IL SB1624

Amends the Personal Information Protection Act to require data collectors that experience a breach affecting more than 500 Illinois residents to notify the Attorney General in addition to affected residents.

Attorney General notification must include the nature of the breach, number of affected Illinois residents, and steps taken or planned to address the incident, provided in the most expedient time possible and no later than when consumer notice is given.

Attorney General may publicly disclose the name of the data collector, types of personal information compromised, and date range of the breach upon receiving breach notification.

Exempts covered entities and business associates in compliance with Section 50 (healthcare entities under HIPAA) from the Attorney General notification requirement.