Bill Text: IL HB3200 | 2019-2020 | 101st General Assembly | Introduced

---

Bill Title: Amends the Personal Information Protection Act. Provides that if there is a breach of the security of system data, a data collector must notify the Attorney General in addition to the Illinois resident to whom the breach relates. Requires the notice to be provided no later than 5 days after the breach.

Spectrum: Partisan Bill (Democrat 2-0)

Status: (Introduced - Dead) 2019-03-29 - House Committee Amendment No. 1 Rule 19(c) / Re-referred to Rules Committee [HB3200 Detail]

Download: Illinois-2019-HB3200-Introduced.html

---

101ST GENERAL ASSEMBLY State of Illinois 2019 and 2020 HB3200 Introduced , by Rep. Diane Pappas SYNOPSIS AS INTRODUCED:
815 ILCS 530/10
Amends the Personal Information Protection Act. Provides that if there is a breach of the security of system data, a data collector must notify the Attorney General in addition to the Illinois resident to whom the breach relates. Requires the notice to be provided no later than 5 days after the breach.
LRB101 10070 JLS 55173 b
A BILL FOR
HB3200 LRB101 10070 JLS 55173 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 5. The Personal Information Protection Act is
amended by changing Section 10 as follows:
(815 ILCS 530/10)
Sec. 10. Notice of breach.
(a) Any data collector that owns or licenses personal
information concerning an Illinois resident shall notify the
Attorney General and the resident at no charge that there has
been a breach of the security of the system data following
discovery or notification of the breach. The disclosure
notification shall be made in the most expedient time possible,
but no later than 5 days after the breach and without
unreasonable delay, consistent with any measures necessary to
determine the scope of the breach and restore the reasonable
integrity, security, and confidentiality of the data system.
The disclosure notification to an Illinois resident shall
include, but need not be limited to, information as follows:
(1) With respect to personal information as defined in
Section 5 in paragraph (1) of the definition of "personal
information":
(A) the toll-free numbers and addresses for

HB3200 - 2 - LRB101 10070 JLS 55173 b
consumer reporting agencies;
(B) the toll-free number, address, and website
address for the Federal Trade Commission; and
(C) a statement that the individual can obtain
information from these sources about fraud alerts and
security freezes.
(2) With respect to personal information defined in
Section 5 in paragraph (2) of the definition of "personal
information", notice may be provided in electronic or other
form directing the Illinois resident whose personal
information has been breached to promptly change his or her
user name or password and security question or answer, as
applicable, or to take other steps appropriate to protect
all online accounts for which the resident uses the same
user name or email address and password or security
question and answer.
The notification shall not, however, include information
concerning the number of Illinois residents affected by the
breach.
(b) Any data collector that maintains or stores, but does
not own or license, computerized data that includes personal
information that the data collector does not own or license
shall notify the Attorney General and the owner or licensee of
the information of any breach of the security of the data
immediately following discovery, if the personal information
was, or is reasonably believed to have been, acquired by an

HB3200 - 3 - LRB101 10070 JLS 55173 b
unauthorized person. In addition to providing such
notification to the owner or licensee, the data collector shall
cooperate with the owner or licensee in matters relating to the
breach. That cooperation shall include, but need not be limited
to, (i) informing the owner or licensee of the breach,
including giving notice of the date or approximate date of the
breach and the nature of the breach, and (ii) informing the
owner or licensee of any steps the data collector has taken or
plans to take relating to the breach. The data collector's
cooperation shall not, however, be deemed to require either the
disclosure of confidential business information or trade
secrets or the notification of an Illinois resident who may
have been affected by the breach.
(b-5) The notification to an Illinois resident required by
subsection (a) of this Section may be delayed if an appropriate
law enforcement agency determines that notification will
interfere with a criminal investigation and provides the data
collector with a written request for the delay. However, the
data collector must notify the Illinois resident as soon as
notification will no longer interfere with the investigation.
(c) For purposes of this Section, notice to consumers may
be provided by one of the following methods:
(1) written notice;
(2) electronic notice, if the notice provided is
consistent with the provisions regarding electronic
records and signatures for notices legally required to be

HB3200 - 4 - LRB101 10070 JLS 55173 b
in writing as set forth in Section 7001 of Title 15 of the
United States Code; or
(3) substitute notice, if the data collector
demonstrates that the cost of providing notice would exceed
$250,000 or that the affected class of subject persons to
be notified exceeds 500,000, or the data collector does not
have sufficient contact information. Substitute notice
shall consist of all of the following: (i) email notice if
the data collector has an email address for the subject
persons; (ii) conspicuous posting of the notice on the data
collector's web site page if the data collector maintains
one; and (iii) notification to major statewide media or, if
the breach impacts residents in one geographic area, to
prominent local media in areas where affected individuals
are likely to reside if such notice is reasonably
calculated to give actual notice to persons whom notice is
required.
(d) Notwithstanding any other subsection in this Section, a
data collector that maintains its own notification procedures
as part of an information security policy for the treatment of
personal information and is otherwise consistent with the
timing requirements of this Act, shall be deemed in compliance
with the notification requirements of this Section if the data
collector notifies subject persons in accordance with its
policies in the event of a breach of the security of the system
data.

HB3200 - 5 - LRB101 10070 JLS 55173 b
(Source: P.A. 99-503, eff. 1-1-17; 100-201, eff. 8-18-17.)