IL HB3412

Amends the Personal Information Protection Act to require data collectors to notify the Illinois Attorney General in addition to affected residents when a security breach occurs.

Establishes a notification deadline of no later than 5 days after discovery of a breach, replacing the previous "without unreasonable delay" standard.

Requires data collectors that maintain but do not own personal information to notify the Attorney General and data owner immediately following discovery of a breach.

Mandates that data collectors notifying more than 500 Illinois residents of a breach must provide the Attorney General with a description of the breach, the number of affected residents, and steps taken to address the incident.

Authorizes the Attorney General to publicly publish the name of the breached data collector, types of compromised personal information, and the date range of the breach.