(c) Notwithstanding subsection (b), a State agency
that maintains its own notification procedures as part of an
information security policy for the treatment of personal
information and is otherwise consistent with the timing requirements of this Act shall be deemed in compliance
with the notification requirements of this Section if the
State agency notifies subject persons in accordance with its policies in the event of a breach of the security of the system data or written material.
(d) If a State agency is required to notify more than 1,000 persons of a breach of security pursuant to this Section, the State agency shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notices. Nothing in this subsection (d) shall be construed to require the State agency to provide to the consumer reporting agency the names or other personal identifying information of breach notice recipients.
(Source: P.A. 97-483, eff. 1-1-12.)