IL SB3007

Data collectors must notify the Illinois Attorney General if a single breach affects more than 100 Illinois residents, including a description of the breach, number of affected residents, and remedial steps taken within 14 business days of discovery.

Data collectors that maintain but do not own personal information must notify the Attorney General of breaches affecting more than 100 residents, providing the same information within 14 business days of discovery or when notifying the data owner, whichever is sooner.

The Attorney General must report annually to the General Assembly by February 1 on breach statistics including total affected residents, number of breaches over 100 residents, total records breached, median and mean breach sizes, types of data compromised, breach methods, affected industries, and non-compliance with notice requirements.

Existing notification requirements to Illinois residents remain unchanged, including timing (expedient time without unreasonable delay), content requirements, and permitted notification methods (written, electronic, or substitute notice).