Bill Amendment: IL SB1833 | 2015-2016 | 99th General Assembly

NOTE: For additional amemendments please see the Bill Drafting List

---

Bill Title: PERSONAL INFO PROTECTION

Status: 2015-09-24 - Bill Dead - Amendatory Veto [SB1833 Detail]

Download: Illinois-2015-SB1833-House_Amendment_001.html

---

Rep. Ann Williams

Filed: 5/11/2015

09900SB1833ham001 LRB099 09064 JLS 35392 a
AMENDMENT TO SENATE BILL 1833
AMENDMENT NO. ______. Amend Senate Bill 1833 on page 1 by
replacing line 5 with the following:
"amended by changing Sections 5, 10, and 12 and adding Sections
45,"; and
on page 1, line 6, by changing "and 50" to "50, and 55"; and
on page 2, line 4, by changing "history." to "history,
including, but not limited to, consumer profiles that are based
upon the information. "Consumer marketing information" does
not include information related to a consumer's online browsing
history, online search history, or purchasing history held by a
data collector that has a direct relationship with the
consumer."; and
on page 2, line 7, by changing "is" to "is stored and"; and

09900SB1833ham001 - 2 - LRB099 09064 JLS 35392 a
on page 2, line 8, by changing "the device" to "an individual";
and
on page 3, line 14, by changing "data" to "data generated from
measurements or analysis of human body characteristics that
could be used to identify an individual"; and
on page 3, line 23, by changing "name" to "name, when not part
of an individual's surname"; and
on page 5, line 2, by changing "information"" to "information",
excluding geolocation information and consumer marketing
information"; and
on page 8, line 4, by changing "that" to "that owns or licenses
personal information and"; and
on page 8, line 9, by changing "A description of the" to "The
types of"; and
on page 8, line 20, by changing "2 days before" to "when"; and
on page 9, line 12, by changing "A description of the" to "The
types of"; and
on page 10 by replacing lines 10 through 18 with the following:

09900SB1833ham001 - 3 - LRB099 09064 JLS 35392 a
"(f) Upon receiving notification from a data collector of a
breach of personal information, the Attorney General may
publish the name of the data collector that suffered the
breach, the types of personal information compromised in the
breach, and the date range of the breach."; and
on page 10 by inserting immediately below line 19 the
following:
"(815 ILCS 530/12)
Sec. 12. Notice of breach; State agency.
(a) Any State agency that collects personal information,
excluding geolocation and consumer marketing information,
concerning an Illinois resident shall notify the resident at no
charge that there has been a breach of the security of the
system data or written material following discovery or
notification of the breach. The disclosure notification shall
be made in the most expedient time possible and without
unreasonable delay, consistent with any measures necessary to
determine the scope of the breach and restore the reasonable
integrity, security, and confidentiality of the data system.
The disclosure notification to an Illinois resident shall
include, but need not be limited to information as follows:
(1) With respect to personal information defined in
Section 5 in paragraph (1) of the definition of "personal
information": ,

09900SB1833ham001 - 4 - LRB099 09064 JLS 35392 a
(i) the toll-free numbers and addresses for
consumer reporting agencies; ,
(ii) the toll-free number, address, and website
address for the Federal Trade Commission; , and
(iii) a statement that the individual can obtain
information from these sources about fraud alerts and
security freezes.
(2) With respect to personal information as defined in
Section 5 in paragraph (2) of the definition of "personal
information", notice may be provided in electronic or other
form directing the Illinois resident whose personal
information has been breached to promptly change his or her
user name or password and security question or answer, as
applicable, or to take other steps appropriate to protect
all online accounts for which the resident uses the same
user name or email address and password or security
question and answer.
The notification shall not, however, include information
concerning the number of Illinois residents affected by the
breach.
(a-5) The notification to an Illinois resident required by
subsection (a) of this Section may be delayed if an appropriate
law enforcement agency determines that notification will
interfere with a criminal investigation and provides the State
agency with a written request for the delay. However, the State
agency must notify the Illinois resident as soon as

09900SB1833ham001 - 5 - LRB099 09064 JLS 35392 a
notification will no longer interfere with the investigation.
(b) For purposes of this Section, notice to residents may
be provided by one of the following methods:
(1) written notice;
(2) electronic notice, if the notice provided is
consistent with the provisions regarding electronic
records and signatures for notices legally required to be
in writing as set forth in Section 7001 of Title 15 of the
United States Code; or
(3) substitute notice, if the State agency
demonstrates that the cost of providing notice would exceed
$250,000 or that the affected class of subject persons to
be notified exceeds 500,000, or the State agency does not
have sufficient contact information. Substitute notice
shall consist of all of the following: (i) email notice if
the State agency has an email address for the subject
persons; (ii) conspicuous posting of the notice on the
State agency's web site page if the State agency maintains
one; and (iii) notification to major statewide media.
(c) Notwithstanding subsection (b), a State agency that
maintains its own notification procedures as part of an
information security policy for the treatment of personal
information and is otherwise consistent with the timing
requirements of this Act shall be deemed in compliance with the
notification requirements of this Section if the State agency
notifies subject persons in accordance with its policies in the

09900SB1833ham001 - 6 - LRB099 09064 JLS 35392 a
event of a breach of the security of the system data or written
material.
(d) If a State agency is required to notify more than 1,000
persons of a breach of security pursuant to this Section, the
State agency shall also notify, without unreasonable delay, all
consumer reporting agencies that compile and maintain files on
consumers on a nationwide basis, as defined by 15 U.S.C.
Section 1681a(p), of the timing, distribution, and content of
the notices. Nothing in this subsection (d) shall be construed
to require the State agency to provide to the consumer
reporting agency the names or other personal identifying
information of breach notice recipients.
(e) Notice to Attorney General.
(1) Any State agency that suffers a single breach of
the security of the data concerning the personal
information of more than 250 Illinois residents shall
provide notice to the Attorney General of the breach,
including:
(A) The categories of personal information
compromised in the breach.
(B) The number of Illinois residents affected by
such incident at the time of notification.
(C) Any steps the State agency has taken or plans
to take relating to notification of the breach to
consumers.
(D) The date and timeframe of the breach, if known

09900SB1833ham001 - 7 - LRB099 09064 JLS 35392 a
at the time notification is provided.
Such notification must be made within 30 business days
of the State agency's discovery of the security breach or
when the State agency provides any notice to consumers
required by this Section, whichever is sooner, unless the
State agency has good cause for reasonable delay to
determine the scope of the breach and restore the
integrity, security, and confidentiality of the data
system, or when law enforcement requests in writing to
withhold disclosure of some or all of the information
required in the notification under this Section. If the
date or timeframe of the breach is unknown at the time the
notice is sent to the Attorney General, the State agency
shall send the Attorney General the date or timeframe of
the breach as soon as possible.
(Source: P.A. 97-483, eff. 1-1-12.)"; and
on page 11 by deleting lines 17 through 22; and
on page 11, line 23, by changing "(e)" to "(d)"; and
on page 13, line 23, by replacing "online service" with ", in
the case of an operator of an online service, make the policy
available in accordance with paragraph (5) of subsection (a) of
this Section"; and

09900SB1833ham001 - 8 - LRB099 09064 JLS 35392 a
on page 15 by inserting immediately below line 10 the
following:
"(815 ILCS 530/55 new)
Sec. 55. Entities subject to the federal Health Insurance
Portability and Accountability Act of 1996. Any covered entity
or business associate that is subject to and in compliance with
the privacy and security standards for the protection of
electronic health information established pursuant to the
federal Health Insurance Portability and Accountability Act of
1996 and the Health Information Technology for Economic and
Clinical Health Act shall be deemed to be in compliance with
the provisions of this Act, provided that any covered entity or
business associate required to provide notification of a breach
to the Secretary of Health and Human Services pursuant to the
Health Information Technology for Economic and Clinical Health
Act also provides such notification to the Attorney General
within 5 business days of notifying the Secretary.".