On May 4, 2017, the Illinois State Senate passed a bill requiring websites and apps to notify their Illinois customers of the personally identifiable information they collect and disclose and with whom they share it. If enacted, this would expand existing Illinois law, which only requires notification of security breaches. 

The bill, titled the “Right to Know Act,” was designed to recognize “the importance of providing consumers with transparency about how their personal information, especially information relating to their children, is shared by businesses,” and to help them “protect themselves and their families from cyber-crimes and identity thieves.” Toward this end, the bill requires that operators of commercial websites or online services (“Operators”) provide certain information when customers sign up for services, and upon request. Specifically, if ultimately enacted, the Right to Know Act will first require Operators that collect Illinois customers’ “personal information” through the internet to disclose and describe the following to customers in their customer agreements, “Terms of Use,” or incorporated addenda:

• The categories of personal information that the Operator collects about its customers;
• All the types or categories of third parties to which an Operator may disclose a customer’s personal information; and
• A customer’s rights under the Right to Know Act.

Second, the Right to Know Act will require that Operators make certain specified information available to customers who request it, including the names of parties who received the information. Operators must also provide an e-mail address or toll-free telephone number whereby customers may request or obtain the information.

The bill also gives Illinois residents a private right of action. Specifically, customers may recover: (i) liquidated damages of $10 or actual damages, whichever is greater; (ii) injunctive relief, if appropriate; and (iii) reasonable attorneys' fees, costs, and expenses. To appease the business community, this provision replaced a March 2017 version proposed by the State Senate Judiciary Committee that created a right of action for customers to pursue relief under the Illinois Consumer Fraud and Deceptive Business Practices Act.

The bill narrowly passed the Illinois State Senate, with 31 out of a total of 59 senators voting “aye.” The bill now moves to the Illinois House for consideration, against the backdrop of the United States Congress voting to repeal the Federal Communications Commission's broadband privacy rules, which were adopted last fall under the Obama administration and were supposed to go into effect this year. 

The Right to Know Act can be found here.