A new Illinois data privacy law specifically tailored to motor vehicle-secured financing transactions became effective on January 1, 2024. The law, Senate Bill 800, amends the Illinois Collateral Recovery Act and requires licensed repossession agencies to clear, erase, delete, or otherwise eliminate personal information collected or stored in a vehicle after repossession.

The law defines "personal information" as information that is associated with an owner, driver, or passenger of the collateral and that is collected and stored by electronic means in or by the collateral (this appears to include information saved to the cloud that is accessible-and erasable-from the vehicle) during the course of use of that collateral. The law specifically refers to several examples of covered personal information, including, but not limited to:

The law also expressly covers information that is deemed "sensitive personal information" by the Federal Trade Commission, "personally identifiable information" under federal Illinois law, and "individually identifiable health information" under the Health Insurance Portability and Accountability Act. To ensure that the Jaw covers all bases, the Illinois legislature added a broad catch-all to cover "information that a licensed repossession agency reasonably believes would be deemed confidential or private by the person who is associated with the information."

A repossession agency that has cause to believe that a repossessed vehicle collects personal information must delete or otherwise clear this information from the repossessed vehicle as soon as practicable upon repossession of the vehicle and prior to release of the vehicle. (As an aside, the law does not make an exception to the requirement to delete information when the vehicle is released back to the consumer, perhaps upon reinstatement). The repossession agency must use a standardized electronic solution approved by the American Recovery Association to delete covered information.