HB4088eng 96TH GENERAL ASSEMBLY

HB4088 Engrossed LRB096 09577 MJR 22568 b

AN ACT concerning privacy.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Illinois Accurate Government Records Act.

Section 5. Findings. The General Assembly declares that the right to privacy is a personal and fundamental right protected by the Constitution of the United States and the Constitution of the State of Illinois and that all individuals have a right of privacy in information pertaining to them. The General Assembly further makes the following findings:

(1) The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.

(2) The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.

(3) In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits.

Section 10. Definitions. For purposes of this Act:

"Agency" means any State agency or local agency.

"Individual" means a natural person.

"Local agency" means any municipal corporation, school district, special purpose district, or township of the State or any elected officer or board, bureau, commission, department, division, institution, or instrumentality of a county.

"Maintain" means to maintain, collect, use, or disseminate.

"Personal record" means any item, collection, or grouping of information about an individual that is maintained by an agency. A personal record includes, but is not limited to, the individual's education, financial, medical, or employment history, or items that contain or make reference to the individual's name, identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.

"Routine use" means, with respect to the disclosure of a record, the use of the record for a purpose that is compatible with the purpose for which it was collected.

"State agency" means the office of any elected State officer and any agency, board, commission, department, division, or educational institution of the State.

"System of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to that individual.

Section 15. Access to personal records.

(a) Upon the request of an individual to gain access to the individual's personal record, an agency shall permit the individual to review the record and have a copy made within 10 working days after the date of receipt of the request by the agency, unless the personal record requested is exempted under subsection (c) to this Section. The 10-day period may be extended for an additional 20 working days if the agency provides to the individual, within the initial 10 working days, a written explanation of unusual circumstances causing the delay.

(b) Each agency that maintains any accessible personal record shall make that record available to the individual to whom it pertains in a reasonably intelligible form. Where necessary the agency shall provide a translation into common terms of any machine readable code or any code or abbreviation employed for internal agency use.

(c) An agency is not required under this Section to grant an individual access to personal records or information in records:

(1) Maintained by an agency that performs as its or as a principal function any activity pertaining to the prevention, control, or reduction of crime, and which consist of:

(A) information or reports prepared or compiled for the purpose of criminal intelligence or of a criminal investigation, including reports of informers, witnesses, and investigators; or

(B) reports prepared or compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through confinement, correctional supervision, and release from supervision.

(2) The disclosure of which would reveal the identity of a source who furnished information to the agency under an express or implied promise of confidentiality.

(3) Consisting of testing or examination material or scoring keys used solely to determine individual qualifications for appointment or promotion in public employment, or used as or to administer a licensing examination or an academic examination, the disclosure of which would compromise the objectivity, fairness, or effectiveness of the testing or examination process.

(4) Including investigative reports and materials, related to an upcoming, ongoing, or pending civil or criminal action or administrative proceeding against the individual.

(5) Required to be withheld from the individual to whom it pertains by statute or judicial decision or authorized to be so withheld by constitutional or statutory privilege.

(d) Nothing in this Section shall be construed to permit or require an agency to withhold or deny access to a personal record or any information in a personal record:

(1) when the agency is ordered to produce, disclose, or allow access to the record or information in the record, or when discovery of such record or information is allowed by prevailing rules of discovery or by subpoena, in any judicial or administrative proceeding; or

(2) where any statute, administrative rules, rule of court, judicial decision, or other law authorizes or allows an individual to gain access to a personal record or to any information in a personal record or requires that the individual be given such access.

Section 20. Correction of personal records.

(a) Each agency shall permit an individual to request in writing an amendment of a personal record, and shall within 30 days after the date of receipt of such request:

(1) make each correction in accordance with the individual's request of any portion of a personal record that the individual believes is not accurate, relevant, timely, or complete and inform the individual of the corrections made in accordance with his or her request; or

(2) inform the individual of its refusal to amend the personal record in accordance with such individual's request, the reason for the refusal, the procedures established by the agency for the individual to request a review by the head of the agency or an official specifically designated by the head of the agency of the refusal to amend, and the name, title, and business address of the reviewing official.

(b) Each agency shall permit any individual who disagrees with the refusal of the agency to amend a personal record to request a review of such refusal by the head of the agency or an official specifically designated by the head of the agency, and, not later than 30 days after the date on which the individual requests such review, complete the review and make a final determination unless, for good cause shown, the head of the agency extends the review period by 30 days.

(c) If, after review, the reviewing official refuses to amend the personal record in accordance with the request, the agency shall permit the individual to file with the agency a statement of reasonable length setting forth the reasons for the individual's disagreement.

(d) The agency, with respect to any disclosure containing information about which the individual has filed a statement of disagreement, shall clearly note any portion of the personal record that is disputed and make available copies of such individual's statement, and copies of a concise statement of the reasons of the agency for not making the amendment, to any person or agency to whom the disputed record has been or is disclosed.

Section 25. Limitations on an agency's disclosure of personal records.

(a) No agency shall disclose any personal record by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be:

(1) to those officers and employees of the agency that maintains the record who have a need for the record in the performance of their duties;

(2) pursuant to and to the extent required by the Freedom of Information Act;

(3) for a routine use;

(4) to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(5) to the State archives as a record that has sufficient historical or other value to warrant its continued preservation;

(6) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought;

(7) to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of the individual;

(8) to either chamber of the General Assembly, or, to the extent of matter within its jurisdiction, any committee or subcommittee of the General Assembly;

(9) to either the Comptroller or the Auditor General, or any of his or her authorized representatives, in the course of the performance of his or her duties;

(10) pursuant to the order of a court of competent jurisdiction; or

(11) to a consumer reporting agency as permitted or allowed by federal or State statute.

(b) An individual's name and address may not be sold or rented by an agency unless that action is specifically authorized by law. This subsection (b) shall not be construed to require the withholding of names and addresses otherwise permitted to be made public.

Section 30. Limitations on an agency's maintenance of systems of personal records. Each agency that maintains a system of records shall do all of the following:

(1) Maintain in its personal records only the information about an individual as is relevant and necessary to accomplish a purpose of the agency required or authorized by the Illinois Constitution or statute or mandated by the federal government.

(2) Collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under State programs.

(3) Inform each individual whom it asks to supply personal information, on the form that it uses to collect the information or on a separate form that can be retained by the individual:

(A) the authority, whether granted by statute, or by executive order of the Governor, that authorizes the solicitation of the information and whether disclosure of the information is mandatory or voluntary;

(B) the principal purpose or purposes for which the information is intended to be used;

(C) the routine uses that may be made of the information; and

(D) the effects on the individual, if any, of not providing all or any part of the requested information.

(4) Publish upon establishment or revision a notice of the existence and character of the system of records, which notice shall include the following:

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(C) the categories of records maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his or her request if the system of records contains a record pertaining to him or her;

(H) the agency procedures whereby an individual can be notified at his or her request how he or she can gain access to any record pertaining to him or her contained in the system of records, and how he or she may contest its content; and

(I) the categories of sources of records in the system.

(5) Maintain all records that are used by the agency in making any determination about any individual with accuracy, relevance, timeliness, and completeness as is reasonably necessary to ensure fairness to the individual in the determination.

(6) Prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to the Freedom of Information Act, make reasonable efforts to ensure that the records are accurate, complete, timely, and relevant for agency purposes.

(7) Make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record.

(8) Establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information and instruct each person with respect to such rules and the requirements of this Act, including any other rules and procedures adopted pursuant to this Act, and the remedies and penalties for noncompliance.

(9) Establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the provisions of this Act, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to their security or integrity that could result in any injury.

Section 35. Limitations on an agency's maintenance of personal records. An agency shall maintain no personal record, whether or not the personal record is part of a system of records, describing how any individual exercises rights guaranteed by the First Amendment to the United States Constitution or Sections 3, 4, or 5 of Article I of the Illinois Constitution, unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity.

Section 40. Civil remedies.

(a) An individual may bring a civil action against an agency in a circuit court of the State whenever an agency fails to comply with any provision of this Act, and after appropriate administrative remedies have been exhausted.

(b) In any action brought by an individual under this Section, the court may:

(1) order the agency to disclose, correct, or amend the individual's personal record;

(2) issue an injunction to require any other agency action, or to enjoin the agency from improper actions, as the court may deem necessary and appropriate to render substantial relief; and

(3) assess reasonable attorney's fees and other litigation costs reasonably incurred against the agency in any case in which the individual has partially prevailed.

(c) In any action brought by an individual under this Section in which the court determines that the agency knowingly or intentionally violated a provision of this Act, the agency shall be liable to the individual in an amount equal to the sum of:

(1) actual damages sustained by the individual as a result of the failure of the agency to properly maintain the personal record, but in no case shall an individual entitled to recovery receive less than the sum of $1,000; and

(2) the costs of the action together with reasonable attorney's fees as determined by the court.

(d) An action may be brought in the circuit court where the complainant resides, the complainant's principal place of business is situated, or the complainant's relevant personal record is situated. No action shall be brought later than 2 years after notification of the agency denial or, where applicable, the date of receipt of the final determination of the office of information practices.

(e) In addition to an action by an individual under this Act, actions for injunction under this Section may also be prosecuted by the Attorney General, or any State's Attorney in this State, in the name of the people of the State of Illinois.

(f) The rights and remedies set forth in this Act shall be deemed to be nonexclusive and are in addition to all those rights and remedies that are otherwise available under any other provision of law.

Section 45. Agency responsibilities. Each agency shall: (1) issue instructions and guidelines necessary to effectuate this Act; and (2) take steps to ensure that all its employees and officers responsible for the collection, maintenance, use, and dissemination of personal records are informed of the requirements of this Act.

Section 50. Attorney General responsibilities. The Office of the Attorney General of Illinois:

(1) shall develop and, after notice and opportunity for public comment, prescribe guidelines and rules for the use of agencies in implementing the provisions of this Section;

(2) shall provide continuing assistance to and oversight of the implementation of this Section by agencies;

(3) shall biennially submit to the Speaker of the House of Representatives and the President of the Senate a report:

(A) describing the actions of the Attorney General pursuant to this Section during the preceding 2 years;

(B) describing the exercise of individual rights of access and amendment under this Section during those years;

(C) identifying changes in or additions to systems of records; and

(D) containing such other information concerning administration of this Section as may be necessary or useful to the General Assembly in reviewing the effectiveness of this Section in carrying out the purposes of this Act;

(4) may, upon request by any person, provide advisory opinions or other information regarding that person's rights and the functions and responsibilities of agencies under this Act; and

(5) shall receive complaints from and actively solicit the comments of the public regarding the implementation of this Act.

Section 55. Government contractors. If an agency provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, then the agency shall, consistent with its authority, cause the requirements of this Section to be applied to that system.

Section 60. Rights of legal guardians. For the purposes of this Section, the parent of any minor, or the legal guardian of any individual who has been declared to be incompetent due to physical or mental incapacity or age by a court of competent jurisdiction, may act on behalf of the individual.