IL HB3200

Amends the Personal Information Protection Act to require data collectors to notify the Illinois Attorney General in addition to affected Illinois residents of security breaches.

Establishes a strict 5-day deadline for breach notification, replacing the previous "expedient time possible" standard and removing language that allowed delays for investigation purposes.

Requires notification to include toll-free numbers and addresses for consumer reporting agencies and the Federal Trade Commission, along with information about fraud alerts and security freezes.

Allows data collectors maintaining their own notification procedures as part of an information security policy to comply if consistent with the 5-day timing requirement.

Permits delayed notification only if a law enforcement agency provides written notice that notification would interfere with a criminal investigation, requiring notification as soon as the interference ends.