The Illinois Personal Information Protection Act, 815 ILCS 530/1 provides that any data collector that owns or licenses personal information concerning an Illinois resident shall notify the resident at no charge if there has been a breach of the security of the system data following discovery or notification of the breach. The disclosure notification shall be made in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Furthermore the act provides that any data collector that maintains or stores, but does not own or license, computerized data that includes personal information that the data collector does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

If the data collector demonstrates that the cost of providing notice would exceed $250,000 or that the affected class of subject persons to be notified exceeds 500,000, or the data collector does not have sufficient contact information, substitute notice (as defined in the Act) may be provided.

“Personal information” is defined as a person’s name plus one of the following: social security number; driver’s license number or state identification card number; account number or credit or debit card number; medical information; health insurance information; or unique biometric data. “Personal information” also includes a user name or email address in combination with a password or security question and answer that would permit access to an online account.

For more information, visit the Illinois Attorney General Data Breech Webpage: https://illinoisattorneygeneral.gov/Consumer-Protection/For-Businesses/Data-Breach/.