U.S. Illinois Personal Information Protection Act (PIPA)

Why does it matter?

Illinois PIPA turns a data breach into a legal event with a defined audience: affected residents, and above a threshold the Attorney General. It also sets a baseline duty to protect records and a rule for destroying them, so a breach is judged against what the organization did before it happened.

Key benefits include:

• A defined set of data elements

Section 5 lists the combinations that count as personal information, including medical information, health insurance information and unique biometric data, so scope can be inventoried field by field.

• Encryption changes the outcome

Name or data elements that are encrypted or redacted fall outside the definition unless the keys to read them were acquired through the breach (Section 5).

• Security reaches vendors

A contract for the disclosure of personal information must require the recipient to implement and maintain reasonable security measures (Section 45(b)).

• Defined paths to deemed compliance

Compliance with the GLBA Section 501(b) standards, with HIPAA and HITECH (Section 50), with a stricter law (Section 45(c)) or with your own notification procedures (Section 10(d)) is deemed compliance under the sections stated.

• The Attorney General can publish

On receiving notice, the Attorney General may publish the data collector's name, the types of personal information compromised and the date range of the breach (Section 10(e)).

How does it work?

A breach is unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information. Good faith acquisition by an employee or agent for a legitimate purpose is excluded if the information is not misused or further disclosed (Section 5). An owner or licensee notifies each affected Illinois resident at no charge, following discovery or notification of the breach, in the most expedient time possible and without unreasonable delay (Section 10(a)). The Act sets no fixed number of days for private data collectors.

The notice must give the toll-free numbers and addresses of consumer reporting agencies, the Federal Trade Commission's toll-free number, address and website, and a statement that the individual can obtain information about fraud alerts and security freezes. For user name or password breaches, the notice may direct the resident to change credentials. It must not state how many residents were affected. A law enforcement agency's written request can delay notice (Section 10(b-5)). Methods are written, electronic or substitute notice, which is allowed when cost exceeds $250,000, more than 500,000 people are affected or contact details are missing (Section 10(c)).

A data collector that maintains but does not own or license the data notifies the owner or licensee immediately following discovery and cooperates (Section 10(b)). More than 500 Illinois residents in one breach requires notice to the Attorney General no later than the consumer notice (Section 10(e)). State agencies follow Section 12: Attorney General notice above 250 residents within 45 days, nationwide consumer reporting agencies above 1,000 persons, and, for agencies directly responsible to the Governor, notice to the Department of Innovation and Technology's Chief Information Security Officer and the Attorney General within 72 hours.

Key Elements

• Definitions (Section 5)

Data collector, breach of the security of the system data, personal information, medical information and health insurance information, with publicly available government record information excluded.

• Notice to residents (Section 10(a) to (d))

Timing, content, delay for law enforcement, notice methods and substitute notice thresholds.

• Notice to the Attorney General (Section 10(e))

Above 500 residents: nature of the breach, number of residents affected and steps taken, no later than the consumer notice.

• Data security (Section 45)

Reasonable security measures for records held, and a security clause in contracts that disclose personal information.

• Disposal (Section 40)

Materials containing personal information are made unreadable, unusable and undecipherable; a civil penalty of up to $100 per individual and $50,000 per instance applies.

• State agency duties (Sections 12, 25 and 30)

Agency notice rules, reports to the General Assembly within five business days and secure disposal of personal data.

• Deemed compliance (Sections 10(d), 45(c) to (d) and 50)

GLBA, HIPAA and HITECH, stricter laws and own notification procedures, each on the conditions stated.

What does it cover?

The Act applies to data collectors holding personal information about Illinois residents, from corporations and retailers to universities, financial institutions and government agencies (Section 5). The breach and notice provisions cover computerized data; the disposal rule covers any materials containing personal information and applies to any “person” (Section 40). Financial institutions under 15 U.S.C. 6801 et seq. are exempt from the disposal section (Section 40(f)). Covered entities and business associates in compliance with Section 50 are outside the Attorney General notice rule of Section 10(e).

What are its objectives?

The Act has no statement of purpose. Its provisions pursue these outcomes:

Residents learn of a breach promptly and receive the information they need about fraud alerts, security freezes and credential changes (Sections 10(a) and 12(a)).

Records holding personal information are protected by reasonable security measures, including at vendors that receive the data (Section 45).

The Attorney General is informed of breaches above 500 residents, and above 250 for State agencies (Sections 10(e) and 12(e)).

Personal information is destroyed so it cannot practicably be read or reconstructed (Section 40(b)).

State agencies report breaches, and their corrective measures, to the General Assembly (Section 25).

Framework in Context

The Act is codified in Chapter 815, Business Transactions, of the Illinois Compiled Statutes. It points to federal law in several places: 15 U.S.C. 7001 for electronic notice, 15 U.S.C. 1681a(p) for nationwide consumer reporting agencies, 15 U.S.C. 6801 et seq. for GLBA, and HIPAA and HITECH for health information. Section 20 ties a violation to the Consumer Fraud and Deceptive Business Practices Act, and Section 40 gives the Attorney General the disposal penalty and court actions. The statute does not define “reasonable security measures”, so organizations choose and document the safeguards they can defend.

Common Framework Mappings

Illinois PIPA is mapped to the frameworks below. Sections 45(d) and 50 deem compliance with the data security rule for entities that meet the GLBA Section 501(b) standards or HIPAA and HITECH, so those mappings are direct. Mappings to ISO/IEC 27001, NIST CSF, NIST SP 800-53 and CIS Critical Security Controls help evidence the reasonable security measures of Section 45(a).

Mapped frameworks include:

California Consumer Privacy Act (CCPA)

CIS Critical Security Controls

General Data Protection Regulation (GDPR)

Gramm-Leach-Bliley Act (GLBA)

HIPAA Security Rule

ISO/IEC 27001

NIST Cybersecurity Framework

NIST SP 800-53

PCI DSS