SB1833sam001 99TH GENERAL ASSEMBLY

Sen. Daniel Biss

Filed: 4/10/2015

09900SB1833sam001 LRB099 09064 JLS 33138 a

AMENDMENT TO SENATE BILL 1833

AMENDMENT NO. ______. Amend Senate Bill 1833 on page 3, line 2, by changing "obtained" to "acquired without authorization"; and

on page 4, line 14, by changing "information" to "information, excluding geolocation information and consumer marketing information,"; and

on page 4 by replacing lines 23 through 25 with the following:

"not be limited to, information as follows:

(1) With respect to personal information as defined in Section 5 in paragraph (1) of the definition of "personal information":

(A) (i) the toll-free numbers and addresses for consumer reporting agencies; ,

(B) (ii) the toll-free number, address, and website address for the Federal Trade Commission; , and

(C) (iii) a statement that the individual can obtain information from these sources about fraud alerts and security freezes.

The notification shall not, however, include information concerning the number of Illinois residents affected by the breach.

(2) With respect to personal information defined in Section 5 in paragraph (2) of the definition of "personal information", notice may be provided in electronic or other form directing the Illinois resident whose personal information has been breached to promptly change his or her username or password and security question or answer, as applicable, or to take other steps appropriate to protect all online accounts for which the resident uses the same user name or email address and password or security question and answer."; and

on page 5 by deleting lines 1 through 5; and

on page 7 by replacing lines 13 through 16 with the following:

"(1) Any data collector that suffers a breach of the security of the data concerning the personal information of more than 250 Illinois residents shall provide notice to the Attorney General of the"; and

on page 7, line 24, by replacing "14" with "30"; and

on page 8 by replacing lines 8 through 10 with the following: "personal information that suffers a breach of the security of the data concerning the personal information of more than 250 Illinois residents shall notify the Attorney"; and

on page 8, line 21, by changing "14" to "30"; and

on page 9 by inserting immediately below line 2 the following:

"(f) A data collector that suffers a breach subject to the breach notification standards established pursuant to the federal Health Information Technology Act, 42 U.S.C. Section 17932, shall be deemed to be in compliance with the provisions of this Section if that data collector does the following: (1) provides notification to individuals in compliance with the federal Health Information Technology Act and implementing regulations and (2) provides notification to the Attorney General pursuant to subsection (e)."; and

on page 9 by inserting immediately below line 25 the following:

"(d) A data collector that is subject to and in compliance with the security standards for the protection of electronic health information, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996 shall be deemed to be in compliance with the provisions of this Section.

(e) A data collector that is subject to and in compliance with the standards established pursuant to Section 501(b) of the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. Section 6801, shall be deemed to be in compliance with the provisions of this Section.".