Extracts :

Extract :

""Sensitive covered data" means the following types of covered data: (1) A government-issued identifier, such as a Social Security number, passport number, or driver's license number, that is not required by law to be displayed in public. (2) Any information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or health condition or treatment of an individual. (3) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual, except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data. (4) Biometric information. (5) Genetic information. (6) Precise geolocation information. (7) An individual's private communications such as voicemail, emails, texts, direct messages, or mail, or information identifying the parties to such communications, voice communications, video communications, and any information that pertains to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location information of the parties to the call, unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication. Communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications. (8) Account or device log-in credentials, or security or access codes for an account or device. (9) Information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection, processing, or transfer of such information. (10) Calendar information, address book information, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location. Such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information. (11) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an individual. (12) Information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in paragraph (4). This paragraph does not include covered data used solely for transfers for independent video measurement. (13) Information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor. (14) An individual's race, color, ethnicity, religion, or union membership. (15) Information identifying an individual's online activities over time and across third party websites or online services. (16) Any other covered data collected, processed, or transferred for the purpose of identifying the types of covered data listed in paragraphs (1) through (15).

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extracts :

Extract :

""Sensitive covered data" means the following types of covered data: (1) A government-issued identifier, such as a Social Security number, passport number, or driver's license number, that is not required by law to be displayed in public. (2) Any information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or health condition or treatment of an individual. (3) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual, except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data. (4) Biometric information. (5) Genetic information. (6) Precise geolocation information. (7) An individual's private communications such as voicemail, emails, texts, direct messages, or mail, or information identifying the parties to such communications, voice communications, video communications, and any information that pertains to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location information of the parties to the call, unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication. Communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications. (8) Account or device log-in credentials, or security or access codes for an account or device. (9) Information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection, processing, or transfer of such information. (10) Calendar information, address book information, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location. Such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information. (11) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an individual. (12) Information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in paragraph (4). This paragraph does not include covered data used solely for transfers for independent video measurement. (13) Information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor. (14) An individual's race, color, ethnicity, religion, or union membership. (15) Information identifying an individual's online activities over time and across third party websites or online services. (16) Any other covered data collected, processed, or transferred for the purpose of identifying the types of covered data listed in paragraphs (1) through (15).

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extracts :

Extract :

""Sensitive covered data" means the following types of covered data: (1) A government-issued identifier, such as a Social Security number, passport number, or driver's license number, that is not required by law to be displayed in public. (2) Any information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or health condition or treatment of an individual. (3) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual, except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data. (4) Biometric information. (5) Genetic information. (6) Precise geolocation information. (7) An individual's private communications such as voicemail, emails, texts, direct messages, or mail, or information identifying the parties to such communications, voice communications, video communications, and any information that pertains to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location information of the parties to the call, unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication. Communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications. (8) Account or device log-in credentials, or security or access codes for an account or device. (9) Information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection, processing, or transfer of such information. (10) Calendar information, address book information, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location. Such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information. (11) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an individual. (12) Information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in paragraph (4). This paragraph does not include covered data used solely for transfers for independent video measurement. (13) Information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor. (14) An individual's race, color, ethnicity, religion, or union membership. (15) Information identifying an individual's online activities over time and across third party websites or online services. (16) Any other covered data collected, processed, or transferred for the purpose of identifying the types of covered data listed in paragraphs (1) through (15).

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extracts :

Extract :

""Sensitive covered data" means the following types of covered data: (1) A government-issued identifier, such as a Social Security number, passport number, or driver's license number, that is not required by law to be displayed in public. (2) Any information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or health condition or treatment of an individual. (3) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual, except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data. (4) Biometric information. (5) Genetic information. (6) Precise geolocation information. (7) An individual's private communications such as voicemail, emails, texts, direct messages, or mail, or information identifying the parties to such communications, voice communications, video communications, and any information that pertains to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location information of the parties to the call, unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication. Communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications. (8) Account or device log-in credentials, or security or access codes for an account or device. (9) Information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection, processing, or transfer of such information. (10) Calendar information, address book information, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location. Such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information. (11) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an individual. (12) Information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in paragraph (4). This paragraph does not include covered data used solely for transfers for independent video measurement. (13) Information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor. (14) An individual's race, color, ethnicity, religion, or union membership. (15) Information identifying an individual's online activities over time and across third party websites or online services. (16) Any other covered data collected, processed, or transferred for the purpose of identifying the types of covered data listed in paragraphs (1) through (15).

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extracts :

Extract :

""Sensitive covered data" means the following types of covered data: (1) A government-issued identifier, such as a Social Security number, passport number, or driver's license number, that is not required by law to be displayed in public. (2) Any information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or health condition or treatment of an individual. (3) A financial account number, debit card number, credit card number, or information that describes or reveals the income level or bank account balances of an individual, except that the last four digits of a debit or credit card number shall not be deemed sensitive covered data. (4) Biometric information. (5) Genetic information. (6) Precise geolocation information. (7) An individual's private communications such as voicemail, emails, texts, direct messages, or mail, or information identifying the parties to such communications, voice communications, video communications, and any information that pertains to the transmission of such communications, including telephone numbers called, telephone numbers from which calls were placed, the time calls were made, call duration, and location information of the parties to the call, unless the covered entity or a service provider acting on behalf of the covered entity is the sender or an intended recipient of the communication. Communications are not private for purposes of this clause if such communications are made from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that such employer may access such communications. (8) Account or device log-in credentials, or security or access codes for an account or device. (9) Information identifying the sexual behavior of an individual in a manner inconsistent with the individual's reasonable expectation regarding the collection, processing, or transfer of such information. (10) Calendar information, address book information, phone or text logs, photos, audio recordings, or videos, maintained for private use by an individual, regardless of whether such information is stored on the individual's device or is accessible from that device and is backed up in a separate location. Such information is not sensitive for purposes of this paragraph if such information is sent from or to a device provided by an employer to an employee insofar as such employer provides conspicuous notice that it may access such information. (11) A photograph, film, video recording, or other similar medium that shows the naked or undergarment-clad private area of an individual. (12) Information revealing the video content requested or selected by an individual collected by a covered entity that is not a provider of a service described in paragraph (4). This paragraph does not include covered data used solely for transfers for independent video measurement. (13) Information about an individual when the covered entity or service provider has knowledge that the individual is a covered minor. (14) An individual's race, color, ethnicity, religion, or union membership. (15) Information identifying an individual's online activities over time and across third party websites or online services. (16) Any other covered data collected, processed, or transferred for the purpose of identifying the types of covered data listed in paragraphs (1) through (15).

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extracts :

Extract :

"The policy must include, at a minimum, the following: (1) The identity and the contact information of: (A) the covered entity or service provider to which the privacy policy applies (including the covered entity's or service provider's points of contact and generic electronic mail addresses, as applicable for privacy and data security inquiries); and (B) any other entity within the same corporate structure as the covered entity or service provider to which covered data is transferred by the covered (2) The categories of covered data the covered entity or service provider collects or processes. (3) The processing purposes for each category of covered data the covered entity or service provider collects or processes. (4) Whether the covered entity or service provider transfers covered data and, if so, each category of service provider and third party to which the covered entity or service provider transfers covered data, the name of each data broker to which the covered entity or service provider transfers covered data, and the purposes for which such data is transferred to such categories of service providers and third parties or third-party collecting entities, except for a transfer to a governmental entity pursuant to a court order or law that prohibits the covered entity or service provider from disclosing such transfer. (5) The length of time the covered entity or service provider intends to retain each category of covered data, including sensitive covered data, or, if it is not possible to identify that timeframe, the criteria used to determine the length of time the covered entity or service provider intends to retain categories of covered data. (6) A prominent description of how an individual can exercise the rights described in this Act. (7) A general description of the covered entity's or service provider's data security practices. (8) The effective date of the privacy policy."

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extract :

Extracts :

Extract :

"The policy must include, at a minimum, the following: (1) The identity and the contact information of: (A) the covered entity or service provider to which the privacy policy applies (including the covered entity's or service provider's points of contact and generic electronic mail addresses, as applicable for privacy and data security inquiries); and (B) any other entity within the same corporate structure as the covered entity or service provider to which covered data is transferred by the covered (2) The categories of covered data the covered entity or service provider collects or processes. (3) The processing purposes for each category of covered data the covered entity or service provider collects or processes. (4) Whether the covered entity or service provider transfers covered data and, if so, each category of service provider and third party to which the covered entity or service provider transfers covered data, the name of each data broker to which the covered entity or service provider transfers covered data, and the purposes for which such data is transferred to such categories of service providers and third parties or third-party collecting entities, except for a transfer to a governmental entity pursuant to a court order or law that prohibits the covered entity or service provider from disclosing such transfer. (5) The length of time the covered entity or service provider intends to retain each category of covered data, including sensitive covered data, or, if it is not possible to identify that timeframe, the criteria used to determine the length of time the covered entity or service provider intends to retain categories of covered data. (6) A prominent description of how an individual can exercise the rights described in this Act. (7) A general description of the covered entity's or service provider's data security practices. (8) The effective date of the privacy policy."

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extract :

Extracts :

Extract :

"The policy must include, at a minimum, the following: (1) The identity and the contact information of: (A) the covered entity or service provider to which the privacy policy applies (including the covered entity's or service provider's points of contact and generic electronic mail addresses, as applicable for privacy and data security inquiries); and (B) any other entity within the same corporate structure as the covered entity or service provider to which covered data is transferred by the covered (2) The categories of covered data the covered entity or service provider collects or processes. (3) The processing purposes for each category of covered data the covered entity or service provider collects or processes. (4) Whether the covered entity or service provider transfers covered data and, if so, each category of service provider and third party to which the covered entity or service provider transfers covered data, the name of each data broker to which the covered entity or service provider transfers covered data, and the purposes for which such data is transferred to such categories of service providers and third parties or third-party collecting entities, except for a transfer to a governmental entity pursuant to a court order or law that prohibits the covered entity or service provider from disclosing such transfer. (5) The length of time the covered entity or service provider intends to retain each category of covered data, including sensitive covered data, or, if it is not possible to identify that timeframe, the criteria used to determine the length of time the covered entity or service provider intends to retain categories of covered data. (6) A prominent description of how an individual can exercise the rights described in this Act. (7) A general description of the covered entity's or service provider's data security practices. (8) The effective date of the privacy policy."

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extract :

Extracts :

Extract :

"The policy must include, at a minimum, the following: (1) The identity and the contact information of: (A) the covered entity or service provider to which the privacy policy applies (including the covered entity's or service provider's points of contact and generic electronic mail addresses, as applicable for privacy and data security inquiries); and (B) any other entity within the same corporate structure as the covered entity or service provider to which covered data is transferred by the covered (2) The categories of covered data the covered entity or service provider collects or processes. (3) The processing purposes for each category of covered data the covered entity or service provider collects or processes. (4) Whether the covered entity or service provider transfers covered data and, if so, each category of service provider and third party to which the covered entity or service provider transfers covered data, the name of each data broker to which the covered entity or service provider transfers covered data, and the purposes for which such data is transferred to such categories of service providers and third parties or third-party collecting entities, except for a transfer to a governmental entity pursuant to a court order or law that prohibits the covered entity or service provider from disclosing such transfer. (5) The length of time the covered entity or service provider intends to retain each category of covered data, including sensitive covered data, or, if it is not possible to identify that timeframe, the criteria used to determine the length of time the covered entity or service provider intends to retain categories of covered data. (6) A prominent description of how an individual can exercise the rights described in this Act. (7) A general description of the covered entity's or service provider's data security practices. (8) The effective date of the privacy policy."

2023

Reference :

HB 3385 | Illinois Data Privacy and Protection Act

Information on Illinois data protection regulations

Link to reference

Extract :

Legal text name	Original text name	Legislation type	Year signed	Regulation status	In effect since	Latest update initiated	Latest update areas	Latest update signed year
	Illinois Data Privacy and Protection Act \| HB 3385	General privacy/data protection law	null	In legal process
SB1624	Personal Information Protection Act (PIPA)	Data breach law	2006	Active	2006	2017		2020

🇺🇸 US-Illinois

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : Yes

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Differentiation between how data controller and data processor are defined : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": financial data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : No

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : No

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : Yes

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : No

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : No

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 46447

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors :

Requirement of a DPIA : No

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : No

Right to data portability : Yes

Right against automated decision making : No

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : No

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : Yes

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : Yes

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : Yes

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : No