HB2736 - Right to Know Act

• Requires commercial website and online service operators collecting personal information from Illinois residents to disclose in their customer agreements what categories of personal information they collect and which third parties receive that information.

• Mandates operators disclose to customers free of charge all categories of personal information disclosed to third parties and the names of those third parties for the prior 12 months, upon request within 30 days.

• Establishes a private right of action for customers whose rights are violated, allowing recovery of liquidated damages of $10 or actual damages (whichever is greater), injunctive relief, and reasonable attorney's fees.

• Requires all manufacturers and companies doing business in Illinois that collect personal information from state residents to develop a data protection safety plan.

• Voids any waiver of the Act's provisions or any customer agreement that fails to comply with the Act's requirements; exempts financial institutions subject to federal Gramm-Leach-Bliley Act, health information covered by HIPAA, and telecommunications providers.