6 July 2017
The Illinois General Assembly announced, on 27 June 2017, that both the House and the Senate had passed the Geolocation Privacy Protection Act (‘the Act’). In particular, the Act provides that a private entity may not collect, use, store or disclose geolocation information from a location-based application on an individual’s device without obtaining the individual’s affirmative and express consent.
Lisa Sotto, Partner at Hunton & Williams LLP, told DataGuidance, “The Act is among the first of its kind. But it does not introduce a concept that is particularly groundbreaking in the US. For years, the Federal Trade Commission has held firmly to the position that precise geolocation data is sensitive data for which express and affirmative consent is needed […] The major app platforms have traditionally required opt-in consent for the collection of precise geolocation data, so the Act does not change what has been enshrined for years as a good practice principle.”
The major app platforms have traditionally required opt-in consent for the collection of precise geolocation data so the Act does not change what has been enshrined for years as a good practice principle
In addition, the Act stipulates that a private entity must provide clear, prominent and accurate notice to the data subject that their geolocation information will be collected, used or disclosed for a specified purpose, alongside providing a hyperlink or a comparable means to access the information contained in the Act.
With regard to enforcement, Sotto highlighted, “The Act is written so that is does not serve as a ‘gotcha’ statute – notably, the Act provides for a 15-day grace period to fix the [violation] after notice is provided and also does not allow for a private right of action. This is a key distinction from Illinois’ Biometric Information Privacy Act 2008, which is currently the basis for a number of class action lawsuits and has also forced companies to refrain from marketing certain products to Illinois residents.”
The Act must now be signed by the Governor of Illinois.
Felicity Turton | Privacy Analyst