Illinois. Breach notification. Act
IL breach lawIllinois data breach notification law (815 ILCS 530 (Personal Information Protection Act))
Partly verified
Medium confidence.Penalty figure from the general Consumer Fraud Act; not stated on summary page.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Illinois residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account with codes, medical and health insurance data, biometric data; online credentials.
- Key themes
- Unique features
No risk-of-harm exception; violations are Consumer Fraud Act violations; separate BIPA governs biometric privacy.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Illinois requires the maintaining entity to notify the owner immediately after discovery and cooperate. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; AG if >500 residents, no later than individual notice
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Consumer Fraud Act civil penalties up to $50,000 per violation (more if intent to defraud)
§3Dates
- Key dates
- Adopted
- In force
- SB 1624 (eff. 2020-01-01) added AG notice over 500 residents; HB 1260 (eff. 2017-01-01) added medical, biometric and credentials
§4Text and authority
- Text
- Authoritative text ilga.gov
- Authority
- Illinois Attorney General
§5Where it applies
- Domestic law of
- Illinois
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figure from the general Consumer Fraud Act; not stated on summary page.