Sec. 117. Enforcement by persons
1,100 words·~5 min read·
/bill/118/hr/8818/ih/section-117·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Subject to subsections
(b)and (c), a person may bring a civil action against a covered entity or service provider for a violation of subsection
(b)or
(c)of section 102, subsection
(a)or
(e)of section 104, section 105, subsection
(a)or (b)(2) of section 106, section 107, section 108, section 109 to the extent such action alleges a data breach arising from a violation of subsection
(a)of such section, subsection
(d)of section 111, or subsection (c)(4) of section 112, or a regulation promulgated thereunder, in an appropriate Federal district court of the United States. In a civil action brought under paragraph
(1)in which the plaintiff prevails, the court may award the plaintiff— an amount equal to the sum of any actual damages; injunctive relief, including an order that an entity retrieve any covered data transferred in violation of this title; declaratory relief; and reasonable attorney fees and litigation costs. In a civil action brought under paragraph
(1)for a violation of this title with respect to section 102(c), in which the plaintiff prevails, if the conduct underlying the violation occurred primarily and substantially in Illinois, the court may award the plaintiff— for a violation involving biometric information, the same relief as set forth in section 20 of the Biometric Information Privacy Act (740 ILCS 14/20), as such statute reads on December 31, 2024; or for a violation involving genetic information, the same relief as set forth in section 40 of the Genetic Information Privacy Act (410 ILCS 513/40), as such statute reads on December 31, 2024. In a civil action brought under paragraph
(1)for a violation of this title alleging unauthorized access of covered information as a result of a violation of section 109(a), in which the plaintiff prevails, the court may award a plaintiff who is a resident of California the same relief as set forth in section 1798.150 of the California Civil Code, as such statute read on January 1, 2024. For purposes of this subparagraph, the term covered information means the following: A username, email address, or telephone number of an individual in combination with a password or security question or answer that would permit access to an account held by the individual that contains or provides access to sensitive covered data. The first name or first initial of an individual and the last name of the individual in combination with 1 or more of the following categories of sensitive covered data, if either the name or the sensitive covered data are not encrypted or redacted: A government-issued identifier described in section 101(49)(A)(i). A financial account number described in section 101(49)(A)(iv). Health information, but only to the extent such information reveals the history of medical treatment or diagnosis by a health care professional of the individual. Biometric information. Genetic information. Any amount that a court orders an entity to pay to a person under subparagraph (A)(i), (B), or
(C)shall be offset by any amount the person received from an action brought against the entity for the same violation under section 115 or 116. Subject to paragraph (3), an action for injunctive relief may be brought by a person under this section only if, prior to initiating such action against an entity, the person provides to the entity written notice identifying the specific provisions of this title the person alleges have been or are being violated. In the event a cure is possible with respect to a violation alleged in a notice described in paragraph
(1)and, not later than 60 days after the date of receipt of such notice, the entity cures such violation and provides the person an express written statement that the violation has been cured and that no further such violations shall occur, an action for injunctive relief may not be permitted with respect to the noticed violation. Notice is not required under paragraph
(1)prior to bringing an action for injunctive relief for a violation that resulted in a substantial privacy harm. Subject to paragraph (4), an action under this section for actual damages may be brought by a person only if, 60 days prior to initiating such action against an entity, the person provides the entity written notice identifying the specific provisions of this title the person alleges have been or are being violated. An entity that receives a written notice from a person under paragraph
(1)may settle with the person who sent the written notice. In the event of a settlement under paragraph (2), the terms of such settlement shall govern any future action under this section for actual damages between the parties to the settlement that relates to the underlying facts that resulted in the settlement. Notice is not required under paragraph
(1)prior to bringing an action for actual damages for a violation of this title that resulted in a substantial privacy harm, if such action includes a claim for a preliminary injunction or temporary restraining order. Notwithstanding any other provision of law, at the election of the person alleging a violation of this title, no pre-dispute arbitration agreement shall be valid or enforceable with respect to— a claim alleging a violation involving an individual under the age of 18; or a claim alleging a violation that resulted in a substantial privacy harm. Any issue as to whether this subsection applies to a dispute shall be determined under Federal law. The applicability of this subsection to an agreement to arbitrate and the validity and enforceability of an agreement to which this subsection applies shall be determined by a Federal court, rather than an arbitrator, irrespective of whether the party resisting arbitration challenges the arbitration agreement specifically or in conjunction with other terms of the contract containing the agreement, and irrespective of whether the agreement purports to delegate the determination to an arbitrator. For purposes of this subsection, the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement. A person may combine the notices required by subsections (b)(1) and (c)(1) into a single notice, if the single notice complies with the requirements of each such subsection. If a person represented by counsel brings a civil action under this section against a covered entity or service provider requesting actual damages from the covered entity or service provider, and fails to provide notice to the covered entity or service provider in accordance with this section, the action may be dismissed without prejudice and may not be reinstated until the person has complied with the notice requirements of this section.