SB1899 94TH GENERAL ASSEMBLY

LRB094 11231 RXD 41958 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
SB1899

Introduced 2/25/2005, by Sen. Dan Cronin

SYNOPSIS AS INTRODUCED:

New Act

Creates the Identity Theft Notification Act. Requires any agency, person, or business that conducts business in Illinois and owns or licenses data that includes personal information concerning an Illinois resident to notify the resident that there has been a breach of the security of that data following discovery or notification of the breach. Requires any agency, person, or business that maintains data that includes personal information concerning an Illinois resident and that the agency, person, or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been acquired by an unauthorized person. Provides that notice may be provided in one of the following ways: (1) written notice; (2) electronic notice; or (3) substitute notice if the agency, person, or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the agency, person, or business does not have sufficient contact information.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Identity Theft Notification Act.

Section 5. Definitions. In this Act:

"Breach of the security of the data" means unauthorized acquisition of data that compromises the security and confidentiality of personal information maintained by an agency, person, or business. "Breach of the security of the data" does not include good faith acquisition of personal information by an employee or agent of the agency, person, or business, provided that the personal information is not used for a purpose unrelated to the business of the agency, person, or business or subjected to further unauthorized disclosure.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the data elements are not encrypted or redacted:

(1) Social security number.

(2) Driver's license number or Illinois State Identification Card number.

(3) Account number or credit or debit card number,in combination with any required security code, access code, or password that would permit access to an individual's financial account. "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.

Section 10. Security breach; notification.

(a) Any agency, person, or business that conducts business in Illinois and that owns or licenses data that includes personal information concerning an Illinois resident shall notify the resident that there has been a breach of the security of that data following discovery or notification of the breach. The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of the law enforcement agency, as provided in subsection (d), or any measures necessary to determine the scope of the breach and restore the reasonable security and confidentiality of the data.

(b) Any agency, person, or business that maintains data that includes personal information concerning an Illinois resident and that the agency, person, or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been acquired by an unauthorized person.

(c) Notice may be provided by one of the following methods:

(1) written notice;

(2) electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code; or

(3) substitute notice, if the agency, person, or business demonstrates that the cost of providing notice would exceed $250,000, or the affected class of persons to be notified exceeds 500,000, or the agency, person, or business does not have sufficient contact information. Substitute notice shall consist of all of the following: (i) email notification if the agency, person, or business has an email address for the person to be notified; (ii) conspicuous posting of the notice on the web site page of the agency, person, or business, if the agency, person, or business maintains a web site page; and (iii) notification to major statewide media outlets.

(d) The notification required under this Section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. Notification shall be made after the law enforcement agency determines that it will not compromise its investigation. Notification shall not be required if, as a result of an investigation, the law enforcement agency concludes that personal information was not acquired by an unauthorized person.

(e) Notwithstanding subsection (c) of this Section, any agency, person, or business that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this Section shall be deemed to be in compliance with the notification requirements of this Section if the agency, person, or business notifies the subject persons in accordance with its policies in the event of a breach of security of the data.