§ 2-68-050 — Data residency requirements for City data

2-68-050 Data residency requirements for City data.

(a) For purposes of this section: “City data” means final versions of information that are: (1) in alphanumeric form reflected in a list, table, graph, chart or other non-narrative form, that can be digitally stored and retrieved; (2) created or maintained by or on behalf of a City agency and are controlled by that City agency; and (3) related to the mission of a City agency. The term “City data” shall not include information that is: (1) provided to a City agency by other entities; (2) created or maintained by or on behalf of a City or other United States public safety official operating in their official capacity outside of the United States; (3) subject to one or more international exchange agreements for the exchange of criminal justice information with one or more foreign government agencies; or (4) created or maintained for the purpose of backup or recovery. “Earned credit” means the amount of the bid preference allocated to a vendor upon completion of a contract during which the vendor met a data residency commitment under subsection (c)(1) of this section during the performance of a City contract. (b) Unless otherwise authorized by the Chief Information Officer, any contract advertised and entered into by the City after the effective date of this section that provides for the storage of any City data shall include a requirement that such City data must be processed, stored, and disposed of within the jurisdiction of the United States. (c) (1) Unless otherwise prohibited by federal or State law, and subject to paragraphs (2) through (5) of this subsection (c), for any contract advertised and entered into by the City after the effective date of this section that provides for the storage of City data, the Chief Procurement Officer shall allocate to any qualified bidder an earned credit of: (A) two percent of the contract base bid for ensuring that all such City data are stored within the State of Illinois outside the corporate boundaries of the City; and (B) four percent of the contract base bid for ensuring that all such City data are stored within the corporate boundaries of the City other than at a City-owned data center. (2) Any earned credit allocated pursuant to this section must be utilized within three years of issuance by the Chief Procurement Officer. (3) If a contractor is allocated a bid preference pursuant to Section 2-92-412, the contract shall not be eligible to receive the earned credit allocated pursuant to this section. (4) The Chief Procurement Officer may determine not to allocate an earned credit under this section when the Chief Procurement Officer determines doing so is not in the City’s best interest. (5) As part of the contract closeout procedure, if the Chief Procurement Officer determines that the contractor has successfully met its data residency commitment, the Chief Procurement Officer shall issue an earned credit certificate that evidences the amount of earned credits allocated to the vendor. The vendor may apply the earned credits as the bid preference for any future contract bid of equal or greater dollar value. The earned credit certificate is valid for three years from the date of issuance and shall not be applied to any future contract bid after the expiration of that period. To receive the earned credit certificate, the vendor shall maintain accurate and detailed books and records necessary to monitor compliance with this section and shall submit such reports as required by the Chief Procurement Officer or the commissioner of the supervising department. Full access to the contractor’s records shall be granted to the Chief Procurement Officer, the commissioner of the supervising department, or any designee thereof. The contractor shall maintain all relevant records for at least three years after final acceptance of the work. (d) The Chief Information Officer and Chief Procurement Officer are authorized to adopt rules for the proper administration and enforcement of this section. The Chief Information Officer is authorized to define by rule the term “data center” for purposes of this section. (Added Coun. J. 9-18-24, p. 16423, § 1; Amend Coun. J. 12-20-25, p. 38352, § 2)