WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(b)(1)–(8) Ongoing advances in technology have produced exponential growth in the volume and variety of personal data being generated, collected, stored, and analyzed, and these advances present both great promise and potential risks. (2) Technology that collects data about the user's bodily and mental functions is transforming the volume and sensitivity of personal data collected from individuals and stored by companies. (3) Neurotechnologies, including devices capable of recording, interpreting, and altering the response of an individual's central or peripheral nervous system to its internal or external environment, raise particularly pressing privacy concerns given their ability to monitor, decode, and manipulate brain activity. (4) Data concerning the activity of the human brain and wider nervous systems, or "neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10", is extremely sensitive and can reveal intimate information about individuals, including information about health, mental states, emotions, and cognitive functioning. (5) Each human brain is unique, meaning that neural data is specific to the individual from whom it is collected. Because neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 contains distinctive information about the structure and functioning of individual brains and nervous systems, it contains sensitive information that may link the data to an identified or identifiable individual. (6) The collection of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 involves the involuntary disclosure of information. Even if individuals consent to the collection and processing of their data for narrow use, they are unlikely to be fully aware of the content or quality of information they are sharing. (7) NeurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 users cannot decide what specific neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 information they would like to disclose, and they are unlikely to understand the extent to which their neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 can be decoded, currently or in the future. Neurotechnologies can collect and process information about an individual that the individual did not even know existed. (8) Neurotechnologies that are deployed in medical settings or otherwise utilize the surgical implantation of invasive devices are typically regulated as medical tools that produce health information. Both invasive and noninvasive wearable neurotechnologies used in medical settings are also regulated by health data privacy laws. However, when noninvasive neurotechnologies are used outside of medical settings, they are generally considered consumer products and operate without regulation or data protection standards.
Section 5 adds new legislative findings addressing the privacy risks posed by neurotechnology — devices capable of recording, interpreting, and altering nervous system responses. The new findings emphasize that neurotechnology data is extremely sensitive, uniquely identifiable, involves involuntary disclosure of information, and that consumer neurotechnologies used outside of medical settings currently operate without regulation or data protection standards. These findings provide the policy justification for the substantive obligations added elsewhere in the bill.
"NeurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "NeurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10.
"Neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.
Section 10 adds two new defined terms — neurotechnology and neurotechnology data — to the Genetic Information Privacy Act's existing definitions. Neurotechnology covers devices capable of recording, interpreting, or altering central or peripheral nervous system responses. Neurotechnology data covers information captured by such devices, including neural activity measurements, but expressly excludes downstream physical effects such as pupil dilation, motor activity, and breathing rate. These definitions determine the scope of every substantive obligation in the bill.
(a) 1 An insurerInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10 may not seek information derived from genetic testing or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 for use in connection with a policy of accident and health insurance. Except as provided in subsection (c), an insurerInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10 that receives information derived from genetic testing or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10, regardless of the source of that information, may not use the information for a nontherapeutic purposeNontherapeutic purpose"Nontherapeutic purpose" means a purpose that is not intended to improve or preserve the life or health of the individual whom the information concerns.410 ILCS 513/10 as it relates to a policy of accident and health insurance.
(b) 2 An insurerInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10 shall not use or disclose protected health information that is genetic information or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 for underwriting purposes. For purposes of this Section, "underwriting purposes" means, with respect to an insurerInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10: (1) rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (2) the computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities, such as completing a health risk assessment or participating in a wellness program); (3) the application of any pre-existing condition exclusion under the plan, coverage, or policy; and (4) other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits. "Underwriting purposes" does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy. This subsection (b) does not apply to insurersInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10 that are issuing a long-term care policy, excluding a nursing home fixed indemnity plan.
(d) 3 An insurerInsurer"Insurer" means (i) an entity that is subject to the jurisdiction of the Director of Insurance and (ii) a managed care plan.410 ILCS 513/10 that possesses information derived from genetic testing or from neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 may not release the information to a third partyThird party"Third party" means a person other than the consumer, entity, or processor.410 ILCS 513/27(a), except as specified in this Act.
(e) 4 A company providing direct-to-consumer commercial genetic testing or providing direct-to-consumer neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 is prohibited from sharing any genetic test information, neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10, or other personally identifiable information about a consumer with any health or life insurance company without written consent from the consumer.
Section 20 extends all existing insurer-facing prohibitions from the Genetic Information Privacy Act to cover neurotechnology data in addition to genetic testing information. Insurers may not seek or use neurotechnology data for nontherapeutic purposes in connection with accident and health insurance policies, and may not use it for underwriting purposes (eligibility, premiums, pre-existing condition exclusions, or contract creation/renewal). The narrow exception allowing consideration of genetic test results voluntarily submitted by the individual is also extended to neurotechnology data, but only when the results are favorable to the individual. Insurers possessing neurotechnology data may not release it to third parties except as specified in the Act, and direct-to-consumer neurotechnology data providers are prohibited from sharing such data with health or life insurers without written consumer consent.
(c)(1)–(2) 5 An employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10, employment agency, labor organization, and licensing agency shall not directly or indirectly do any of the following: (1) solicit, request, require or purchase genetic testing or genetic information of a person or a family member of the person, or administer a genetic test to a person or a family member of the person as a condition of employment, preemployment application, labor organization membership, or licensure; (2) solicit, request, require, or purchase neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 data of a person or a family member of a person, or require the person or family member of the person to use a neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10, as a condition of employment, preemployment application, labor organization membership, or licensure;
(c)(3) 6 affect the terms, conditions, or privileges of employment, preemployment application, labor organization membership, or licensure, or terminate the employment, labor organization membership, or licensure of any person because of genetic testing, genetic information, or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 with respect to the employee or family member, or information about a request for or the receipt of genetic testing or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 by such employee or family member of such employee;
(c)(4) 6 limit, segregate, or classify employees in any way that would deprive or tend to deprive any employee of employment opportunities or otherwise adversely affect the status of the employee as an employee because of genetic testing, genetic information, or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 with respect to the employee or a family member, or information about a request for or the receipt of genetic testing, genetic information, or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 by such employee or family member of such employee; and
(c)(5) 7 retaliate through discharge or in any other manner against any person alleging a violation of this Act or participating in any manner in a proceeding under this Act.
(d) 8 An agreement between a person and an employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10, prospective employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10, employment agency, labor organization, or licensing agency, or its employees, agents, or members offering the person employment, labor organization membership, licensure, or any pay or benefit in return for taking a genetic test or using a neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 is prohibited.
(e) 9 An employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10 shall not use genetic information, genetic testing, or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 in furtherance of a workplace wellness program benefiting employees unless (1) health services, genetic services, or neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 services are offered by the employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10, (2) the employee provides written authorization in accordance with Section 27 or 30 of this Act, as it may apply, (3) only the employee or family member if the family member is receiving genetic neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 services and the licensed health care professional or licensed genetic counselor involved in providing such services receive individually identifiable information concerning the results of such services, and (4) any individually identifiable information is only available for purposes of such services and shall not be disclosed to the employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10 except in aggregate terms that do not disclose the identity of specific employees. An employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10 shall not penalize an employee who does not disclose his or her genetic information or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 or does not choose to participate in a program requiring disclosure of the employee's genetic information or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10.
(k) 10 Except as provided in subsections (e), (f), (h), and (i) of this Section, a person shall not knowingly sell to or interpret for an employerEmployer"Employer" means the State of Illinois, any unit of local government, and any board, commission, department, institution, or school district, any party to a public contract, any joint apprenticeship or training committee within the State, and every other person employing employees within the State.410 ILCS 513/10, employment agency, labor organization, or licensing agency, or its employees, agents, or members, a genetic test or neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 data of an employee, labor organization member, or license holder, or of a prospective employee, member, or license holder.
Section 25 extends the Act's employment-context prohibitions to neurotechnology data. Employers, employment agencies, labor organizations, and licensing agencies are prohibited from soliciting, requesting, requiring, or purchasing neurotechnology data — or requiring the use of a neurotechnology device — as a condition of employment, preemployment application, labor organization membership, or licensure. They may not take adverse employment actions based on neurotechnology data, and may not limit, segregate, or classify employees in ways that deprive them of opportunities based on neurotechnology data. Agreements offering employment benefits in exchange for neurotechnology use are prohibited. Use of neurotechnology data in workplace wellness programs requires employee written authorization and is subject to strict conditions (only the employee and licensed professionals receive individually identifiable results; the employer receives only aggregate data). Retaliation against persons alleging violations is prohibited. An exception permits employer-requested neurotechnology data for monitoring biological effects of toxic substances in the workplace under defined safeguards.
(b) 11 Except as otherwise provided in this Act, neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 and information derived from neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 is confidential and privileged and may be released only to the individual whose activity is measured or captured and to persons specifically authorized, in writing in accordance with this Section, by that individual to receive the information.
(c)(1) 12 To safeguard the privacy, confidentiality, security, and integrity of an individual's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10, an entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) shall: (1) provide clear and complete information regarding the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s policies and procedures for the collection, use, or disclosure of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 by making available to a consumer: (A) a high-level privacy policy overview that includes basic, essential information about the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s collection, use, or disclosure of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; and (B) a prominent, publicly available privacy notice that includes, at a minimum, information about the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices for neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10;
(c)(2) 13 obtain initial express consent from a consumer, parent, guardian, or power of attorney for the collection, use, or disclosure of the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 that: (A) clearly describes the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s use of the neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 that the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) collects through the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 product or service; (B) specifies the categories of individuals within the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) that have access to neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; and (C) specifies how the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) may share the neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10;
(c)(3) 14 if the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) engages in any of the following, obtain a consumer's: (A) separate express consent for: (i) the transfer or disclosure of the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 to any third partyThird party"Third party" means a person other than the consumer, entity, or processor.410 ILCS 513/27(a) other than the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s processorsProcessor"Processor" means a person that processes genetic data on behalf of an entity pursuant to a contract between the entity and the processor that prohibits the processor from retaining, using, or disclosing the neurotechnology data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received neurotechnology, as applicable, for any purpose other than for the specific purpose of performing the services specified in the contract.410 ILCS 513/27(a), including the name of the third partyThird party"Third party" means a person other than the consumer, entity, or processor.410 ILCS 513/27(a) to which the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 will be transferred or disclosed with the consumer's express consent; (ii) the use of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 beyond the primary purpose of the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 product or service and inherent contextual uses; or (iii) the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s retention of any neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 provided by the consumer following the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s completion of the primary purpose of the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 requested by the consumer; (B) informed express consent for transfer or disclosure of the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 to third partyThird party"Third party" means a person other than the consumer, entity, or processor.410 ILCS 513/27(a) persons for: (i) research purposes; or (ii) research conducted under the control of the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) for the purpose of publication or generalizable knowledge; and (C) express consent for: (i) marketing to a consumer based on the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; (ii) marketing by a third-party person to a consumer based on the consumer having ordered or purchased a neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 product or service, except that marketing under this subdivision (ii) does not include the provision of customized content or offers on the websites or through the applications or services provided by the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) with the first-party relationship to the consumer; or (iii) sale or other valuable consideration of the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10.
(c)(4) 15 comply with the provisions of subsection (d) requiring a valid legal process for disclosing neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 to law enforcement or any other government agencyGovernment agency"Government agency" means a State agency as defined under Section 1-7 of the Illinois State Auditing Act, a unit of local government, a school district, or any administrative unit or corporate outgrowth thereof.410 ILCS 513/27(a) without a consumer's express consent;
(c)(5) 16 develop, implement, and maintain a comprehensive security program to protect a consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 against unauthorized access, use, or disclosure;
(c)(6) 17 provide a process for a consumer to: (A) access the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; (B) request and obtain the destruction of the consumer's neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; and (C) revoke any consent provided by the consumer.
(c-5) 17 The requirements of paragraph (6) of subsection (c) shall be waived if: (1) the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) obtains express and informed written consent from a consumer, parent, guardian, or power of attorney for participation in a clinical research trial, including the collection and use of any neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10, which at a minimum must: (A) be in accordance with the good clinical practice guideline issued by the international council for harmonization of technical requirements for pharmaceuticals for human use; (B) be obtained no sooner than 14 days from the initial neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 collection if the data is collected for a primary purpose unrelated to clinical research; (C) be obtained separately from any other items of consent; (D) be in writing on a form with text that is easily readable with size 12-point type font or larger; (E) include the entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a)'s data retention, sharing, and use policies; and (F) include notice that after consent is given, there is no right to access, inspect, or require the destruction of any neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10; (2) the neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 is used for clinical research purposes only.
(c-10) 18 The requirements of subsection (c-5) supersede all exceptions to, and waivers of, informed consent in the federal policy for the protection of human subjects under 45 CFR Part 46, to the extent permitted by federal law. NeurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 data of Illinois residents collected in the State may not be stored within the territorial boundaries of any country currently sanctioned in any way by the United States office of foreign asset control or designated as a foreign adversary under 15 CFR 7.4(a). NeurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 data of Illinois residents collected in the State may only be transferred or stored outside the United States with the consent of the resident.
(d)(1)–(3) 19 Neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 use by government agencies is regulated as follows: (1) Any collection, storage, use, or dissemination of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 by a government agencyGovernment agency"Government agency" means a State agency as defined under Section 1-7 of the Illinois State Auditing Act, a unit of local government, a school district, or any administrative unit or corporate outgrowth thereof.410 ILCS 513/27(a) must be performed in accordance with a specific State law or executed through a search warrant or investigative subpoena. (2) A government agencyGovernment agency"Government agency" means a State agency as defined under Section 1-7 of the Illinois State Auditing Act, a unit of local government, a school district, or any administrative unit or corporate outgrowth thereof.410 ILCS 513/27(a) may not obtain neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 search results from a consumer neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 database: (A) without a search warrant or investigative subpoena issued by a court on a finding of probable cause; or (B) unless the consumer whose information is sought previously waived the consumer's right to privacy in the information. (3) A government agencyGovernment agency"Government agency" means a State agency as defined under Section 1-7 of the Illinois State Auditing Act, a unit of local government, a school district, or any administrative unit or corporate outgrowth thereof.410 ILCS 513/27(a) that legally obtains neurotechnologyNeurotechnology"Neurotechnology" means devices capable of recording, interpreting, or altering the response of an individual's central or peripheral nervous system to its internal or external environment. "Neurotechnology" includes mental augmentation or improving human cognition and behavior through direct recording or manipulation of neural activity by neurotechnology.410 ILCS 513/10 database search results, as set forth in paragraph (2) of subsection (d), or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10, as set forth in this Section, may use the results during criminal investigations and judicial proceedings subject to applicable rules of criminal procedure and evidence.
(e) This Section does not apply to protected health information that is collected by a covered entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) or business associate as those terms are defined in 45 CFR Parts 160 and 164, if separate informed consent related to the collection, use, and dissemination of neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 is obtained from the consumer, parent, guardian, or power of attorney, and the covered entityEntity"Entity" means a partnership, corporation, association, or public or private organization of any character that: (1) offers consumer neurotechnology products or services directly to a consumer; or (2) collects, uses, or analyzes neurotechnology data.410 ILCS 513/27(a) or business associate follows the policies outlined in paragraph (6) of subsection (c).
Section 27 is the bill's core new section, creating a comprehensive privacy regime for neurotechnology data. It establishes that all neurotechnology data is confidential and privileged, releasable only to the measured individual and persons authorized in writing. Entities collecting neurotechnology data must provide both a high-level privacy policy overview and a detailed public privacy notice. They must obtain tiered express consent: initial consent for collection and use; separate express consent for third-party transfers, secondary uses, and post-purpose retention; informed express consent for research disclosures; and express consent for marketing and data sales. Entities must maintain a comprehensive security program, provide consumers with access, deletion, and consent-revocation rights, and comply with restrictions on government-agency disclosure (requiring a search warrant or investigative subpoena). The section also restricts cross-border data storage — barring storage in sanctioned or foreign-adversary countries and requiring resident consent for transfers outside the United States. A clinical-research waiver allows entities to bypass consumer access, deletion, and revocation rights if they obtain express and informed written consent meeting specified conditions, including a 14-day waiting period, ICH good clinical practice compliance, and notice that data rights are waived.
(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court against an offending party. A prevailing party may recover for each violation: (1) Against any party who negligently violates a provision of this Act, liquidated damages of $2,500 or actual damages, whichever is greater. (2) Against any party who intentionally or recklessly violates a provision of this Act, liquidated damages of $15,000 or actual damages, whichever is greater. (3) Reasonable attorney's fees and costs, including expert witness fees and other litigation expenses. (4) Such other relief, including an injunction, as the State or federal court may deem appropriate.
(c) Notwithstanding any provisions of the law to the contrary, any person alleging a violation of subsection (a) of Section 15, subsection (b) of Section 25, Section 27, Section 30, Section 31, or Section 35 of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court to seek a preliminary injunction preventing the release or disclosure of genetic testing, genetic information, or neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 pending the final resolution of any action under this Act.
Section 40 extends the existing private right of action under the Genetic Information Privacy Act to cover violations of the new Section 27 (confidentiality of neurotechnology data). The damages structure is unchanged: $2,500 liquidated damages per negligent violation or $15,000 per intentional or reckless violation, whichever is greater than actual damages, plus attorney's fees, expert witness fees, litigation expenses, and injunctive relief. The section also adds Section 27 violations to the list of provisions for which a plaintiff may seek a preliminary injunction to prevent release or disclosure of neurotechnology data pending final resolution.
Any home rule unit of local government, any non-home rule municipality, or any non-home rule county within the unincorporated territory of the county may enact ordinances, standards, rules, or regulations that protect genetic information, genetic testing, and neurotechnology dataNeurotechnology data"Neurotechnology data" means information that is captured by neurotechnologies, that is generated by measuring the activity of an individual's central or peripheral nervous systems, or that is data associated with neural activity, the activity of neurons or glial cells in the central or peripheral nervous system. "Neurotechnology data" does not include nonneural information, such as pupil dilation, motor activity, breathing rate, or other information about the downstream physical effects of neural activity.410 ILCS 513/10 in a manner or to an extent equal to or greater than the protection provided in this Act. This Section is a limitation on the concurrent exercise of home rule power under subsection (i) of Section 6 of Article VII of the Illinois Constitution.
Section 50 makes a conforming change to the home-rule provision, adding neurotechnology data alongside genetic information and genetic testing. Local governments may enact protections for neurotechnology data equal to or greater than those in this Act, consistent with the existing home-rule limitation. This is a floor-preemption provision — the Act sets a minimum standard but does not prevent stronger local protections.