Cook County bars its contractors from giving residents' data to ICE or data brokers

The Cook County Board passed an ordinance this week barring every company with a county contract from giving residents' personal information to immigration agents or selling it to data brokers. The full text is embedded below.

Cook County has limited its cooperation with ICE since its 2011 detainer ordinance, but those rules bind county employees, not the companies hired by the county. Jail data reached ICE through one of those companies:

1. The State's Attorney's Office contracts with Appriss to run VINE, a service that alerts crime victims when someone is released from jail, and Appriss receives the county's jail custody data to send those alerts.
2. A "Risk Solutions" clause in the contract allowed Appriss to share that data with other companies, including LexisNexis Risk Solutions.
3. LexisNexis sells law enforcement access to that data through its Accurint database, and ICE is a paying customer.

In a separate Illinois case, an ICE officer described under oath finding a man by searching St. Clair County jail bookings in LexisNexis.

What the ordinance says

• Contractors cannot disclose personal or private information they received from the county to immigration agents unless the agent has a criminal warrant or a judicial court order. ICE's administrative warrants are signed by immigration officers rather than judges, so they do not qualify.
• Contractors cannot pass that information to a data broker, which the ordinance defines as anyone who collects personal information and resells or discloses it for profit, or use it for any commercial purpose unless a county ordinance allows it.
• The ban applies for the life of the contract and continues after the contract ends.
• A contractor that violates it has five business days to report the violation to the county agency it works for, must stop the disclosures, and must make "best efforts" to get anyone it shared the data with to delete it.
• The county's Office of the Independent Inspector General may review compliance and publish the results.
• Anyone whose information was disclosed in violation of the ordinance can sue the contractor for an injunction and declaratory relief, plus court costs and attorney's fees. The ordinance sets no fines and no money damages.

The definitions

The ordinance does not write its own definition of the personal information that cannot be shared; instead, it refers to two state laws. The Illinois Personal Information Protection Act covers a person's name combined with an identifier such as a Social Security, driver's license or account number, or medical information, and it excludes information the government lawfully makes public. The Illinois FOIA's definition of "private information" covers Social Security and driver's license numbers, medical records, personal phone numbers and email addresses, home addresses and license plates. Neither law names custody status, booking dates or release dates, which are the records VINE sends, so a future amendment could add them.

The ordinance takes effect 60 days after passage. The county's Appriss contract expires in October, and the county has been taking bids for a new vendor. Commissioner Jessica Vásquez, one of the sponsors, said she hopes to introduce a resolution on Flock license plate cameras next month.

The Cook County Sheriff's Office is tracked at FinePrint.