AI & Privacy · Illinois Data Privacy · Chicago

Illinois Data Privacy Compliance

Counsel for Chicago and Illinois businesses on the Biometric Information Privacy Act, the Genetic Information Privacy Act, and the breach notice and data security duties of the Personal Information Protection Act, put in place before a claim or an incident tests them.

A fingerprint timeclock, a health questionnaire in a hiring packet and a laptop full of customer records each fall under a different Illinois statute. Two of those statutes let the affected person sue and set liquidated damages, and a third is enforced through the Consumer Fraud and Deceptive Business Practices Act. Lincoln Square Law handles Illinois data privacy compliance for employers, healthcare practices and other regulated businesses: we identify which statutes reach the data a business holds and put the required documents and controls in place.

The Illinois privacy statutes and what triggers each one

The Illinois duties covered on this page sit in separate statutes, each with its own trigger. The first task is to match the data to the statute.

• Biometric Information Privacy Act (BIPA), 740 ILCS 14. Triggered when a private entity collects or holds a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, or information based on one of them that is used to identify a person.
• Genetic Information Privacy Act (GIPA), 410 ILCS 513. Triggered by genetic testing and genetic information, including in hiring and employment.
• Personal Information Protection Act (PIPA), 815 ILCS 530. Triggered when a business owns, licenses, maintains or stores records containing personal information about Illinois residents.
• Mental Health and Developmental Disabilities Confidentiality Act, 740 ILCS 110. Triggered when a therapist or agency keeps records or receives communications in the course of mental health or developmental disabilities services.

BIPA: what must exist before the first scan

BIPA puts its main duties ahead of collection. A private entity in possession of biometric identifiers or biometric information must have a written policy, made available to the public, with a retention schedule and guidelines for permanent destruction when the purpose of collection has been satisfied or within 3 years of the person’s last interaction with the entity, whichever comes first (740 ILCS 14/15(a)). Before it collects, the entity must tell the person in writing that a biometric is being collected or stored, state in writing the specific purpose and length of time, and receive a written release (740 ILCS 14/15(b)).

The Act also prohibits selling, leasing, trading or otherwise profiting from a person’s biometrics, limits disclosure to listed circumstances such as consent, and requires protection under the reasonable standard of care in the entity’s industry, at least as protective as the way it guards other confidential and sensitive information (740 ILCS 14/15(c), (d), (e)). A person aggrieved by a violation may sue for liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages, plus attorney’s fees and an injunction (740 ILCS 14/20(a)).

The 2024 BIPA amendment: one recovery per person, and electronic signatures

Public Act 103-769, effective August 2, 2024, changed how damages accrue. An entity that collects the same biometric from the same person by the same method more than once, in violation of the notice and release requirement, has committed a single violation for which that person is entitled to at most one recovery (740 ILCS 14/20(b)). The same rule applies to repeated disclosure of the same biometric to the same recipient (740 ILCS 14/20(c)). The amendment also added electronic signature to the definition of written release, so a release may be signed electronically (740 ILCS 14/10).

The amendment did not change what the Act requires. The policy, the notice, the release, the limits on disclosure and the security duty all remain, and each employee or customer whose biometrics were collected without them may still bring a claim.

Who and what BIPA does not cover

The exclusions matter as much as the duties. Biometric identifiers do not include information captured from a patient in a health care setting, or information collected, used or stored for health care treatment, payment or operations under HIPAA (740 ILCS 14/10). That exclusion is written around patients. A practice that uses a fingerprint timeclock for its staff should not assume it applies to employee data. The Act also does not apply to a financial institution subject to Title V of the Gramm-Leach-Bliley Act, or to a contractor of a State agency or local government when working for that agency (740 ILCS 14/25). Photographs and written signatures are not biometric identifiers, but a scan of face geometry is.

Genetic information in hiring and employment

GIPA is the statute employers tend to meet through a pre-employment physical. An employer may not directly or indirectly solicit, request, require or purchase genetic testing or genetic information of a person or a family member as a condition of employment or a preemployment application, and may not use that information to affect the terms of employment or retaliate against a person who alleges a violation (410 ILCS 513/25(c)). The Act borrows the HIPAA definition of genetic information, which includes the manifestation of a disease or disorder in family members (410 ILCS 513/10, 45 C.F.R. 160.103). A family medical history question on an intake form is therefore a GIPA question.

A person aggrieved by a violation may recover liquidated damages of $2,500 or actual damages, whichever is greater, for a negligent violation, and $15,000 or actual damages for an intentional or reckless one, with attorney’s fees (410 ILCS 513/40). We review hiring packets, occupational health vendor forms and wellness program materials, and we recommend removing family history questions the employer does not need.

PIPA: reasonable security, breach notice and disposal

PIPA reaches any business that holds records with personal information about Illinois residents. Personal information means a person’s name combined with a Social Security number, a driver’s license or State identification card number, a financial account, credit or debit card number, medical information, health insurance information or unique biometric data, when the name or the data element is not encrypted or redacted. A user name or email address with the password or security answer that gives access to an online account is also covered (815 ILCS 530/5). The Act imposes three kinds of duty.

• Security. A data collector that owns, licenses, maintains or stores records containing personal information about an Illinois resident must implement and maintain reasonable security measures, and a contract that discloses that information to another party must require the recipient to do the same (815 ILCS 530/45).
• Breach notice. After discovering a breach, the owner or licensee of the data must notify affected Illinois residents at no charge, in the most expedient time possible and without unreasonable delay. A business that only maintains or stores the data must notify the owner or licensee immediately following discovery. When a single breach requires notice to more than 500 Illinois residents, the Attorney General must be notified no later than the residents are (815 ILCS 530/10(e)). Entities regulated under HIPAA follow a separate provision.
• Disposal. Materials containing personal information must be disposed of in a way that leaves the information unreadable, unusable and undecipherable, and the Attorney General may seek civil penalties for improper disposal (815 ILCS 530/40).

A violation of PIPA is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act (815 ILCS 530/20). In practice the statute calls for a written security program sized to the business, vendor contracts that carry the security clause, and an incident plan that names who decides whether notice is owed.

Mental health records and other health information

Behavioral health clients work under their own confidentiality statute. Under the Mental Health and Developmental Disabilities Confidentiality Act, all records and communications are confidential and may be disclosed only as the Act provides (740 ILCS 110/3). Outside the listed exceptions, disclosure requires written consent on a form that states the recipient, the purpose, the information to be disclosed, the right to inspect and copy it, the consequences of refusing, the date the consent expires and the right to revoke (740 ILCS 110/5). A person aggrieved by a violation may sue for damages and an injunction, with attorney’s fees (740 ILCS 110/15). HIPAA applies alongside these rules, and our healthcare compliance page explains how the two fit together.

How we build an Illinois privacy program

We start with a data map: what the business collects, from whom, on which devices and systems, and which vendors receive it. From the map we prepare the BIPA policy, notice and release, and we check that the vendor behind the device is bound to the same retention and security terms. We revise hiring and occupational health forms for GIPA. We write the PIPA security program, the vendor clause and the incident plan. When a demand letter or lawsuit has already arrived, we assess the exposure and the available defenses and advise on next steps.

The work is led by the founding attorney, who holds the CIPP/US and AIGP credentials and has served as in-house general counsel and privacy officer. It can be a fixed project or part of the monthly retainer described on our AI, privacy and data governance page. Businesses with customers or employees outside Illinois should also read U.S. state data privacy compliance and CCPA and CPRA compliance.

Common questions about Illinois data privacy compliance

Does BIPA apply to a fingerprint or face-scan timeclock?

A fingerprint and a scan of hand or face geometry are biometric identifiers, and information based on them that is used to identify a person is biometric information (740 ILCS 14/10). An employer using that kind of timeclock needs the public policy, the written notice and the written release before the first scan, and the release may be made a condition of employment.

Can employees sign the BIPA release electronically?

Yes. Since August 2, 2024, the definition of written release includes an electronic signature, meaning an electronic sound, symbol or process attached to or logically associated with a record and adopted by a person with the intent to sign (740 ILCS 14/10). We recommend keeping the signed record for each person with the version of the notice that person saw.

May an employer ask about family medical history in a pre-employment physical?

GIPA prohibits an employer from soliciting or requiring genetic information of a person or a family member as a condition of employment or a preemployment application, directly or indirectly (410 ILCS 513/25(c)). Because genetic information includes the manifestation of a disease or disorder in family members, we recommend taking those questions out of employer forms and instructing outside clinics to do the same.

How quickly must an Illinois business give notice of a data breach?

PIPA sets a standard and not a fixed number of days: the most expedient time possible and without unreasonable delay after discovery (815 ILCS 530/10). A vendor that holds the data for someone else must notify the owner immediately. Contracts, insurers and other laws, including HIPAA for covered entities, may set shorter or more specific deadlines.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.