USA – ILLINOIS Trends and Developments Contributed by: Paul Yovanic, Jason Priebe, Ada Dolph and Michael Jacobsen, Seyfarth Shaw LLP
Illinois Privacy Rights Act (proposed, Senate Bill 0052) Illinois first attempted to pass a statewide con - sumer privacy law in 2021 with the Illinois Pri - vacy Rights Act (IPRA). Unlike most other state privacy laws, the IPRA included a proposed “purpose limitation” requirement. In the context of personal information processing, a “purpose limitation” is intended to prohibit businesses from retaining personal information beyond the originally disclosed or mutually understood pur - pose without subsequent notice and permission from the consumer. This would have, at the time, distinguished Illinois from other states’ privacy laws, as it sought to prevent the indefinite reten - tion of consumer data. However, the bill never made it to a vote, largely due to competing leg - islative priorities stemming from the COVID-19 pandemic. In 2024, the Illinois legislature revived its efforts with another proposed bill that aligned more closely with existing state privacy frameworks, like California’s Consumer Privacy Act (CCPA) and Virginia’s Consumer Data Privacy Act (VCD - PA). However, controversy arose over the inclu - sion of individual workers and job applicants in the definition of “consumer” where other state laws typically exclude employment-related infor - mation. Strong opposition from industry groups and business interests ultimately contributed to the 2024 bill’s failure. In January 2025, Illinois lawmakers made anoth - er effort with the introduction of Senate Bill 0052, now titled the Privacy Rights Act (PRA). The PRA, like the 2024 proposal, includes individual workers and job applicants in its definition of an Illinois “consumer”. If enacted, Illinois would be only the second state to provide consumer privacy rights to workers for data collected in the employment context. This inclusion is still a
terms, privileges, or conditions of employment.” The statutory language appears to encompass any “use” of AI for these purposes, not just fully automated decision-making. The new law does not go into effect until 1 January 2026, so the exact details of the required disclosures under the new law have yet to be fleshed out. That said, the Illinois Department of Human Rights (IDHR) is authorised to establish rules for its implementation. This could include specifying when and how notice must be given, though it remains to be seen whether the IDHR will fol - low the approaches seen in other states such as Colorado. In any event, the law’s broad wording appears to extend the disclosure requirement to a wide range of AI applications in the employ - ment context. In addition, the new AI law prohibits AI-driven discrimination against protected classes under the Illinois Human Rights Act. However, the provisions of the new law do not introduce new obligations for employers, as discriminatory practices have already been prohibited under existing law. Instead, the law merely reiterates that AI decisions must comply with existing non-discrimination principles, emphasising the importance of fairness in AI-assisted employ - ment processes. Further, the law specifically forbids using zip codes as proxies for protected classes, such as race or national origin, in AI tools. This aims to prevent biased decision-mak - ing based on indirect correlations between zip codes and protected characteristics. However, the law does not restrict the use of zip codes altogether or extend to other forms of location data, so employers can still use other geograph - ic data in AI systems.
563 CHAMBERS.COM
Powered by FlippingBook