Illinois Data Breach Notification Law

Notification deadline: Most expedient time possible, without unreasonable delay

Enforcement: Illinois Attorney General

Overview

Illinois requires businesses to notify affected residents "in the most expedient time possible" and report to the Attorney General when more than 500 Illinois residents are affected. Illinois also has the nation's strictest biometric privacy law (BIPA).

Who Must Be Notified

• • Affected Illinois residents
• • Illinois Attorney General (if 500+ residents affected)

Covered Data Types

Social Security number, Driver's license or state ID number, Financial account number with access code, Medical information, Health insurance information, Unique biometric data (fingerprints, retina scans, etc.)

Notification Requirements

• • Written or electronic notice in most expedient time possible
• • Include description of breach and types of information involved
• • Steps being taken to protect from further breach
• • Contact information and credit reporting agency info
• • File AG notice if 500+ Illinois residents affected

Exemptions

• • Encrypted data (if key not compromised)
• • Publicly available information
• • Entities compliant with HIPAA, GLBA (notification still required)

Penalties

AG can seek civil penalties, injunctions, and attorney fees. BIPA violations: $1,000 per negligent violation, $5,000 per intentional violation. Private right of action under BIPA.