100TH GENERAL ASSEMBLY
State of Illinois
2017 and 2018
HB4367

 

Introduced , by Rep. Barbara Wheeler

 

SYNOPSIS AS INTRODUCED:
 
815 ILCS 530/10

    Amends the Personal Information Protection Act. Provides that a private entity data collector that owns or licenses personal information concerning an Illinois resident must notify the resident of any security breach of the system data within 14 days after discovery of the breach (rather than requiring notification in the most expedient time possible and without unreasonable delay).


LRB100 16914 JLS 32056 b

FISCAL NOTE ACT MAY APPLY

 

 

A BILL FOR

 

HB4367LRB100 16914 JLS 32056 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 5. The Personal Information Protection Act is
5amended by changing Section 10 as follows:
 
6    (815 ILCS 530/10)
7    Sec. 10. Notice of breach.
8    (a) Any data collector that owns or licenses personal
9information concerning an Illinois resident shall notify the
10resident at no charge that there has been a breach of the
11security of the system data following discovery or notification
12of the breach. The disclosure notification shall be made by
13private entities within 14 days after discovery of the breach
14and by public entities in the most expedient time possible and
15without unreasonable delay, consistent with any measures
16necessary to determine the scope of the breach and restore the
17reasonable integrity, security, and confidentiality of the
18data system. The disclosure notification to an Illinois
19resident shall include, but need not be limited to, information
20as follows:
21        (1) With respect to personal information as defined in
22    Section 5 in paragraph (1) of the definition of "personal
23    information":

 

 

HB4367- 2 -LRB100 16914 JLS 32056 b

1            (A) the toll-free numbers and addresses for
2        consumer reporting agencies;
3            (B) the toll-free number, address, and website
4        address for the Federal Trade Commission; and
5            (C) a statement that the individual can obtain
6        information from these sources about fraud alerts and
7        security freezes.
8        (2) With respect to personal information defined in
9    Section 5 in paragraph (2) of the definition of "personal
10    information", notice may be provided in electronic or other
11    form directing the Illinois resident whose personal
12    information has been breached to promptly change his or her
13    user name or password and security question or answer, as
14    applicable, or to take other steps appropriate to protect
15    all online accounts for which the resident uses the same
16    user name or email address and password or security
17    question and answer.
18    The notification shall not, however, include information
19concerning the number of Illinois residents affected by the
20breach.
21    (b) Any data collector that maintains or stores, but does
22not own or license, computerized data that includes personal
23information that the data collector does not own or license
24shall notify the owner or licensee of the information of any
25breach of the security of the data immediately following
26discovery, if the personal information was, or is reasonably

 

 

HB4367- 3 -LRB100 16914 JLS 32056 b

1believed to have been, acquired by an unauthorized person. In
2addition to providing such notification to the owner or
3licensee, the data collector shall cooperate with the owner or
4licensee in matters relating to the breach. That cooperation
5shall include, but need not be limited to, (i) informing the
6owner or licensee of the breach, including giving notice of the
7date or approximate date of the breach and the nature of the
8breach, and (ii) informing the owner or licensee of any steps
9the data collector has taken or plans to take relating to the
10breach. The data collector's cooperation shall not, however, be
11deemed to require either the disclosure of confidential
12business information or trade secrets or the notification of an
13Illinois resident who may have been affected by the breach.
14    (b-5) The notification to an Illinois resident required by
15subsection (a) of this Section may be delayed if an appropriate
16law enforcement agency determines that notification will
17interfere with a criminal investigation and provides the data
18collector with a written request for the delay. However, the
19data collector must notify the Illinois resident as soon as
20notification will no longer interfere with the investigation.
21    (c) For purposes of this Section, notice to consumers may
22be provided by one of the following methods:
23        (1) written notice;
24        (2) electronic notice, if the notice provided is
25    consistent with the provisions regarding electronic
26    records and signatures for notices legally required to be

 

 

HB4367- 4 -LRB100 16914 JLS 32056 b

1    in writing as set forth in Section 7001 of Title 15 of the
2    United States Code; or
3        (3) substitute notice, if the data collector
4    demonstrates that the cost of providing notice would exceed
5    $250,000 or that the affected class of subject persons to
6    be notified exceeds 500,000, or the data collector does not
7    have sufficient contact information. Substitute notice
8    shall consist of all of the following: (i) email notice if
9    the data collector has an email address for the subject
10    persons; (ii) conspicuous posting of the notice on the data
11    collector's web site page if the data collector maintains
12    one; and (iii) notification to major statewide media or, if
13    the breach impacts residents in one geographic area, to
14    prominent local media in areas where affected individuals
15    are likely to reside if such notice is reasonably
16    calculated to give actual notice to persons whom notice is
17    required.
18    (d) Notwithstanding any other subsection in this Section, a
19data collector that maintains its own notification procedures
20as part of an information security policy for the treatment of
21personal information and is otherwise consistent with the
22timing requirements of this Act, shall be deemed in compliance
23with the notification requirements of this Section if the data
24collector notifies subject persons in accordance with its
25policies in the event of a breach of the security of the system
26data.

 

 

HB4367- 5 -LRB100 16914 JLS 32056 b

1(Source: P.A. 99-503, eff. 1-1-17; 100-201, eff. 8-18-17.)