Data Protection and Privacy 2026

USA – ILLINOIS Trends and Developments Contributed by: Paul Yovanic, Jason Priebe, Ada Dolph and Michael Jacobsen, Seyfarth Shaw LLP

• whether inadvertent or stray references fall within GIPA’s prohibitions; and • whether defences such as ERISA pre-emption, extraterritoriality, OSHA‑driven compliance or con - sent/authorisation defeat liability. Defendants are also expected to push arguments that the statutory scheme – like BIPA’s – requires courts to apply discretion in awarding damages, particularly in cases involving large putative classes and minimal actual harm. Altogether, 2026 is shaping up to be a pivotal year for GIPA litigation. With class certification and summary judgment decisions on the horizon, courts will finally begin resolving the threshold issues that have thus far only been previewed at the motion‑to‑dismiss stage. These rulings will determine not only the viability of the earliest GIPA cases but also the trajectory of the statute as a potential parallel to BIPA – or, alternatively, as a narrower, more context‑specific privacy statute that resists broad class treatment. Illinois Privacy Legislative Developments At the outset of 2026, the Illinois legislature consid - ered approximately seven bills addressing privacy and technology regulation. Notably, the proposed Illinois Personal Information Privacy Act failed to pass, leav - ing the state without a comprehensive privacy frame - work comparable to the California Consumer Privacy Act (CCPA) or the Virginia Data Protection Act (VDPA). That said, Illinois continues to pursue a targeted regu - latory approach, focusing on discrete categories of sensitive information, as seen with BIPA and GIPA, as well as recent legislative efforts that have sought to regulate the collection and use of precise geolocation data (eg, SB 2121 and HB 3712). Of particular significance for Illinois – and for employ - ers operating locally and nationally with Illinois person - nel or job applicants – are new restrictions governing the use of artificial intelligence (AI) in employment- related decision-making. Illinois now joins jurisdictions such as California, Colorado and New York City in imposing stringent requirements on AI-driven hiring, performance evaluation and job-related assessments.

Effective January 2026, House Bill 3773 amended the Illinois Human Rights Act to regulate AI use in employment contexts (Illinois Human Rights Act, 775 ILCS 5/2-102, 2026). The statute defines AI broadly, encompassing both generative AI (content creation) and predictive AI (tools generating scores, rankings, classifications or recommendations). Employers must provide written notice to applicants and employees whenever AI is utilised for decisions related to recruit - ment, hiring, promotion, training, discharge, discipline, tenure or other employment conditions. The law also prohibits AI applications that result in discriminatory outcomes based on protected charac - teristics. While this prohibition is noteworthy, it largely reiterates existing anti-discrimination provisions under 775 ILCS 5/2-102. The Illinois Department of Human Rights (IDHR) was granted authority to promulgate rules governing notice requirements, timing and delivery methods. However, the text of the IDHR draft regulations under considera - tion expands the statutory scope and requirements significantly. For example, where the statute refers to AI “use”, the draft rules extend coverage to any AI that “influ - ences or facilitates” an employment decision, even in the absence of automated decision-making. This interpretation potentially encompasses a wide array of applications, including generative AI tools used for drafting job postings. There are also disclosure requirements in the draft rules. Under the proposed framework, employers must disclose: • the name of each AI product, along with its devel - oper and vendor; • the employment decisions that the AI influences or facilitates; • the purpose of the AI system and categories of personal data processed, described in practical terms; • the job positions for which the AI is deployed; • a designated point of contact for enquiries; and

593 CHAMBERS.COM

Powered by