103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB2359

 

Introduced 2/10/2023, by Sen. Rachel Ventura

 

SYNOPSIS AS INTRODUCED:
 
New Act

    Creates the Protecting Privacy from Government Intrusion Act. Provides that a government entity may not obtain the location information of an electronic device without a tracking warrant. Provides that a warrant granting access to location information must be issued only if the government entity shows that there is probable cause that the person who possesses an electronic device is committing, has committed, or is about to commit a crime. Provides for requirements of an application for a warrant. Describes when a government entity may obtain location information without a tracking warrant. Provides for a time period to achieve the objective of the authorization; notice on the persons named in the warrant; a report on collection of location information; a prohibition on the use of evidence; a limit on storage of license plate data; a prohibition on transfer of license plate data; and student online personal information protection. Defines terms.


LRB103 30648 DTM 57106 b

 

 

A BILL FOR

 

SB2359LRB103 30648 DTM 57106 b

1    AN ACT concerning criminal law.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 1. Short title. This Act may be cited as the
5Protecting Privacy from Government Intrusion Act.
 
6    Section 5. Definitions. In this Act:
7    "Automated license plate recognition system" means one or
8more mobile or fixed cameras combined with computer algorithms
9to convert images of license plates into computer-readable
10data.
11    "Captured plate data" means the global positioning device
12coordinates, date and time, photograph, license plate number,
13and any other data captured by or derived from any automated
14license plate recognition system.
15    "Electronic communication service" means any service that
16provides to its subscribers or users the ability to send or
17receive electronic communications, including any service that
18acts as an intermediary in the transmission of electronic
19communications, or stores electronic communication
20information.
21    "Government entity" means a State or local agency,
22including, but not limited to, a law enforcement entity or any
23other investigative entity, agency, department, division,

 

 

SB2359- 2 -LRB103 30648 DTM 57106 b

1bureau, board, commission, or an individual acting or
2purporting to act for or on behalf of a State or local agency
3or any unit of local government or political subdivision of
4this State.
5    "Location information" means information concerning the
6location of an electronic device that, in whole or in part, is
7generated or derived from or obtained by the operation of an
8electronic device.
9    "Location information service" means the provision of a
10global positioning service or other mapping, locational, or
11directional information service.
12    "Operator" means the operator of an Internet website,
13online service, online application, or mobile application with
14actual knowledge that the site, service, or application is
15used primarily for K–12 school purposes and was designed and
16marketed for K–12 school purposes.
17    "Remote computing service" means the provision to the
18public of computer storage or processing services by means of
19an electronic communications system.
20    "Tracking warrant" means an order in writing, in the name
21of the State, signed by a court other than a court exercising
22probate jurisdiction, directed to a peace officer, granting
23the officer access to location information of an electronic
24device.
 
25    Section 10. Tracking warrant required for location

 

 

SB2359- 3 -LRB103 30648 DTM 57106 b

1information.
2    (a) Except as provided in paragraph (2), a government
3entity may not obtain the location information of an
4electronic device without a tracking warrant. A warrant
5granting access to location information must be issued only if
6the government entity shows that there is probable cause the
7person who possesses an electronic device is committing, has
8committed, or is about to commit a crime. An application for a
9warrant must be made in writing and include:
10        (1) the identity of the government entity's peace
11    officer making the application and the officer authorizing
12    the application; and
13        (2) a full and complete statement of the facts and
14    circumstances relied on by the applicant to justify the
15    applicant's belief that a warrant should be issued,
16    including (i) details as to the particular offense that
17    has been, is being, or is about to be committed, and (ii)
18    the identity of the person, if known, committing the
19    offense whose location information is to be obtained.
20    (b) A government entity may obtain location information
21without a tracking warrant:
22        (1) when the electronic device is reported lost or
23    stolen by the owner;
24        (2) in order to respond to the user's call for
25    emergency services;
26        (3) with the informed, affirmative, documented consent

 

 

SB2359- 4 -LRB103 30648 DTM 57106 b

1    of the owner or user of the electronic device;
2        (4) with the informed, affirmative consent of the
3    legal guardian or next of kin of the owner or user if the
4    owner or user is believed to be deceased or reported
5    missing and unable to be contacted; or
6        (5) in an emergency situation that involves the risk
7    of death or serious physical harm to a person who
8    possesses an electronic communications device.
 
9    Section 15. Time period. A tracking warrant issued under
10this Act must authorize the collection of location information
11for a period not to exceed 60 days or the period of time
12necessary to achieve the objective of the authorization,
13whichever is less.
14    Extensions of a tracking warrant may be granted, but only
15upon an application for an order and upon the judicial finding
16required by paragraph (2) of subsection (a) of Section 10. The
17period of extension must be for a period not to exceed 60 days
18or the period of time necessary to achieve the objective for
19which it is granted, whichever is less.
20    This Section applies only to tracking warrants issued for
21the contemporaneous collection of electronic device location
22information.
 
23    Section 20. Notice.
24    (a) Within a reasonable time, but not later than 90 days

 

 

SB2359- 5 -LRB103 30648 DTM 57106 b

1after the court unseals the tracking warrant under this
2Section, the issuing or denying judge shall cause to be served
3on the persons named in the warrant and the application an
4inventory which shall include notice of:
5        (1) the fact of the issuance of the warrant or the
6    application;
7        (2) the date of the issuance and the period of
8    authorized, approved, or disapproved collection of
9    location information or the denial of the application; and
10        (3) the fact that during the period location
11    information was or was not collected.
12    (b) A tracking warrant authorizing collection of location
13information must direct:
14        (1) the warrant to be sealed for a period of 90 days or
15    until the objective of the warrant has been accomplished,
16    whichever is shorter; and
17        (2) the warrant to be filed with the court
18    administrator within 10 days of the expiration of the
19    warrant.
20    (c) The State's Attorney may request that the tracking
21warrant, supporting affidavits, and any order granting the
22request not be filed. An order must be issued granting the
23request in whole or in part if, from affidavits, sworn
24testimony, or other evidence, the court finds reasonable
25grounds exist to believe that filing the warrant may cause the
26search or a related search to be unsuccessful, create a

 

 

SB2359- 6 -LRB103 30648 DTM 57106 b

1substantial risk of injury to an innocent person, or severely
2hamper an ongoing investigation.
3    (d) The tracking warrant must direct that following the
4commencement of any criminal proceeding utilizing evidence
5obtained in or as a result of the search, the supporting
6application or affidavit must be filed either immediately or
7at any other time as the court directs. Until such filing, the
8documents and materials ordered withheld from filing must be
9retained by the judge or the judge's designee.
 
10    Section 25. Report on collection of location information.
11    (a) At the same time as notice is provided under paragraph
12(4), the issuing or denying judge shall report to the State
13court administrator:
14        (1) the fact that a tracking warrant or extension was
15    applied for;
16        (2) the fact that the warrant or extension was granted
17    as applied for, was modified, or was denied;
18        (3) the period of collection authorized by the warrant
19    and the number and duration of any extensions of the
20    warrant;
21        (4) the offense specified in the warrant or
22    application or an extension of a warrant;
23        (5) whether the collection required contemporaneous
24    monitoring of an electronic device's location; and
25        (6) the identity of the applying investigative or

 

 

SB2359- 7 -LRB103 30648 DTM 57106 b

1    peace officer and agency making the application and the
2    person authorizing the application.
3    (b) On or before November 15 of each even-numbered year,
4the State court administrator shall transmit to the General
5Assembly a report concerning:
6        (1) all tracking warrants authorizing the collection
7    of location information during the 2 previous calendar
8    years; and
9        (2) all applications that were denied during the 2
10    previous calendar years. Each report shall include a
11    summary and analysis of the data required to be filed
12    under this Section. The report is public and must be
13    available for public inspection at the library of the
14    Legislative Reference Bureau and the State court
15    administrator's office and website.
 
16    Section 30. Prohibition on the use of evidence.
17    (a) Except as proof of a violation of this Section, no
18evidence obtained in violation of this Section shall be
19admissible in any criminal, civil, administrative, or other
20proceeding.
21    (b) Any location information obtained pursuant to this Act
22or evidence derived therefrom shall not be received in
23evidence or otherwise disclosed in any trial, hearing, or
24other proceeding in a federal or State court unless each
25party, not less than 10 days before the trial, hearing, or

 

 

SB2359- 8 -LRB103 30648 DTM 57106 b

1proceeding, has been furnished with a copy of the tracking
2warrant and accompanying application under which the
3information was obtained. This 10-day period may be waived by
4the judge if the judge finds that it was not possible to
5furnish a party with the required information 10 days before
6the trial, hearing, or proceeding and that a party will not be
7prejudiced by the delay in receiving the information.
 
8    Section 35. Limit on storage of license plate data. Any
9captured plate data collected or retained by any governmental
10or private entity or individual through the use of an
11automated license plate recognition system may not be stored
12for more than 180 days unless, in the case of a governmental
13entity, the data is retained or stored as part of an ongoing
14governmental investigation, and in that case, the data shall
15be destroyed at the conclusion of either:
16        (1) an investigation that does not result in any
17    criminal charges being filed; or
18        (2) any criminal action undertaken in the matter
19    involving the captured plate data.
 
20    Section 40. Prohibition on transfer of license plate data.
21No governmental entity shall transfer captured plate data
22except for the purpose of conducting criminal investigations
23and ensuring compliance with the law.
24    No governmental entity, private entity, or individual

 

 

SB2359- 9 -LRB103 30648 DTM 57106 b

1shall sell captured plate data for any purpose.
 
2    Section 45. Student online personal information
3protection.
4    (a) An operator shall not knowingly engage in any of the
5following activities with respect to the operator's site,
6service, or application:
7        (1) engage in targeted advertising on the operator's
8    site, service, or application or target advertising on any
9    other site, service, or application when the targeting of
10    the advertising is based upon any information, including
11    covered information and persistent unique identifiers that
12    the operator has acquired because of the use of that
13    operator's site, service, or application;
14        (2) use information, including persistent unique
15    identifiers, created or gathered by the operator's site,
16    service, or application to amass a profile about a K–12
17    student except in furtherance of a K–12 school purpose;
18        (3) sell a student's information, including covered
19    information. This prohibition does not apply to the
20    purchase, merger, or other type of acquisition of an
21    operator by another entity, provided that the operator or
22    successor entity continues to be subject to the provisions
23    of this Section with respect to previously acquired
24    student information; and
25        (4) disclose covered information unless the disclosure

 

 

SB2359- 10 -LRB103 30648 DTM 57106 b

1    is made:
2            (A) in furtherance of the K–12 school purpose of
3        the site, service, or application, provided the
4        recipient of the covered information disclosed
5        pursuant to this subsection:
6                (i) shall not further disclose the information
7            unless done to allow or improve operability and
8            functionality within that student's classroom or
9            school; and
10                (ii) is legally required to comply with
11            subsection (c);
12            (B) to ensure legal and regulatory compliance;
13            (C) to respond to or participate in judicial
14        process;
15            (D) to protect the safety of users or others or
16        security of the site; or
17            (E) to a service provider, provided the operator
18        contractually: (i) prohibits the service provider from
19        using any covered information for any purpose other
20        than providing the contracted service to, or on behalf
21        of, the operator; (ii) prohibits the service provider
22        from disclosing any covered information provided by
23        the operator with subsequent third parties; and (iii)
24        requires the service provider to implement and
25        maintain reasonable security procedures and practices
26        as provided in subsection (c).

 

 

SB2359- 11 -LRB103 30648 DTM 57106 b

1    (b) Nothing in subsection (a) shall be construed to
2prohibit the operator's use of information for maintaining,
3developing, supporting, improving, or diagnosing the
4operator's site, service, or application.
5    (c) An operator shall:
6        (1) implement and maintain reasonable security
7    procedures and practices appropriate to the nature of the
8    covered information and protect that information from
9    unauthorized access, destruction, use, modification, or
10    disclosure; and
11        (2) delete a student's covered information if the
12    school or district requests deletion of data under the
13    control of the school or district.
14    (d) Notwithstanding paragraph (4) of subsection (a), an
15operator may disclose covered information of a student, as
16long as paragraphs (1) through (3) of subsection (a) are not
17violated, under the following circumstances:
18        (1) if other provisions of federal or State law
19    require the operator to disclose the information, and the
20    operator complies with the requirements of federal and
21    state law in protecting and disclosing that information;
22        (2) for legitimate research purposes: (i) as required
23    by State or federal law and subject to the restrictions
24    under applicable State and federal law; or (ii) as allowed
25    by State or federal law and under the direction of a
26    school, school district, or state department of education,

 

 

SB2359- 12 -LRB103 30648 DTM 57106 b

1    if no covered information is used for any purpose in
2    furtherance of advertising or to amass a profile on the
3    student for purposes other than K–12 school purposes; and
4        (3) to a State or local educational agency, including
5    schools and school districts for K–12 school purposes, as
6    permitted by State or federal law.
7    (e) Nothing in this Section prohibits an operator from
8using deidentified student covered information as follows:
9        (1) within the operator's site, service, or
10    application or other sites, services, or applications
11    owned by the operator to improve educational products; and
12        (2) to demonstrate the effectiveness of the operator's
13    products or services, including in the operator's
14    marketing.
15    (f) Nothing in this Section prohibits an operator from
16sharing aggregated deidentified student covered information
17for the development and improvement of educational sites,
18services, or applications.
19    (g) As used in this Section:
20    "Covered information" means personally identifiable
21information or materials, in any media or format that meets
22any of the following:
23        (1) is created or provided by a student, or the
24    student's parent or legal guardian, to an operator in the
25    course of the student's, parent's, or legal guardian's use
26    of the operator's site, service, or application for K–12

 

 

SB2359- 13 -LRB103 30648 DTM 57106 b

1    school purposes;
2        (2) is created or provided by an employee or agent of
3    the K–12 school, school district, local education agency,
4    or county office of education, to an operator; or
5        (3) is gathered by an operator through the operation
6    of a site, service, or application and is descriptive of a
7    student or otherwise identifies a student, including, but
8    not limited to, information in the student's educational
9    record or email, first and last name, home address,
10    telephone number, email address, other information that
11    allows physical or online contact, discipline records,
12    test results, special education data, juvenile dependency
13    records, grades, evaluations, criminal records, medical
14    records, health records, social security number, biometric
15    information, disabilities, socioeconomic information,
16    food purchases, political affiliations, religious
17    information, text messages, documents, student
18    identifiers, search activity, photos, voice recordings, or
19    geolocation information.
20    "K–12 school purposes" means purposes that customarily
21take place at the direction of the K–12 school, teacher, or
22school district or aid in the administration of school
23activities, including, but not limited to, instruction in the
24classroom or at home, administrative activities, collaboration
25between students, school personnel, or parents, or are for the
26use and benefit of the school.

 

 

SB2359- 14 -LRB103 30648 DTM 57106 b

1    "Online service" means cloud computing services, which
2must comply with this Section if the cloud computing services
3otherwise meet the definition of an operator.
4    (h) This Section shall not be construed to limit the
5authority of a law enforcement agency to obtain any content or
6information from an operator as authorized by law or pursuant
7to an order of a court of competent jurisdiction.
8    (i) This Section does not limit the ability of an operator
9to use student data, including covered information, for
10adaptive learning or customized student learning purposes.
11    (j) This Section does not apply to general audience
12Internet websites, general audience online services, general
13audience online applications, or general audience mobile
14applications, even if login credentials created for an
15operator's site, service, or application may be used to access
16those general audience sites, services, or applications.
17    (k) This Section does not limit Internet service providers
18from providing Internet connectivity to schools or students
19and the students' families.
20    (l) This Section shall not be construed to prohibit an
21operator of an Internet website, online service, online
22application, or mobile application from marketing educational
23products directly to parents so long as the marketing did not
24result from the use of covered information obtained by the
25operator through the provision of services covered under this
26Section.

 

 

SB2359- 15 -LRB103 30648 DTM 57106 b

1    (m) This Section does not impose a duty upon a provider of
2an electronic store, gateway, marketplace, or other means of
3purchasing or downloading software or applications to review
4or enforce compliance of this Section on those applications or
5software.
6    (n) This Section does not impose a duty upon a provider of
7an interactive computer service, as defined in 47 U.S.C. 230,
8to review or enforce compliance with this Section by
9third-party content providers.
10    (o) This Section does not impede the ability of students
11to download, export, or otherwise save or maintain the
12student's own student created data or documents.
 
13    Section 97. Severability. The provisions of this Act are
14severable under Section 1.31 of the Statute on Statutes.