SB0209 94TH GENERAL ASSEMBLY

LRB094 05727 MKM 35779 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
SB0209

Introduced 2/2/2005, by Sen. Martin A. Sandoval

SYNOPSIS AS INTRODUCED:

New Act

Creates the Personal Information Protection Act. Requires each financial institution to provide an annual disclosure statement to all persons for which the financial institution maintains unencrypted personal information concerning measures the financial institution has taken to prevent (i) a breach of the security system and (ii) any unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the financial institution. Requires each financial institution to maintain duplicate records of all computerized data at a back-up site located at least 90 miles from the primary site at which the data is stored. Provides that the effectiveness of the back-up site shall be tested annually and requires the results of that test to be included in the annual disclosure statement.

A BILL FOR

AN ACT concerning regulation.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Personal Information Protection Act.

Section 5. Definitions. As used in this Act:

"Financial institution" means (i) any bank subject to the Illinois Banking Act, any savings bank subject to the Savings Bank Act, any savings and loan association subject to the Illinois Savings and Loan Act of 1985, or any credit union subject to the Illinois Credit Union Act; (ii) any federally chartered commercial bank, savings bank, savings and loan association, or credit union organized and operated in this State under the laws of the United States; and (iii) any business corporation, limited liability company, business trust, partnership, joint venture, or other entity that is directly or indirectly at least 50% owned by or commonly owned with a financial institution.

"Personal information" means a person's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(1) social security number;

(2) driver's license number or state identification card number; or

(3) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to a financial account. "Personal information" does not include information that is lawfully made available to the public from federal, State, or local government records.

Section 10. Disclosure of measures to prevent security breach. Each financial institution shall provide an annual disclosure statement to all persons for whom the financial institution maintains unencrypted personal information concerning the measures the financial institution has taken to prevent (i) a breach of the security system and (ii) any unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the financial institution. If a financial institution maintains computerized data that includes personal information that the financial institution does not own, the financial institution shall provide the annual disclosure statement to the owner or licensee of that information. The disclosure shall include an analysis of the testing of each back-up site, as required under Section 15.

Section 15. Maintenance of duplicate records. Each financial institution shall maintain duplicate records of all computerized data at a back-up site located at least 90 miles from the primary site at which the data is stored. The effectiveness of the back-up site in the event of a breach of the security system at the primary site shall be tested annually.