Public Act 0439 103RD GENERAL ASSEMBLY

HB2954 Enrolled LRB103 30878 LNS 57401 b

Public Act 103-0439

AN ACT concerning civil law.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Civil Liability for Doxing Act.

Section 5. Definitions. As used in this Act:

"Course of conduct" means a pattern of conduct composed of 2 or more acts, evidencing a continuity of purpose.

"Electronic communication" means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photo-optical system.

"Emotional distress" means significant mental suffering, anxiety, or alarm. "Emotional distress" is limited to emotional suffering that is protracted and not merely trivial or transitory.

"Family or household member" has the meaning given to the term "family or household members" in Section 103 of the Illinois Domestic Violence Act of 1986.

"Personally identifiable information" means any information that can be used to distinguish or trace a person's identity, such as name, prior legal name, alias, mother's maiden name, and date or place of birth in combination with any other information that is linked or linkable to a person such as:

(1) social security number, home address, phone number, email address, social media accounts, or biometric data;

(2) medical, financial, education, consumer, or employment information, data, or records;

(3) any other sensitive or private information that is linked or linkable to a specific identifiable person, such as gender identity, sexual orientation, or any sexually intimate visual depiction; or

(4) any information that provides access to a person's teleconferencing, video-teleconferencing, or other digital meeting room.

"Post" means to circulate, deliver, distribute, disseminate, transmit, or otherwise make available to 2 or more persons through electronic communication.

"Publish" means to circulate, deliver, distribute, disseminate, post, transmit, or otherwise make available to another person. "Publish" does not include writing or electronically communicating to one other person in private communications for which an individual has a reasonable expectation of privacy.

"Regularly resides" means residing in the household with some permanency or regular frequency in the person's living arrangement.

"Stalk" or "stalking" has the meaning provided in Section 12-7.3 of the Criminal Code of 2012, except that "stalking" does not include an activity that is part of a protest that is protected by the United States Constitution or the Illinois Constitution.

"Substantial life disruption" means a material and significant alteration of an individual's livelihood. "Substantial life disruption" may include, but is not limited to, moving from an established residence, changing routes to and from work, changing employment or work schedule, or losing time at work or a job.

Section 10. Doxing.

(a) An individual engages in the act of doxing when that individual intentionally publishes another person's personally identifiable information without the consent of the person whose information is published and:

(1) the information is published with the intent that it be used to harm or harass the person whose information is published and with knowledge or reckless disregard that the person whose information is published would be reasonably likely to suffer death, bodily injury, or stalking; and

(2) the publishing of the information:

(i) causes the person whose information is published to suffer significant economic injury or emotional distress or to fear serious bodily injury or death of the person or a family or household member of the person; or

(ii) causes the person whose information is published to suffer a substantial life disruption; and

(3) the person whose information is published is identifiable from the published personally identifiable information itself.

(b) It is not an offense under this Act for an individual to:

(1) provide another person's personally identifiable information or sensitive personal information in connection with the reporting of criminal activity to an employee of a law enforcement agency or in connection with any lawfully authorized investigative, protective, or intelligence activity of any law enforcement agency or of an intelligence agency of the United States and the person making the report reasonably believes the alleged criminal activity occurred or the existing investigative, protective, or intelligence activity is legitimate;

(2) disseminate the personally identifiable information for the purpose of, or in connection with, the reporting of conduct reasonably believed to be unlawful; or

(3) provide a person's personally identifiable information in connection with activity protected under the United States Constitution or the Illinois Constitution pertaining to speech, press, assembly, protest, and petition, as well as the provision of personally identifiable information to the press.

(c) Nothing in this Act shall be construed in any manner to:

(1) conflict with Section 230 of Title II of the Communications Act of 1934 (47 U.S.C. 230);

(2) conflict with 42 U.S.C. 1983; or

(3) prohibit any activity protected under the Constitution of the United States or the Illinois Constitution.

Section 15. Civil action.

(a) A person who is aggrieved by a violation of this Act may bring a civil action against (i) the individual who committed the offense of doxing or (ii) any individual or entity that directs one or more persons to violate this Act and that knowingly benefits, financially or by receiving anything of value, from participation in a venture that the individual or entity knew involved a violation of this Act.

(b) A person who is aggrieved by a violation of this Act may recover damages and any other appropriate relief, including reasonable attorney's fees.

(c) An individual who is found liable under this Act shall be jointly and severally liable with each other individual, if any, who is found liable under this Act for damages arising from the same violation of this Act.

(d) When a judgment is entered in favor of an individual alleged to have committed the offense of doxing, the court may award reasonable costs and attorney's fees to the defendant for defending any claim that the court finds was brought by the plaintiff and that the court finds was frivolous, baseless, or brought in bad faith.

Section 20. Injunctive relief.

(a) A court in which a suit is brought under this Act, on the motion of a party, may issue a temporary restraining order, emergency order of protection, or preliminary or permanent injunction to restrain and prevent the disclosure or continued disclosure of a person's personally identifiable information or sensitive personal information. Upon a motion by a party in a civil action brought under this Act, and following a full evidentiary hearing, a court may issue an order pursuant to this Section to prevent the publishing of a person's personally identifiable information or sensitive personal information if the court finds by clear and convincing evidence each of the following:

(1) the individual to be enjoined published personally identifiable information or sensitive personal information in violation of this Act;

(2) continued or further publishing of the personally identifiable information or sensitive personal information poses a present and ongoing risk of death, bodily injury, or stalking to another individual; and

(3) the individual to be enjoined has no lawful or constitutional purpose for continued or further publishing of the personally identifiable information or sensitive personal information.

(b) Any injunctive relief granted under this Section shall state the following with sufficient particularity to allow appellate review:

(1) the required findings in subsection (a) of Section 20 and the evidentiary basis and reasoning for the findings;

(2) the expiration date of the injunction, which shall be no more than one year from the date of its entry;

(3) that the enjoined individual may seek relief from the injunction, if the court determines, after notice and hearing, that one or more of the required findings in subsection (a) of Section 20 no longer apply; and

(4) that the person who sought the injunction may seek an extension of the order of no more than one year if the court determines, after notice and hearing, that the required findings in subsection (a) of Section 20 continue to apply.

(c) If a person violates any order issued under this Section, the court, in its discretion, may grant any civil remedy under State law.

Section 25. Venue. A civil action may be brought in any county in which an element of the offense occurred, or in which a person resides who is the subject of personally identifiable information published in violation of this Act.

Section 30. Constitutionality. The General Assembly does not intend this Act to allow, and this Act shall not allow, actions to be brought against constitutionally protected activity.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Effective Date: 1/1/2024