title
PROPOSED ORDINANCE AMENDMENT
PROHIBITING DISCLOSURE OF PERSONAL INFORMATION
BE IT ORDAINED, by the Cook County Board of Commissioners, that Chapter 34 Finance, Article IV Procurement Code, Division 9 Contract Management, Section 34-303 of the Cook County Code is hereby amended as Follows:
Sec. 34-303. Prohibiting disclosure of personal information.
The purpose is this section is to prohibit the disclosure of personal information via county contracts.
(a) County personnel shall not disclose personal information accessed through County responsibilities absent a criminal warrant, judicial court order, or as otherwise required pursuant to state or federal law that is not related to the enforcement of immigration laws.
(b) County vendors and third parties shall not disclose personal information acquired from the County to any third party, directly, indirectly or by implication, use the data, whether during the term of an agreement or at any time thereafter, in the following manner:
(1) to immigration agents or for an immigration enforcement purpose unless required pursuant to a criminal warrant, or judicial court order;
(2) to a data broker;
(3) for a commercial purpose;
(4) for a risk solutions purpose.
(c) Any vendor or third party which discloses, uses, or possesses personal information acquired from the County in violation of the requirements of Section (b) shall notify the relevant County agency of the violation and the type of personal information impacted, and shall be required by the County agency to cease any access, use or disclosure of personal information and, where possible, delete personal information in its possession that is in violation of these requirements.
(d) The Cook County Office of the Independent Inspector General (OIIG) may conduct periodic audits to ensure compliance under this section including but not limited to whether personal information has been disclosed to immigration agents directly or indirectly through County vendors or third parties. The results of such audits shall be made publicly available. The OIIG shall consult with the Bureau of Technology’s Chief Information Security Officer to determine if a violation of this section has occurred.
(e) Any person whose personal information has been collected, used or disclosed by a data broker in violation of this Section shall have a private right of action for injunctive and declaratory relief in a State circuit court or as a supplemental claim in federal district court against the offending data broker.
(f) The following words, terms, and phrases, when used in this section shall have the meanings ascribed to them in this section:
The term “County personnel” means any employee, official, agent, or contractor of a Cook County agency, board, bureau, commission, department, division, and/or office.
The term “third party vendor” means any subcontractor, company, independent contractor, or vendor of any kind that is not a direct employee or corporate division of Consultant. Third Party Vendors includes Subconsultants as may be defined in the Underlying Contract.
The term “personal information” means personal data or information that relates to a specific, identifiable, individual person, including County personnel, and includes all variations of that term as defined in the Applicable Data and Security Privacy Laws, Personal Information Protection Act, and Freedom of Information Act. For the avoidance of doubt, Personally Identifiable Information includes: (a) any government-issued identification numbers (e.g., Social Security, driver’s license, passport); (b) any financial account information, including account numbers, credit card numbers, debit card numbers, and other Cardholder Data; (c) Criminal Justice Information; (d) Protected Health Information; (e) Biometric Information; (f) passwords or other access-related information associated with any user account; (g) home address; (h) personal license plates and (i) any other personal data defined as Personally Identifiable Information under data breach notification laws.
The term “immigration agent” means any employee, agent, or contractor of a federal, state or local agency that enforces immigration law.
The term “data broker” means a non-governmental entity that collects personal information and resells or discloses that information to others.
The term “risk solutions” means using personal information to assess or predict a person’s perceived level of risk across various contexts, including, but not limited to, criminal justice, health services, social services, and housing.
Effective date: This ordinance shall be in effect immediately upon adoption.
end