title
PROPOSED ORDINANCE AMENDMENT
PROHIBITING DISCLOSURE OF PERSONAL OR PRIVATE INFORMATION
BE IT ORDAINED, by the Cook County Board of Commissioners, that Chapter 34 Finance, Article IV Procurement Code, Division 9 Contract Management, Section 34-303 of the Cook County Code is hereby amended as Follows:
Sec. 34-303. Prohibiting disclosure of personal information.
The purpose of this section is to prohibit the disclosure of personal information or private information by County contractors or persons with access to said personal information and/or private information via County contracts.
(a) The following words, terms, and phrases, when used in this Section shall have the meanings ascribed to them in this section:
The term “personal information” has the meaning ascribed to that term in the Illinois Personal Information Protection Act, 815 ILCS 530/5.
The term “private information" has the meaning ascribed to that term in the Illinois Freedom of Information Act, 5 ILCS 140/2.
The term “immigration agent” means an agent of federal Immigration and Customs Enforcement, federal Customs and Border Protection, or any similar or successor agency, or any other individual with the power to investigate, arrest, or detain individuals or manage custody of detained individuals for purposes of civil immigration enforcement while acting in that capacity or conducting investigations or enforcement pursuant to that power.
The term “data broker” means a person that collects personal information or private information and resells or discloses that information to others for profit.
(b) County employees shall not disclose personal information or private information accessed through County responsibilities for immigration enforcement purposes absent a criminal warrant, or judicial court order, or as required by 8 U.S.C. § 1373.
(c) No County contractor or person shall disclose personal information or private information acquired from the County pursuant to a contract whether during the term of the contract or at any time thereafter, in the following manner:
(1) to immigration agents unless required pursuant to a criminal warrant, or judicial court order;
(2) to a data broker or for a commercial purpose unless authorized under County ordinance.
(d) Any contractor or person which discloses or uses personal information and/or private information acquired from the County through a contract in violation of the requirements of Section (c) shall notify the relevant County using agency within five business days regarding the violation and the type of personal information and/or private information impacted. The contractor or person shall be required to: cease any further disclosures of the personal information and/or private information; comply with relevant legal requirements for unlawful disclosures of personal information and/or private information under State and federal law; and make best efforts to obligate any and all third parties to which the contractor or person disclosed data in violation of this section to permanently delete all such data.
(e) The Cook County Office of the Independent Inspector General (OIIG) may conduct periodic reviews to ensure compliance under this section including but not limited to whether personal information or private information has been disclosed in violation of section (c). The results of such review will be issued as an OIIG Public Statement so long as they meet the requirements for such; otherwise, the results will appear in the OIIG’s public Quarterly Report. The applicable using agency shall cooperate with the OIIG in conducting any such reviews to determine if a violation of this section has occurred.
(f) Any person whose personal information or private information has been used or disclosed by a contractor in violation of this Section shall have a private right of action against that contractor in a civil action for injunctive and declaratory relief together with costs and such reasonable attorney's fees as the court allows.
Effective date: This ordinance shall be in effect 60 days after adoption.
end