103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB0312

 

Introduced 2/2/2023, by Sen. Laura M. Murphy

 

SYNOPSIS AS INTRODUCED:
 
605 ILCS 10/19.1

    Amends the Toll Highway Act. Makes changes concerning the privacy policy of the Illinois State Toll Highway Authority regarding the release of personally identifiable information in response to a subpoena in a pending civil action or lawful order from a civil court of competent jurisdiction. Provides that the Authority may release personally identifiable information to a grand jury if exigent circumstances make obtaining a warrant or subpoena impractical (instead of "in the case of an emergency when obtaining a warrant or subpoena would be impractical"). Provides that the Authority may release personally identifiable information to the Executive Inspector General. Provides that the Authority shall make personally identifiable information of a person available to any State or local agency, inspector general, or law enforcement agency in response to a grand jury subpoena or pursuant to an investigation. Provides that the Authority shall discard personally identifiable information within 5 years. Provides that the Authority shall make every effort, within practical business and cost constraints, to purge the personal account information of an account that is closed or terminated. Provides that in no case shall the Authority maintain personal information more than 5 years after the date an account is closed or terminated. Provides that the new provisions do not preclude compliance with a court order or settlement agreement that has been approved on or before January 1, 2023. Effective immediately.


LRB103 25934 MXP 52285 b

 

 

A BILL FOR

 

SB0312LRB103 25934 MXP 52285 b

1    AN ACT concerning transportation.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Toll Highway Act is amended by changing
5Section 19.1 as follows:
 
6    (605 ILCS 10/19.1)
7    (Text of Section before amendment by P.A. 102-982)
8    Sec. 19.1. Confidentiality of personally identifiable
9information obtained through electronic toll collection
10system.
11    (a) For purposes of this Section:
12    "Electronic toll collection system" is a system where a
13transponder, camera-based vehicle identification system, or
14other electronic medium is used to deduct payment of a toll
15from a subscriber's account or to establish an obligation to
16pay a toll.
17    "Electronic toll collection system user" means any natural
18person who subscribes to an electronic toll collection system
19or any natural person who uses a tolled transportation
20facility that employs the Authority's electronic toll
21collection system.
22    "Personally identifiable information" means any
23information that identifies or describes an electronic toll

 

 

SB0312- 2 -LRB103 25934 MXP 52285 b

1collection system user, including but not limited to travel
2pattern data, address, telephone number, e-mail address,
3license plate number, photograph, bank account information, or
4credit card number.
5    (b) Except as otherwise provided in this Section, the
6Authority may not sell or otherwise provide to any person or
7entity personally identifiable information of any electronic
8toll collection system user that the Authority obtains through
9the operation of its electronic toll collection system.
10    (c) The Authority may, within practical business and cost
11constraints, store personally identifiable information of an
12electronic toll collection system user only if the information
13is required to perform account functions such as billing,
14account settlement, or toll violation enforcement activities.
15    (d) By no later than December 31, 2011, the Authority
16shall establish a privacy policy regarding the collection and
17use of personally identifiable information. Upon its adoption,
18the policy shall be posted on the Authority's website and a
19copy shall be included with each transponder transmitted to a
20user. The policy shall include but need not be limited to the
21following:
22        (1) A description of the types of personally
23    identifiable information collected by the Authority.
24        (2) The categories of third-party persons or entities
25    with whom the Authority may share personally identifiable
26    information and for what purposes that information is

 

 

SB0312- 3 -LRB103 25934 MXP 52285 b

1    shared.
2        (3) The process by which the Authority notifies
3    electronic toll collection system users of material
4    changes to its privacy policy.
5        (4) The process by which an electronic toll collection
6    system user may review and request changes to any of his or
7    her personally identifiable information.
8        (5) The effective date of the privacy policy.
9    (e) This Section does not prohibit the Authority from:
10        (1) providing aggregated traveler information derived
11    from collective data relating to a group or category of
12    electronic toll collection system users from which
13    personally identifiable information has been removed;
14        (2) sharing data with another transportation agency or
15    third-party vendor to comply with interoperability
16    specifications and standards regarding electronic toll
17    collection devices and technologies, provided that the
18    other transportation agency or third-party vendor may not
19    use personally identifiable information obtained under
20    this Section for a purpose other than described in this
21    Section;
22        (3) performing financial, legal and accounting
23    functions such as billing, account settlement, toll
24    violation enforcement, or other activities required to
25    operate and manage its toll collection system;
26        (4) communicating about products and services offered

 

 

SB0312- 4 -LRB103 25934 MXP 52285 b

1    by itself, a business partner, or another public agency;
2        (5) using personally identifiable information in
3    research projects, provided that appropriate
4    confidentiality restrictions are employed to protect
5    against the unauthorized release of such information;
6        (6) releasing personally identifiable information in
7    response to a search warrant, grand jury, subpoena, or
8    lawful order from a court of competent jurisdiction;
9        (6.5) releasing personally identifiable information in
10    response to a subpoena in a pending civil action or lawful
11    order from a civil court of competent jurisdiction in
12    accordance with the following: (i) the Authority must, as
13    soon as practicable but no later than 7 days from its
14    receipt of the subpoena or order, notify the electronic
15    toll collection system user that it has received a
16    subpoena or order that seeks the user's personally
17    identifiable information, and that the user has the right
18    to move to quash the subpoena or set aside the order in the
19    issuing court; (ii) the Authority may use email to notify
20    the user of this subpoena, and the Authority's email shall
21    constitute proof of notice; and (iii) the Authority may
22    adopt rules to carry out this responsibility;
23        (7) releasing personally identifiable information to
24    law enforcement agencies if exigent circumstances make in
25    the case of an emergency when obtaining a warrant or
26    subpoena would be impractical; and

 

 

SB0312- 5 -LRB103 25934 MXP 52285 b

1        (8) releasing personally identifiable information to
2    the Authority's Inspector General, the Executive Inspector
3    General, or, at the Authority Inspector General's
4    direction, to law enforcement agencies under paragraphs
5    (5) and (6) of subsection (f) of Section 8.5 of this Act.
6    (f) In any agreement allowing another public entity to use
7the Authority's toll collection system in a transportation
8facility, the Authority shall require the other public entity
9to comply with the requirements of this Section.
10    (g) Personally identifiable information generated through
11the Authority's toll collection process that reveals the date,
12time, location or direction of travel by an electronic toll
13collection system user shall be exempt from release under the
14Illinois Freedom of Information Act. The exemption in this
15subsection shall not apply to information that concerns (i)
16the public duties of public employees and officials; (ii)
17whether an electronic toll collection system user has paid
18tolls; (iii) whether the Authority is enforcing toll violation
19penalties against electronic toll collection users who do not
20pay tolls; (iv) accidents or other incidents that occur on
21highways under the jurisdiction of the Authority; or (v) the
22obligation, receipt, and use of the funds of the Authority.
23The exemption in this subsection (g) shall not be a limitation
24or restriction on other Freedom of Information Act exemptions
25applicable to personally identifiable information or private
26information.

 

 

SB0312- 6 -LRB103 25934 MXP 52285 b

1    (h) The Authority shall make personally identifiable
2information of a person available to any State or local
3agency, inspector general, or law enforcement agency in
4response to a grand jury subpoena or pursuant to an
5investigation.
6    (i) The Authority shall discard personally identifiable
7information not required for account maintenance or
8enforcement within 5 years. The Authority shall make every
9effort, within practical business and cost constraints, to
10purge the personal account information of an account that is
11closed or terminated. In no case shall the Authority maintain
12personal information more than 5 years after the date an
13account is closed or terminated unless required by another
14statute.
15    (j) Nothing in this Section precludes compliance with a
16court order that has been issued or settlement agreement that
17has been approved on or before January 1, 2023.
18(Source: P.A. 97-342, eff. 8-12-11.)
 
19    (Text of Section after amendment by P.A. 102-982)
20    Sec. 19.1. Confidentiality of personally identifiable
21information obtained through electronic toll collection
22system.
23    (a) For purposes of this Section:
24    "Electronic toll collection system" is a system where a
25transponder, camera-based vehicle identification system, or

 

 

SB0312- 7 -LRB103 25934 MXP 52285 b

1other electronic medium is used to deduct payment of a toll
2from a subscriber's account or to establish an obligation to
3pay a toll.
4    "Electronic toll collection system user" means any natural
5person who subscribes to an electronic toll collection system
6or any natural person who uses a tolled transportation
7facility that employs the Authority's electronic toll
8collection system.
9    "Personally identifiable information" means any
10information that identifies or describes an electronic toll
11collection system user, including but not limited to travel
12pattern data, address, telephone number, e-mail address,
13license plate number, photograph, bank account information, or
14credit card number.
15    (b) Except as otherwise provided in this Section, the
16Authority may not sell or otherwise provide to any person or
17entity personally identifiable information of any electronic
18toll collection system user that the Authority obtains through
19the operation of its electronic toll collection system.
20    (c) The Authority may, within practical business and cost
21constraints, store personally identifiable information of an
22electronic toll collection system user only if the information
23is required to perform account functions such as billing,
24account settlement, or toll violation enforcement activities.
25    (d) By no later than December 31, 2011, the Authority
26shall establish a privacy policy regarding the collection and

 

 

SB0312- 8 -LRB103 25934 MXP 52285 b

1use of personally identifiable information. Upon its adoption,
2the policy shall be posted on the Authority's website and a
3copy shall be included with each transponder transmitted to a
4user. The policy shall include but need not be limited to the
5following:
6        (1) A description of the types of personally
7    identifiable information collected by the Authority.
8        (2) The categories of third-party persons or entities
9    with whom the Authority may share personally identifiable
10    information and for what purposes that information is
11    shared.
12        (3) The process by which the Authority notifies
13    electronic toll collection system users of material
14    changes to its privacy policy.
15        (4) The process by which an electronic toll collection
16    system user may review and request changes to any of his or
17    her personally identifiable information.
18        (5) The effective date of the privacy policy.
19    (e) This Section does not prohibit the Authority from:
20        (1) providing aggregated traveler information derived
21    from collective data relating to a group or category of
22    electronic toll collection system users from which
23    personally identifiable information has been removed;
24        (2) sharing data with another transportation agency or
25    third-party vendor to comply with interoperability
26    specifications and standards regarding electronic toll

 

 

SB0312- 9 -LRB103 25934 MXP 52285 b

1    collection devices and technologies, provided that the
2    other transportation agency or third-party vendor may not
3    use personally identifiable information obtained under
4    this Section for a purpose other than described in this
5    Section;
6        (3) performing financial, legal and accounting
7    functions such as billing, account settlement, toll
8    violation enforcement, or other activities required to
9    operate and manage its toll collection system;
10        (4) communicating about products and services offered
11    by itself, a business partner, or another public agency;
12        (5) using personally identifiable information in
13    research projects, provided that appropriate
14    confidentiality restrictions are employed to protect
15    against the unauthorized release of such information;
16        (6) releasing personally identifiable information in
17    response to a search warrant, grand jury, subpoena, or
18    lawful order from a court of competent jurisdiction;
19        (6.5) releasing personally identifiable information in
20    response to a subpoena in a pending civil action or lawful
21    order from a civil court of competent jurisdiction in
22    accordance with the following: (i) the Authority must, as
23    soon as practicable but no later than 7 days from its
24    receipt of the subpoena or order, notify the electronic
25    toll collection system user that it has received a
26    subpoena or order that seeks the user's personally

 

 

SB0312- 10 -LRB103 25934 MXP 52285 b

1    identifiable information, and that the user has the right
2    to move to quash the subpoena or set aside the order in the
3    issuing court; (ii) the Authority may use email to notify
4    the user of this subpoena, and the Authority's email shall
5    constitute proof of notice; and (iii) the Authority may
6    adopt rules to carry out this responsibility;
7        (7) releasing personally identifiable information to
8    law enforcement agencies if exigent circumstances make in
9    the case of an emergency when obtaining a warrant or
10    subpoena would be impractical; and
11        (8) releasing personally identifiable information to
12    the Authority's Inspector General, the Executive Inspector
13    General, or, at the Authority Inspector General's
14    direction, to law enforcement agencies under paragraphs
15    (5) and (6) of subsection (f) of Section 8.5 of this Act.
16    (f) In any agreement allowing another public entity to use
17the Authority's toll collection system in a transportation
18facility, the Authority shall require the other public entity
19to comply with the requirements of this Section.
20    (g) Personally identifiable information generated through
21the Authority's toll collection process that reveals the date,
22time, location or direction of travel by an electronic toll
23collection system user shall be exempt from release under the
24Illinois Freedom of Information Act. The exemption in this
25subsection shall not apply to information that concerns (i)
26the public duties of public employees and officials; (ii)

 

 

SB0312- 11 -LRB103 25934 MXP 52285 b

1whether an electronic toll collection system user has paid
2tolls; (iii) whether the Authority is enforcing toll violation
3penalties against electronic toll collection users who do not
4pay tolls; (iv) crashes or other incidents that occur on
5highways under the jurisdiction of the Authority; or (v) the
6obligation, receipt, and use of the funds of the Authority.
7The exemption in this subsection (g) shall not be a limitation
8or restriction on other Freedom of Information Act exemptions
9applicable to personally identifiable information or private
10information.
11    (h) The Authority shall make personally identifiable
12information of a person available to any State or local
13agency, inspector general, or law enforcement agency in
14response to a grand jury subpoena or pursuant to an
15investigation.
16    (i) The Authority shall discard personally identifiable
17information not required for account maintenance or
18enforcement within 5 years. The Authority shall make every
19effort, within practical business and cost constraints, to
20purge the personal account information of an account that is
21closed or terminated. In no case shall the Authority maintain
22personal information more than 5 years after the date an
23account is closed or terminated unless required by another
24statute.
25    (j) Nothing in this Section precludes compliance with a
26court order that has been issued or settlement agreement that

 

 

SB0312- 12 -LRB103 25934 MXP 52285 b

1has been approved on or before January 1, 2023.
2(Source: P.A. 102-982, eff. 7-1-23.)
 
3    Section 95. No acceleration or delay. Where this Act makes
4changes in a statute that is represented in this Act by text
5that is not yet or no longer in effect (for example, a Section
6represented by multiple versions), the use of that text does
7not accelerate or delay the taking effect of (i) the changes
8made by this Act or (ii) provisions derived from any other
9Public Act.
 
10    Section 99. Effective date. This Act takes effect upon
11becoming law.