governmental entity, if the telecommunication carrier reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of the information; or

(5) to the National Center for Missing and Exploited Children, in connection with the report submitted thereto under Section 227 of the federal Victims of Child Abuse Act of 1990.

(220 ILCS 5/13-911 new)

Sec. 13-911. Breach of customer proprietary network information.

(a) As used in the Section:

"Breach of customer proprietary network information" means the unauthorized acquisition of customer proprietary network information or personal identifying information that compromises the security, confidentiality, or integrity of that information as maintained by the telecommunications carrier.

"Customer proprietary network information" means that term as it defined in Section 13-910.

"Personal identifying information" means that term as it is defined in subsection (b) of Section 16G-10 of the Criminal Code of 1961.

"Customer proprietary network information" and "personal identifying information" do not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

(b) In the event of a breach of customer proprietary network information or personal identifying information concerning an Illinois resident, the telecommunications carrier must notify the Illinois resident immediately following discovery or notification of the breach. The notice must be made in the most expedient manner possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the customer proprietary network information or personal identifying information.

(c) If the telecommunications carrier discovers or has reason to believe that customer proprietary network information or personal identifying information concerning an Illinois resident was acquired by an unauthorized person, the telecommunications carrier must immediately notify the Illinois resident and disclose any breach or suspected breach of customer proprietary information or personal identifying information. The notice must be made in the most expedient manner possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the acquisition by an unauthorized person and to restore the reasonable integrity, security, and confidentiality of the customer proprietary network information or personal identifying information.

(d) For purposes of this Section, notice to Illinois residents under this Section may be provided by any one of the following methods:

(1) written notice;

(2) electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing, as set forth in Section 7001 of Title 15 of the United States Code; or

(3) substitute notice, if the telecommunications carrier demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds 500,000, or if the telecommunications carrier does not have sufficient contact information. Substitute notice shall consist of all of the following: (i) e-mail notice if the telecommunications carrier has an e-mail address for the subject persons; (ii) conspicuous posting of the notice on the telecommunication carrier's website, if the telecommunications carrier maintains one; and (iii) notice to major statewide media.

(e) Notwithstanding any other provision of this Section to the contrary, if a telecommunications carrier maintains its own notice procedures as part of a security policy for the treatment of customer proprietary network information or personal identifying information that is otherwise consistent with the timing requirements of this Section, then that carrier shall be deemed to be in compliance with the notice requirements of this Section if the telecommunications carrier notifies Illinois residents in accordance with its policies in the event of a breach of the security of customer proprietary network information or personal identifying information.

(f) Any waiver of the provisions of this Section is contrary to public policy and is void and unenforceable.

(g) A violation of this Section constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Section 10. The Private Detective, Private Alarm, Private Security, and Locksmith Act of 2004 is amended by changing Section 40-10 as follows:

(225 ILCS 447/40-10)

(Section scheduled to be repealed on January 1, 2014)

Sec. 40-10. Disciplinary sanctions.

(a) The Department may deny issuance, refuse to renew, or restore or may reprimand, place on probation, suspend, or revoke any license, registration, permanent employee registration card, or firearm authorization card, and it may impose a fine not to exceed $1,500 for a first violation and not to exceed $5,000 for a second or subsequent violation for any of the following:

(1) Fraud or deception in obtaining or renewing of a license or registration.

(2) Professional incompetence as manifested by poor standards of service.

(3) Engaging in dishonorable, unethical, or unprofessional conduct of a character likely to deceive, defraud, or harm the public.

(4) Conviction in Illinois or another state of any crime that is a felony under the laws of Illinois; a felony in a federal court; a misdemeanor, an essential element of which is dishonesty; or directly related to professional practice.

(5) Performing any services in a grossly negligent manner or permitting any of a licensee's employees to perform services in a grossly negligent manner, regardless of whether actual damage to the public is established.

(6) Continued practice, although the person has become unfit to practice due to any of the following:

(A) Physical illness, including, but not limited to, deterioration through the aging process or loss of motor skills that results in the inability to serve the public with reasonable judgment, skill, or safety.

(B) Mental disability demonstrated by the entry of an order or judgment by a court that a person is in need of mental treatment or is incompetent.

(C) Addiction to or dependency on alcohol or drugs that is likely to endanger the public. If the Department has reasonable cause to believe that a person is addicted to or dependent on alcohol or drugs that may endanger the public, the Department may require the person to undergo an examination to determine the extent of the addiction or dependency.

(7) Receiving, directly or indirectly, compensation for any services not rendered.

(8) Willfully deceiving or defrauding the public on a material matter.

(9) Failing to account for or remit any moneys or documents coming into the licensee's possession that belong to another person or entity.

(10) Discipline by another United States jurisdiction or foreign nation, if at least one of the grounds for the discipline is the same or substantially equivalent to those set forth in this Act.

(11) Giving differential treatment to a person that is to that person's detriment because of race, color, creed, sex, religion, or national origin.

(12) Engaging in false or misleading advertising.

(13) Aiding, assisting, or willingly permitting another person to violate this Act or rules promulgated under it.

(14) Performing and charging for services without authorization to do so from the person or entity serviced.

(15) Directly or indirectly offering or accepting any benefit to or from any employee, agent, or fiduciary without the consent of the latter's employer or principal with intent to or the understanding that this action will influence his or her conduct in relation to his or her employer's or principal's affairs.

(16) Violation of any disciplinary order imposed on a licensee by the Department.

(17) Failing to comply with any provision of this Act or rule promulgated under it.

(18) Conducting an agency without a valid license.

(19) Revealing confidential information, except as required by law, including but not limited to information available under Section 2-123 of the Illinois Vehicle Code.

(20) Failing to make available to the Department, upon request, any books, records, or forms required by this Act.

(21) Failing, within 30 days, to respond to a written request for information from the Department.

(22) Failing to provide employment information or experience information required by the Department regarding an applicant for licensure.

(23) Failing to make available to the Department at the time of the request any indicia of licensure or registration issued under this Act.

(24) Purporting to be a licensee-in-charge of an agency without active participation in the agency.

(25) Purchasing, acquiring, selling, or releasing the customer proprietary network information or personal identifying information of any third party who is an Illinois resident. For purposes of this Section, "customer proprietary network information" means that term as it is defined in Section 13-910 of the Public Utilities Act and "personal identifying information" means that term as it is defined in subsection (b) of Section 16G-10 of the Criminal Code of 1961.

(b) The Department shall seek to be consistent in the application of disciplinary sanctions.

(Source: P.A. 93-438, eff. 8-5-03.)

Section 15. The Communications Consumer Privacy Act is amended by changing Section 2 and by adding Section 4 as follows:

(720 ILCS 110/2) (from Ch. 38, par. 87-2)

Sec. 2. Definitions. For purposes of this Act: ,

"Communications Company" means any person or organization which owns, controls, operates or manages any company which provides information or entertainment electronically to a household, including but not limited to a cable or community antenna television system.

"Customer proprietary network information broker" means any person or organization that purchases, acquires, sells, or releases the customer proprietary network information of any third party or that attempts to purchase, acquire, sell, or release the customer proprietary network information of any third party.

"Customer proprietary network information" means that term as it is defined in Section 13-901 of the Public Utilities Act.

"End user" means that term as it is defined in Section 13-217 of the Public Utilities Act.

"Personal identifying information" means that term as it is defined in subsection (b) of Section 16G-10 of the Criminal Code of 1961.

"Telecommunications carrier" means that term as it is defined in Section 13-202 of the Public Utilities Act.

(Source: P.A. 82-526.)

(720 ILCS 110/4 new)

Sec. 4. Customer proprietary network information; purchase, acquisition, sale, or release prohibited.

(a) It is unlawful for any customer proprietary network information broker to purchase, acquire, sell, or release the customer proprietary network information or any personal identifying information of any third party who is an Illinois resident or to attempt to purchase, acquire, sell, or release the customer proprietary network information or any personal identifying information of any third party who is an Illinois resident. This Section applies whether the customer proprietary network information is obtained by the customer proprietary network information broker directly from a telecommunications carrier or from any other third party source. For purposes of this Section, an individual is an Illinois resident if the individual has an Illinois billing address or an Illinois area code.

(b) A violation of any provision of this Section is a business offense punishable by a fine in an amount not to exceed $10,000 for each violation. Each item of customer proprietary network information or personal identifying information purchased, acquired, sold, or released and each attempt to purchase, acquire, sell, or release customer proprietary network information constitutes a separate violation of this Section. Any person who has been injured by a violation of this Section may commence an action in circuit court for damages against the customer proprietary network information broker who committed the violation. If the court awards damages to the plaintiff in any action brought under this Section, the court shall awarded the plaintiff court costs and attorney's fees.

(c) No provision of this Section shall be construed to prevent any action by a law enforcement agency or any officer, employee, or agent of a law enforcement agency, to obtain the customer proprietary network information or personal identifying information of any third party who is an Illinois resident in connection with the performance of the official duties of the agency, officer, employee, or agent.

Section 20. The Consumer Fraud and Deceptive Business Practices Act is amended by changing Section 2Z as follows:

(815 ILCS 505/2Z) (from Ch. 121 1/2, par. 262Z)

Sec. 2Z. Violations of other Acts. Any person who knowingly violates the Automotive Repair Act, the Automotive Collision Repair Act, the Home Repair and Remodeling Act, the Dance Studio Act, the Physical Fitness Services Act, the Hearing Instrument Consumer Protection Act, the Illinois Union Label Act, the Job Referral and Job Listing Services Consumer Protection Act, the Travel Promotion Consumer Protection Act, the Credit Services Organizations Act, the Automatic Telephone Dialers Act, the Pay-Per-Call Services Consumer Protection Act, the Telephone Solicitations Act, the Illinois Funeral or Burial Funds Act, the Cemetery Care Act, the Safe and Hygienic Bed Act, the Pre-Need Cemetery Sales Act, the High Risk Home Loan Act, the Payday Loan Reform Act, subsection (a) or (b) of Section 3-10 of the Cigarette Tax Act, the Payday Loan Reform Act, subsection (a) or (b) of Section 3-10 of the Cigarette Use Tax Act, the Electronic Mail Act, paragraph (6) of subsection (k) of Section 6-305 of the Illinois Vehicle Code, Article 3 of the Residential Real Property Disclosure Act, the Automatic Contract Renewal Act, Section 13-911 of the Public Utilities Act, or the Personal Information Protection Act commits an unlawful practice within the meaning of this Act.

(Source: P.A. 93-561, eff. 1-1-04; 93-950, eff. 1-1-05; 94-13, eff. 12-6-05; 94-36, eff. 1-1-06; 94-280, eff. 1-1-06; 94-292, eff. 1-1-06; revised 8-19-05.)

Section 99. Effective date. This Act takes effect upon becoming law.