Just when we thought we had covered all the changes in Illinois employment laws for 2025-2026, there is yet another change, this time to the Illinois Right to Privacy in the Workplace Act (820 ILCS 55/et seq.). SB2339 was introduced in February 2025, underwent multiple amendments in the Senate, sat idle for many months in the House, and then, in the Fall veto session, passed both chambers on October 30, 2025, and was signed by Governor Pritzker on December 12, 2025. The law is effective immediately.
The Right to Privacy in the Workplace Act (“the Act”) regulates multiple areas, including 1) discrimination for the lawful use of products, such as cannabis (Section 5); 2) requiring an employee or prospective employee to provide access to their social media or online accounts (Section 10); and 3) use of E-Verify and restrictions against taking certain actions relating to employment eligibility verification (Sections 12 and 13, respectively). We wrote last year about amendments to the Act, including the provision that employers could not impose work authorization verification or reverification requirements greater than those required by federal law. Last year’s amendments (in Section 13) also listed out new requirements if the employer finds a discrepancy in the employee’s “employment verification information” or if the employer receives notification from any federal agency of a discrepancy “as it relates to work authorization.” The requirements include providing the employee with the paperwork showing what was deemed to be deficient, instructions on how the employee can correct the documents, and an explanation of the employee’s right to have representation.
Procedures if Taxpayer Identification Number Discrepancy
SB2339 repeals Sections 12 and 13 and adds Section 14, which states that if the employer receives written notification from any federal agency or other outside vendor not responsible for the enforcement of immigration law, including but not limited to the Social Security Administration, the IRS, or an insurance company, of a discrepancy as it relates to an employee’s “individual taxpayer identification number or other identifying documents,” then there are certain steps the employer must take. Compare this to the prior phrasing of notification about discrepancies relating to “work authorization” and “employment verification information” found in Section 13, which is now repealed.
If such a discrepancy is found, the employer must first provide the notice to the employee and the employee’s authorized representative, if any, “as soon as practicable,” but no more than five days after receipt of the notification. The employer must notify the employee by hand if possible, and if not possible, by mail and email if an email address is known. The notice must include an explanation that the agency or vendor has notified the employer that the identification documents do not appear to match, the time period the employee has to contest the disputed information (and if the time period is required by federal law), and any action the employer is requiring the employee to take. Like Section 13 (now repealed), the employer may not take any adverse action against the employee solely based on the notice, and the employee has the right to have a representative present in any discussions, meetings, or proceedings with the employer.
Enhanced Enforcement Options
More importantly, SB2339 also adds new administration and enforcement powers, including now allowing enforcement by the Illinois Attorney General in addition to the Illinois Department of Labor (IDOL). The IDOL now has the power to conduct investigations, including visiting workplaces and inspecting documents to evaluate compliance with the Act, and conducting hearings. The IDOL may also issue cease and desist orders and assess civil penalties, among other things. The Attorney General can also investigate cases, though there is a provision stating that an employer will not be subject to a duplicative investigation involving the same individuals or arising out of the same facts.
Private Rights of Actions by Aggrieved Individuals and “Interested Parties”
Finally, and most significantly, SB2339 now allows for both a private right of action by the employee (Section 17), and a right of action for civil penalties by an “interested party” (Section 16). Further, these new provisions for litigation appear to apply to the entire Act, not just the portion related to employment eligibility verification. An “interested party” is defined as a not-for-profit corporation or a labor organization that monitors or “is attentive to” compliance with worker safety and privacy laws, wage and hour requirements, or other statutory requirements. This provision obviously exposes employers to a deluge of litigation from any such entity, particularly given the broad language of the organization being “attentive to” the various labor issues. Thus, any union or virtually any nonprofit organization can file claims at will, including lawsuits in state court, if it has a “reasonable belief” (undefined) that an employer is violating any part of the Act. For instance, these organizations may file claims if the employer did not follow the notice requirements to the letter of the law, such as emailing or mailing instead of handing the employee the notice of the discrepancy, or providing the notification six days after receipt of the notice rather than five. They can also seemingly file claims under the sections on the use of legal products and accessing social media accounts. Causes of action under this section have a three-year statute of limitations.
Interested parties can secure not only injunctive relief but also 10% of any statutory penalties, with the remaining 90% going to the state to fund enforcement of the Child Labor Law of 2024. Statutory penalties include fines between $100 and $1000 for each violation as adjudicated by the IDOL or a court, which depend in part on the size of the employer and the gravity of the offense. Second and subsequent violations within a three-year period cause the civil penalties to increase to $1,000 to $5,000 per violation. Other possible relief includes making the employee whole if the violation involved denial or loss of employment, including reinstatement with seniority rights, backpay with interest, a civil penalty of $10,000, plus attorney’s fees and litigation costs.
Finally, there is one saving grace for employers, which is the safe harbor provision found in Section 25 relating to the employment verification provisions of Section 14, which states that the employer can avoid civil penalties if it can show that it acted in good faith reliance on guidance issued by the IDOL or the Department of Homeland Security, or made a bona fide administrative error that did not affect an employee’s employment or pay.