HB3385 - Illinois Data Privacy and Protection Act

• Creates comprehensive data privacy law requiring covered entities to limit collection, processing, and transfer of personal data to what is reasonably necessary and proportionate, with effectiveness 180 days after enactment

• Grants individuals rights to access, correct, delete, and port their personal data within 45 days (large data holders) or 60 days (other entities), with protections against deceptive practices and retaliation

• Prohibits targeted advertising and data transfers to third parties without affirmative express consent; provides enhanced protections for minors under 17 and restrictions on collection of sensitive data including biometric, genetic, and health information

• Requires privacy by design policies, data security safeguards, transparency through privacy policies, and designated privacy/security officers for non-small businesses; large data holders must conduct biennial audits and executive certification

• Establishes enforcement authority for Attorney General and private civil actions against violators, with exemptions and modified requirements for small businesses earning under $41 million annually