What does Illinois's data breach law ask a business to do?

Who does this law apply to?

The law says a data collector that owns or licenses personal information about an Illinois resident must notify that resident, at no charge, after it finds or is told of a breach. A data collector is any entity that handles or deals with nonpublic personal information, including corporations, universities, government agencies and retailers.

Any data collector that owns or licenses personal information concerning an Illinois resident shall notify the resident at no charge that there has been a breach of the security of the system data following discovery or notification of the breach.

"Data collector" may include, but is not limited to, government agencies, public and private universities, privately and publicly held corporations, financial institutions, retail operators, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information.

What counts as personal information?

Personal information is a first name or first initial and last name together with items such as a Social Security number, a driver's licence or state identification card number, a financial account or card number, medical information, health insurance information or biometric data. It also covers a user name or email address with the password or security question and answer that opens an online account.

Encrypted or redacted data is outside the definition unless the keys to read it were also taken in the breach.

An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted or are encrypted or redacted but the keys to unencrypt or unredact or otherwise read the name or data elements have been acquired without authorization through the breach of security:

User name or email address, in combination with a password or security question and answer that would permit access to an online account,

How fast must people be told?

The text sets no number of days. Notice must be made in the most expedient time possible and without unreasonable delay, allowing for the time needed to find the scope of the breach and restore the system.

The disclosure notification shall be made in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system.

Who else must be told?

A data collector that must notify more than 500 Illinois residents about a single breach must also notify the Attorney General. That notice is due no later than the notice to the residents themselves.

Any data collector required to issue notice pursuant to this Section to more than 500 Illinois residents as a result of a single breach of the security system shall provide notice to the Attorney General of the breach, including:

Such notification must be made in the most expedient time possible and without unreasonable delay but in no event later than when the data collector provides notice to consumers pursuant to this Section.

What if a vendor holds the data?

A data collector that keeps personal information it does not own or license must tell the owner or licensee immediately after finding a breach, and must cooperate with them.

Any data collector that maintains or stores, but does not own or license, computerized data that includes personal information that the data collector does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.