SB1798 94TH GENERAL ASSEMBLY

LRB094 11157 RXD 41798 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
SB1798

Introduced 2/25/2005, by Sen. Peter J. Roskam

SYNOPSIS AS INTRODUCED:

New Act

Creates the Personal Information Protection Act. Requires any person, business, or State agency conducting business in the State, and that owns or licenses computerized data that includes vulnerable personal information, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any person whose unencrypted personal information was, or is reasonably believed to have been acquired by an unauthorized person. Requires any person, business, or State agency that maintains computerized data that includes vulnerable personal information that the person, business, or State agency does not own, to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the vulnerable personal information was, or is reasonably believed to have been acquired by an unauthorized person. Provides that notice may be provided to a customer in one of the following ways: (1) written notice; or (2) substitute notice if the person or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Personal Information Protection Act.

Section 5. Definitions. In this Act:

"Breach of the security of the system" means unauthorized acquisition of computerized data that comprises the security, confidentiality, or integrity of personal information maintained by a person, business, or State agency. "Breach of the security of the system" does not include good faith acquisition of personal information by an employee or agent of the person, business, or State agency, provided that the personal information is not used or subject to further unauthorized disclosure.

"Personal information" shall mean any information concerning a natural person which, because of name, number, personal mark, or other identifier can be used to identify the natural person.

"Vulnerable personal information" means personal information consisting of any information in combination with any one or more of the following data elements, when either the personal information or the data element is not encrypted:

(1) Social security number.

(2) Driver's license number.

(3) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account. "Vulnerable personal information" does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

Section 10. Security breach.

(a) Any person, business, or State agency that conducts business in the State and owns or licenses computerized data that includes vulnerable personal information shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of the State whose unencrypted personal information was, or is reasonably believed to have been acquired by an unauthorized person. Disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of the law enforcement agency, as provided in subsection (b), or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

(b) Any person, business, or State agency that maintains computerized data that includes vulnerable personal information that the person, business, or State agency does not own, shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the vulnerable personal information was, or is reasonably believed to have been acquired by an unauthorized person.

(1) Notice may be provided by one of the following methods:

(A) written notice; or

(B) substitute notice, if a person, business, or State agency demonstrates that the cost of the providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the person, business, or State agency does not have sufficient contact information. Substitute notice shall consist of all of the following: (i) email notification if the person, business, or State agency has an email address for the person to be notified; (ii) conspicuous posting of the notice on a web site if the person, business, or State agency maintains a web site page; and (iii) notification to major statewide media outlets.

(2) The notification required under this subsection (b) may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. Notification shall be made after the law enforcement agency determines that it will not compromise its investigation.

Section 15. Violation; person or business.

(a) Any person or business found to have violated this Act, knowingly or recklessly, shall be liable to the aggrieved user for all actual damages sustained by the user as a direct result of the violation, provided that any subscriber that prevails or substantially prevails in any action brought under this subsection (a) shall receive not less than $500,000 in damages, regardless of the amount of actual damage proved, plus costs, disbursements, and reasonable attorney's fees. An action brought under this subsection (a) may be maintained as a class action.

(b) Civil penalties under this Act are recoverable in an action brought by the Attorney General on behalf of the State in the circuit court. A circuit court may issue an injunction to restrain any person or business from violating or continuing to violate any provision of this Act.

(c) If the court determines that a grossly negligent violation of this Act has occurred, the court may impose a civil penalty of not more than $1,000 for the violation.

(d) The rights and remedies available under this Section are cumulative to each other and to any other rights and remedies available under law.