LexLint.ioBeta

Know the law your code answers to.

Law / United States / Illinois

Personal Information Protection Act, safe disposal of personal information

815 ILCS 530/40 (P.A. 97-483, eff. )

In force since .

A security baseline statutes rule binding public and private bodies.

Obligation class
Security, Retention

What it requires

  • This binds any person, including a natural person, a corporation, another legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident, except a financial institution regulated under Gramm-Leach-Bliley Act Title V or a person subject to the disposal rule at 15 U.S.C. 1681w.
  • Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.NIST CSF 2.0ID.AM-08
  • Where a third party is contracted to dispose of the materials, require it to implement and monitor policies and procedures that prohibit unauthorized access to, acquisition of, or use of personal information during collection, transportation, and disposal.NIST CSF 2.0GV.SC-05
  • A violation carries a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard; Section 20 separately deems a violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening the Attorney General's and a private plaintiff's remedies under 815 ILCS 505/7 and 505/10a as well.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • CT.DM-P5Data are destroyed according to policy.
NIST CSF 2.0
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
CIS Controls
  • 3.5Destroying data in a way that fits its sensitivity and storage type.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 3.2Monitoring and logging
  • 4.2Backup and redundancy management
  • 12.2Handling of assets

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

815 ILCS 530/40(d): a civil penalty of not more than $100 for each individual with respect to whom personal information is disposed of in violation of this Section, not to exceed $50,000 for each instance of improper disposal, imposed by the Attorney General after notice and an opportunity to be heard. Section 20 separately deems any violation of this Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening that Act's own civil penalty of up to $50,000 under 815 ILCS 505/7(b) as an additional route.

Rule
Per violation only
As of
Currency
USD
Fixed cap
50,000
Per violation unit
Person
Per violation amount
100

Who enforces it

Enforcement body

815 ILCS 530/40(d) gives the Attorney General authority to impose a civil penalty directly, after notice and an opportunity to be heard, and subsection (e) lets the Attorney General bring a circuit court action for any appropriate relief. Section 20 separately deems a violation of this Act, including this Section, an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, opening that Act's own Attorney General and private-action remedies as well.

Settledness

As of
Open questions
  • What counts as an 'instance of improper disposal' for the $50,000 ceiling in 815 ILCS 530/40(d) when the records of many individuals are discarded together or over several days?
  • Does the 'unreadable, unusable, and undecipherable' standard in 815 ILCS 530/40(b) require anything beyond the methods listed in 815 ILCS 530/40(b)(1) and (2), which the subsection introduces as methods that 'include, but are not limited to' those listed?
  • Does a person that contracts with a third party under 815 ILCS 530/40(c) remain liable under 815 ILCS 530/40(d) when the third party's disposal fails?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Any person, defined to include a natural person, a corporation or other legal entity, a unit of local government, or the State of Illinois or one of its agencies, that disposes of materials containing personal information about an Illinois resident must do so in a manner that renders the personal information unreadable, unusable, and undecipherable, such as by redacting, burning, pulverizing, or shredding paper records, or destroying or erasing electronic media.

A third party contracted to dispose of such materials must implement and monitor policies and procedures against unauthorized access, acquisition, or use of personal information during collection, transport, and disposal. A financial institution regulated under Gramm-Leach-Bliley Act Title V, or a person subject to the disposal rule at 15 U.S.C. section 1681w, is exempt.

The Attorney General may impose a civil penalty of up to $100 per individual whose information was improperly disposed of, capped at $50,000 per instance of improper disposal, after notice and an opportunity to be heard, and may separately bring a circuit court action for any appropriate relief; Section 20 also deems a violation of this Section an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .