HB3025 EngrossedLRB097 06857 AEK 46950 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Personal Information Protection Act is
5amended by changing Sections 5, 10, and 12 and by adding
6Section 40 as follows:
 
7    (815 ILCS 530/5)
8    Sec. 5. Definitions. In this Act:
9    "Data Collector" may include, but is not limited to,
10government agencies, public and private universities,
11privately and publicly held corporations, financial
12institutions, retail operators, and any other entity that, for
13any purpose, handles, collects, disseminates, or otherwise
14deals with nonpublic personal information.
15    "Breach of the security of the system data" or "breach"
16means unauthorized acquisition of computerized data that
17compromises the security, confidentiality, or integrity of
18personal information maintained by the data collector. "Breach
19of the security of the system data" does not include good faith
20acquisition of personal information by an employee or agent of
21the data collector for a legitimate purpose of the data
22collector, provided that the personal information is not used
23for a purpose unrelated to the data collector's business or

 

 

HB3025 Engrossed- 2 -LRB097 06857 AEK 46950 b

1subject to further unauthorized disclosure.
2    "Personal information" means an individual's first name or
3first initial and last name in combination with any one or more
4of the following data elements, when either the name or the
5data elements are not encrypted or redacted:
6        (1) Social Security number.
7        (2) Driver's license number or State identification
8    card number.
9        (3) Account number or credit or debit card number, or
10    an account number or credit card number in combination with
11    any required security code, access code, or password that
12    would permit access to an individual's financial account.
13"Personal information" does not include publicly available
14information that is lawfully made available to the general
15public from federal, State, or local government records.
16(Source: P.A. 94-36, eff. 1-1-06.)
 
17    (815 ILCS 530/10)
18    Sec. 10. Notice of Breach.
19    (a) Any data collector that owns or licenses personal
20information concerning an Illinois resident shall notify the
21resident at no charge that there has been a breach of the
22security of the system data following discovery or notification
23of the breach. The disclosure notification shall be made in the
24most expedient time possible and without unreasonable delay,
25consistent with any measures necessary to determine the scope

 

 

HB3025 Engrossed- 3 -LRB097 06857 AEK 46950 b

1of the breach and restore the reasonable integrity, security,
2and confidentiality of the data system. The disclosure
3notification to an Illinois resident shall include, but need
4not be limited to, (i) the toll-free numbers and addresses for
5consumer reporting agencies, (ii) the toll-free number,
6address, and website address for the Federal Trade Commission,
7and (iii) a statement that the individual can obtain
8information from these sources about fraud alerts and security
9freezes. The notification shall not, however, include
10information concerning the number of Illinois residents
11affected by the breach.
12    (b) Any data collector that maintains or stores, but does
13not own or license, computerized data that includes personal
14information that the data collector does not own or license
15shall notify the owner or licensee of the information of any
16breach of the security of the data immediately following
17discovery, if the personal information was, or is reasonably
18believed to have been, acquired by an unauthorized person. In
19addition to providing such notification to the owner or
20licensee, the data collector shall cooperate with the owner or
21licensee in matters relating to the breach. That cooperation
22shall include, but need not be limited to, (i) informing the
23owner or licensee of the breach, including giving notice of the
24date or approximate date of the breach and the nature of the
25breach, and (ii) informing the owner or licensee of any steps
26the data collector has taken or plans to take relating to the

 

 

HB3025 Engrossed- 4 -LRB097 06857 AEK 46950 b

1breach. The data collector's cooperation shall not, however, be
2deemed to require either the disclosure of confidential
3business information or trade secrets or the notification of an
4Illinois resident who may have been affected by the breach.
5    (b-5) The notification to an Illinois resident required by
6subsection (a) of this Section may be delayed if an appropriate
7law enforcement agency determines that notification will
8interfere with a criminal investigation and provides the data
9collector with a written request for the delay. However, the
10data collector must notify the Illinois resident as soon as
11notification will no longer interfere with the investigation.
12    (c) For purposes of this Section, notice to consumers may
13be provided by one of the following methods:
14        (1) written notice;
15        (2) electronic notice, if the notice provided is
16    consistent with the provisions regarding electronic
17    records and signatures for notices legally required to be
18    in writing as set forth in Section 7001 of Title 15 of the
19    United States Code; or
20        (3) substitute notice, if the data collector
21    demonstrates that the cost of providing notice would exceed
22    $250,000 or that the affected class of subject persons to
23    be notified exceeds 500,000, or the data collector does not
24    have sufficient contact information. Substitute notice
25    shall consist of all of the following: (i) email notice if
26    the data collector has an email address for the subject

 

 

HB3025 Engrossed- 5 -LRB097 06857 AEK 46950 b

1    persons; (ii) conspicuous posting of the notice on the data
2    collector's web site page if the data collector maintains
3    one; and (iii) notification to major statewide media.
4    (d) Notwithstanding any other subsection in this Section
5(c), a data collector that maintains its own notification
6procedures as part of an information security policy for the
7treatment of personal information and is otherwise consistent
8with the timing requirements of this Act, shall be deemed in
9compliance with the notification requirements of this Section
10if the data collector notifies subject persons in accordance
11with its policies in the event of a breach of the security of
12the system data.
13(Source: P.A. 94-36, eff. 1-1-06; 94-947, eff. 6-27-06.)
 
14    (815 ILCS 530/12)
15    Sec. 12. Notice of breach; State agency.
16    (a) Any State agency that collects personal information
17concerning an Illinois resident shall notify the resident at no
18charge that there has been a breach of the security of the
19system data or written material following discovery or
20notification of the breach. The disclosure notification shall
21be made in the most expedient time possible and without
22unreasonable delay, consistent with any measures necessary to
23determine the scope of the breach and restore the reasonable
24integrity, security, and confidentiality of the data system.
25The disclosure notification to an Illinois resident shall

 

 

HB3025 Engrossed- 6 -LRB097 06857 AEK 46950 b

1include, but need not be limited to, (i) the toll-free numbers
2and addresses for consumer reporting agencies, (ii) the
3toll-free number, address, and website address for the Federal
4Trade Commission, and (iii) a statement that the individual can
5obtain information from these sources about fraud alerts and
6security freezes. The notification shall not, however, include
7information concerning the number of Illinois residents
8affected by the breach.
9    (a-5) The notification to an Illinois resident required by
10subsection (a) of this Section may be delayed if an appropriate
11law enforcement agency determines that notification will
12interfere with a criminal investigation and provides the State
13agency with a written request for the delay. However, the State
14agency must notify the Illinois resident as soon as
15notification will no longer interfere with the investigation.
16    (b) For purposes of this Section, notice to residents may
17be provided by one of the following methods:
18        (1) written notice;
19        (2) electronic notice, if the notice provided is
20    consistent with the provisions regarding electronic
21    records and signatures for notices legally required to be
22    in writing as set forth in Section 7001 of Title 15 of the
23    United States Code; or
24        (3) substitute notice, if the State agency
25    demonstrates that the cost of providing notice would exceed
26    $250,000 or that the affected class of subject persons to

 

 

HB3025 Engrossed- 7 -LRB097 06857 AEK 46950 b

1    be notified exceeds 500,000, or the State agency does not
2    have sufficient contact information. Substitute notice
3    shall consist of all of the following: (i) email notice if
4    the State agency has an email address for the subject
5    persons; (ii) conspicuous posting of the notice on the
6    State agency's web site page if the State agency maintains
7    one; and (iii) notification to major statewide media.
8    (c) Notwithstanding subsection (b), a State agency that
9maintains its own notification procedures as part of an
10information security policy for the treatment of personal
11information and is otherwise consistent with the timing
12requirements of this Act shall be deemed in compliance with the
13notification requirements of this Section if the State agency
14notifies subject persons in accordance with its policies in the
15event of a breach of the security of the system data or written
16material.
17    (d) If a State agency is required to notify more than 1,000
18persons of a breach of security pursuant to this Section, the
19State agency shall also notify, without unreasonable delay, all
20consumer reporting agencies that compile and maintain files on
21consumers on a nationwide basis, as defined by 15 U.S.C.
22Section 1681a(p), of the timing, distribution, and content of
23the notices. Nothing in this subsection (d) shall be construed
24to require the State agency to provide to the consumer
25reporting agency the names or other personal identifying
26information of breach notice recipients.

 

 

HB3025 Engrossed- 8 -LRB097 06857 AEK 46950 b

1(Source: P.A. 94-947, eff. 6-27-06.)
 
2    (815 ILCS 530/40 new)
3    Sec. 40. Disposal of materials containing personal
4information; Attorney General.
5    (a) In this Section, "person" means: a natural person; a
6corporation, partnership, association, or other legal entity;
7a unit of local government or any agency, department, division,
8bureau, board, commission, or committee thereof; or the State
9of Illinois or any constitutional officer, agency, department,
10division, bureau, board, commission, or committee thereof.
11    (b) A person must dispose of the materials containing
12personal information in a manner that renders the personal
13information unreadable, unusable, and undecipherable. Proper
14disposal methods include, but are not limited to, the
15following:
16        (1) Paper documents containing personal information
17    may be either redacted, burned, pulverized, or shredded so
18    that personal information cannot practicably be read or
19    reconstructed.
20        (2) Electronic media and other non-paper media
21    containing personal information may be destroyed or erased
22    so that personal information cannot practicably be read or
23    reconstructed.
24    (c) Any person disposing of materials containing personal
25information may contract with a third party to dispose of such

 

 

HB3025 Engrossed- 9 -LRB097 06857 AEK 46950 b

1materials in accordance with this Section. Any third party that
2contracts with a person to dispose of materials containing
3personal information must implement and monitor compliance
4with policies and procedures that prohibit unauthorized access
5to or acquisition of or use of personal information during the
6collection, transportation, and disposal of materials
7containing personal information.
8    (d) Any person, including but not limited to a third party
9referenced in subsection (c), who violates this Section is
10subject to a civil penalty of not more than $100 for each
11individual with respect to whom personal information is
12disposed of in violation of this Section. A civil penalty may
13not, however, exceed $50,000 for each instance of improper
14disposal of materials containing personal information. The
15Attorney General may impose a civil penalty after notice to the
16person accused of violating this Section and an opportunity for
17that person to be heard in the matter. The Attorney General may
18file a civil action in the circuit court to recover any penalty
19imposed under this Section.
20    (e) In addition to the authority to impose a civil penalty
21under subsection (d), the Attorney General may bring an action
22in the circuit court to remedy a violation of this Section,
23seeking any appropriate relief.