IL SB3896

Amends the Personal Information Protection Act to require data collectors that maintain or store (but do not own or license) personal information to notify the Illinois Attorney General when notifying data owners/licensees of a security breach.

Data collectors that own or license personal information must notify affected Illinois residents of breaches in the most expedient time possible without unreasonable delay, including information about consumer reporting agencies and the Federal Trade Commission.

Data collectors that maintain but do not own/license data must notify the owner or licensee immediately upon discovery of a breach if personal information was or likely was acquired by an unauthorized person.

Notification to the Attorney General is required when a single breach affects more than 500 Illinois residents, including description of the breach, number of affected residents, and steps taken or planned to address the incident.

The Act takes effect immediately upon becoming law.