SB2082 102ND GENERAL ASSEMBLY

LRB102 12551 JLS 17889 b

102ND GENERAL ASSEMBLY
State of Illinois
2021 and 2022
SB2082

Introduced 2/26/2021, by Sen. Cristina Castro

SYNOPSIS AS INTRODUCED:

New Act

Creates the Keep Internet Devices Safe Act. Includes a statement of legislative intent and defines terms. Provides that a private entity may turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to listen for or collect information, including spoken words or other audible or inaudible sounds, if the private entity makes specified disclosures in its customer agreement or other incorporated addendum. Provides that a private entity that collects, stores, or transmits any information collected through a digital device's microphone concerning an Illinois resident shall implement and maintain reasonable security measures to protect that information from unauthorized access, acquisition, destruction, use, modification, and disclosure. Adds provisions governing waiver, applicability, and exceptions. Provides that a violation of the Keep Internet Devices Safe Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Keep Internet Devices Safe Act.

Section 5. Findings; intent. The General Assembly finds the following:

(1) An increasing number of everyday household devices, such as smartphones, televisions, cars, toys, and home appliances, are being enhanced by speech recognition and other technologies that use microphones to listen for environmental triggers. As a result, private companies are gaining unprecedented and near constant access to Illinois citizens and their families' private lives, including what they do in their homes and their daily habits.

(2) While there are tremendous benefits from these technologies, the collection of personal information from Internet-connected devices pose serious privacy and physical safety risks to Illinois citizens and children. Children's toys now have microphones that can record and collect personal information from conversations within earshot of the device.

(3) The increasing prevalence of these technologies in everyday devices enables companies to collect, store, analyze, and share increasing amounts of personal data, often without Illinois families ever knowing. Illinois citizens have a right to their personal data, and the public welfare, security, and safety will be served by requiring companies to be transparent about their data collection and sharing practices.

(4) It is the public policy of the State of Illinois to ensure that Illinois citizens be aware of and have control over whether a private entity records, collects, stores, or discloses their personal information and to ensure that their personal information is maintained in a secure manner.

Section 10. Definitions. In this Act:

"Digital device" means a smartphone, tablet, television, computer, car, toy, home appliance, or any other device that may be used for personal, family, or household purposes that contains a microphone.

"Microphone" means an instrument capable of listening for, collecting, recording, analyzing, transmitting, interpreting, or otherwise using spoken words or other audible or inaudible sounds.

"Private entity" means any partnership, corporation, limited liability company, association, organization or other group, regardless of organizational structure, or any agent thereof. "Private entity" does not include a State or local governmental agency.

"Person" means a resident of this State who purchases or leases a digital device for personal or household use.

Section 15. Collection, use, storage, or disclosure of information from a digital device's microphone.

(a) No private entity may turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to listen for or collect information, including spoken words or other audible or inaudible sounds, unless the private entity, in its customer agreement or other incorporated addendum, states the following:

(1) that the digital device's microphone may be turned on, enabled, or used;

(2) the commands or actions that may turn on or enable the microphone;

(3) whether the microphone is listening for an audible or inaudible sound, or both; and

(4) the general purpose for which the information may be collected, used, stored, or disclosed.

(b) A manufacturer of a digital device that does not turn on or enable, cause to be turned on or enabled, or otherwise use a digital device's microphone to listen for or collect information is not subject to this Section.

Section 20. Security measures. A private entity that collects, stores, or transmits any information collected through a digital device's microphone concerning an Illinois resident shall implement and maintain reasonable security measures to protect that information from unauthorized access, acquisition, destruction, use, modification, and disclosure.

Section 25. Violation. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

Section 30. General provisions.

(a) Any waiver of the provisions of this Act is void and unenforceable.

(b) Any agreement created or modified after the effective date of this Act that does not comply with this Act is void and unenforceable.