INFO PROTECTION-IMMIGRATION

Illinois General Assembly - Full Text of SB2897

Select Language

×

The Illinois General Assembly offers the Google Translate™ service for visitor convenience. In no way should it be considered accurate as to the translation of any content herein.

Visitors of the Illinois General Assembly website are encouraged to use other translation services available on the internet.

The English language version is always the official and authoritative version of this website.

NOTE: To return to the original English language version, select the "Show Original" button on the Google Translate™ menu bar at the top of the window.

Choose Language

English

Afrikaans

Albanian

Arabic

Armenian

Azerbaijani

Basque

Bengali

Bosnian

Catalan

Croatian

Czech

Danish

Dutch

Esperanto

Estonian

Filipino

Finnish

French

Galician

Georgian

German

Greek

Gujarati

Haitian Creole

Hausa

Hawaiian

Hebrew

Hindi

Hungarian

Icelandic

Indonesian

Interlingua

Interlingue

Inuktitut

Irish

Italian

Japanese

Javanese

Kannada

Khmer

Korean

Latin

Latvian

Lithuanian

Luxembourgish

Macedonian

Malagasy

Malayalam

Maltese

Maori

Marathi

Myanmar

Nepali

Norwegian

Odia

Pashto

Punjabi

Romanian

Russian

Samoan

Sango

Sanskrit

Sardinian

Sindhi

Sinhala

Slovak

Slovenian

Somali

Southern Sotho

Spanish

Sundanese

Swahili

Swedish

Tamil

Telugu

Thai

Tigrinya

Tonga

Turkish

Ukrainian

Urdu

Vietnamese

Welsh

Xhosa

Yiddish

Yoruba

Zulu

Powered by
Translate

Close

Illinois General Assembly

Top Navigation Bar

Translate

Learn

Select General Assembly

Search the 104th General Assembly

Enter search terms for legislation, members, committees, or schedules.

ILGA.GOV

LEGISLATION & LAWS

Bills & Resolutions

Public Acts

Illinois Compiled Statutes

Illinois Constitution

Search Legislation

Glossary

Guide

Reports & Inquiry

Legislative Reports

Special Reports

FTP Site

Legislator Lookup

Capitol Complex Phone Numbers

Rules & Regulations

Illinois Register

Administrative Rules

Senate

Members

Schedules

Committees

Request for Remote Testimony

Journals

Transcripts

Rules

Audio/Video

FOIA Information

Senate Employment Opportunities

Media Guidelines

House

Members

Schedules

Committees

Submit testimony for House Committees

Journals

Transcripts

Rules

Audio/Video

FOIA Information

House Employment Opportunities

Log In

Mobile Top Bar

Search the 104th General Assembly

Enter keywords to search the Illinois General Assembly website.

Full Text of SB2897

Home

Legislation

Full Text

SB2897 - 104th General Assembly

Bill Status

Full Text

Votes

Witness Slips

Select Menu

Bill Status

Full Text

Votes

Witness Slips

Printer Friendly Version

Introduced

Printer Friendly Version

Introduced

Open PDF

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB2897

Introduced 1/27/2026, by Sen. Celina Villanueva

SYNOPSIS AS INTRODUCED:

815 ILCS 530/5
815 ILCS 530/45

Amends the Personal Information Protection Act. Provides that a data
collector shall not own, maintain, license, store, or disclose records
that contain immigration or citizenship status information concerning an
Illinois resident. Provides that the provision shall not apply to
government agencies, public and private universities, or financial
institutions. Provides that the definition of "personal information"
includes immigration or citizenship status information. Defines
"immigration or citizenship status information".
LRB104 16891 SPS 30302 b

A BILL FOR

SB2897
LRB104 16891 SPS 30302 b
1

AN ACT concerning business.

2

Be it enacted by the People of the State of Illinois,
3
represented in the General Assembly:

4

Section 5.
The Personal Information Protection Act is
5
amended by changing Sections 5 and 45 as follows:

6

(815 ILCS 530/5)
7

Sec. 5.
Definitions.
In this Act:
8

"Data collector" may include, but is not limited to,
9
government agencies, public and private universities,
10
privately and publicly held corporations, financial
11
institutions, retail operators, and any other entity that, for
12
any purpose, handles, collects, disseminates, or otherwise
13
deals with nonpublic personal information.
14

"Breach of the security of the system data" or "breach"
15
means unauthorized acquisition of computerized data that
16
compromises the security, confidentiality, or integrity of
17
personal information maintained by the data collector. "Breach
18
of the security of the system data" does not include good faith
19
acquisition of personal information by an employee or agent of
20
the data collector for a legitimate purpose of the data
21
collector, provided that the personal information is not used
22
for a purpose unrelated to the data collector's business or
23
subject to further unauthorized disclosure.

SB2897
- 2 -
LRB104 16891 SPS 30302 b
1

"Health insurance information" means an individual's
2
health insurance policy number or subscriber identification
3
number, any unique identifier used by a health insurer to
4
identify the individual, or any medical information in an
5
individual's health insurance application and claims history,
6
including any appeals records.
7

"Immigration or citizenship status information" means any
8
information concerning: (i) the status of an individual's
9
citizenship of the United States or any other country; or (ii)
10
the legal right, or lack thereof, of an individual to reside in
11
or otherwise to be present in the United States. "Immigration
12
or citizenship status information" includes an individual's
13
nationality and country of origin.
14

"Medical information" means any information regarding an
15
individual's medical history, mental or physical condition, or
16
medical treatment or diagnosis by a healthcare professional,
17
including such information provided to a website or mobile
18
application.
19

"Personal information" means either of the following:
20

(1) An individual's first name or first initial and
21

last name in combination with any one or more of the
22

following data elements, when either the name or the data
23

elements are not encrypted or redacted or are encrypted or
24

redacted but the keys to unencrypt or unredact or
25

otherwise read the name or data elements have been
26

acquired without authorization through the breach of

SB2897
- 3 -
LRB104 16891 SPS 30302 b
1

security:
2

(A) Social Security number.
3

(B) Driver's license number or State
4

identification card number.
5

(C) Account number or credit or debit card number,
6

or an account number or credit card number in
7

combination with any required security code, access
8

code, or password that would permit access to an
9

individual's financial account.
10

(D) Medical information.
11

(E) Health insurance information.
12

(F) Unique biometric data generated from
13

measurements or technical analysis of human body
14

characteristics used by the owner or licensee to
15

authenticate an individual, such as a fingerprint,
16

retina or iris image, or other unique physical
17

representation or digital representation of biometric
18

data.
19

(G) Immigration or citizenship status information.
20

(2) User name or email address, in combination with a
21

password or security question and answer that would permit
22

access to an online account, when either the user name or
23

email address or password or security question and answer
24

are not encrypted or redacted or are encrypted or redacted
25

but the keys to unencrypt or unredact or otherwise read
26

the data elements have been obtained through the breach of

SB2897
- 4 -
LRB104 16891 SPS 30302 b
1

security.
2

"Personal information" does not include publicly available
3
information that is lawfully made available to the general
4
public from federal, State, or local government records.
5
(Source: P.A. 99-503, eff. 1-1-17
.)

6

(815 ILCS 530/45)
7

Sec. 45.
Data security.
8

(a) A data collector that owns or licenses, or maintains
9
or stores but does not own or license, records that contain
10
personal information concerning an Illinois resident shall
11
implement and maintain reasonable security measures to protect
12
those records from unauthorized access, acquisition,
13
destruction, use, modification, or disclosure.
14

(a-5) A data collector shall not own, maintain, license,
15
store, or disclose records that contain immigration or
16
citizenship status information concerning an Illinois
17
resident. This subsection shall not apply to government
18
agencies, public and private universities, or financial
19
institutions.
20

(b) A contract for the disclosure of personal information
21
concerning an Illinois resident that is maintained by a data
22
collector must include a provision requiring the person to
23
whom the information is disclosed to implement and maintain
24
reasonable security measures to protect those records from
25
unauthorized access, acquisition, destruction, use,

SB2897
- 5 -
LRB104 16891 SPS 30302 b
1
modification, or disclosure.
2

(c) If a state or federal law requires a data collector to
3
provide greater protection to records that contain personal
4
information concerning an Illinois resident that are
5
maintained by the data collector and the data collector is in
6
compliance with the provisions of that state or federal law,
7
the data collector shall be deemed to be in compliance with the
8
provisions of this Section.
9

(d) A data collector that is subject to and in compliance
10
with the standards established pursuant to Section 501(b) of
11
the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. Section 6801,
12
shall be deemed to be in compliance with the provisions of this
13
Section.
14
(Source: P.A. 99-503, eff. 1-1-17
.)

Footer

Disclaimer

This site is maintained for the Illinois General Assembly by the
Legislative Information System, 705 Stratton Building, Springfield, Illinois 62706.

Contact ILGA Webmaster

ILGA.gov uses cookies to ensure you get the best experience on our website. By continuing to browse ILGA.gov you consent to our use of cookies.
Read About Cookies

ILGA.GOV

2026 ILGA.gov | All Rights Reserved |
ADA

|
Disclaimers
|
Learn

This site is maintained for the Illinois General Assembly by the
Legislative Information System, 705 Stratton Building, Springfield, Illinois 62706.
Contact ILGA Webmaster

ILGA.gov uses cookies to ensure you get the best experience on our website. By continuing to browse ILGA.gov you consent to our use of cookies.
Read About Cookies

ILGA.GOV

2026 ILGA.gov | All Rights Reserved |
ADA

|
Disclaimers
|
Learn