HB5288 - Data Privacy Act

• Establishes comprehensive data privacy regulation for entities processing personal data of Illinois residents, with thresholds of 100,000+ consumers or 25,000+ consumers where over 50% of revenue derives from data sales.

• Grants consumers verified rights to access, correct, delete, restrict, and obtain personal data in machine-readable format; grants right to object to processing for targeted advertising and sale to data brokers.

• Requires controllers to conduct risk assessments, provide transparent privacy notices, obtain consent for high-risk processing of sensitive data, and notify third parties of consumer deletion requests.

• Exempts health information covered by HIPAA, GLBA, Driver's Privacy Protection Act, employment records, state/local government data, and allows processing for legal compliance, fraud prevention, and law enforcement purposes.

• Enforces violations through Illinois Attorney General with civil penalties of $2,500 per violation or $7,500 for intentional violations; preempts local government regulation and establishes Consumer Privacy Fund for state privacy activities.