HB4975 101ST GENERAL ASSEMBLY

LRB101 19418 JLS 68890 b

101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
HB4975

Introduced 2/18/2020, by Rep. Deanne M. Mazzochi

SYNOPSIS AS INTRODUCED:

815 ILCS 530/22 new

Amends the Personal Information Protection Act. Creates an intellectual property right in persons for the continued use of the individual's personal information (1) when there is a failure to cure a violation within 30 days or (2) when a person's personal information cannot be certified to be fully retrieved from an entity engaging in an unauthorized acquisition or those to whom the individual's data was further conveyed. Provides for the recovery of actual damages and for recovery of statutory damages in the amount of $3,000 per year for a period of 5 years.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Personal Information Protection Act is amended by adding Section 22 as follows:

(815 ILCS 530/22 new)

Sec. 22. Intellectual property right.

(a) An affected individual has an intellectual property right for the continued use of the individual's personal information (1) when there is a failure to cure a violation of this Act within 30 days or (2) when the individual's personal information cannot be certified to be fully retrieved from an entity engaging in an unauthorized acquisition or those to whom the data was further conveyed, used, or sold.

(b) The affected individual is entitled to recover (1) the actual damages suffered by him or her as a result of the continued infringement of the individual's intellectual property rights and any profits of the infringer that are attributable to the infringement from the breach and (2) statutory damages in the amount of $3,000 per year per breach for a period of 5 years.

(c) The burden of proof is on the intellectual property owner to present evidence only of the infringer's gross profits. The infringer is required to prove his or her deductible expenses and elements of profit not attributable to factors associated with the breach and infringement of data privacy rights.

(d) If the perpetrator of the unauthorized acquisition cannot be found, any entity holding or transmitting the breached personal data may be responsible for such liability.