Law / United States / 
Illinois
Personal Information Protection Act, data security duty
815 ILCS 530/45 (P.A. 99-503, eff. )
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds any data collector, including a government agency, a public or private university, or a privately or publicly held corporation, that owns, licenses, maintains, or stores records containing personal information about an Illinois resident.
- Implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.NIST CSF 2.0PR.DS-01
- Require, by contract, that any party to whom personal information is disclosed also implement and maintain reasonable security measures over it.NIST CSF 2.0GV.SC-05
- A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law that requires greater protection, is deemed to comply with this duty.
- There is no dedicated penalty for this section; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to a private action for actual damages and attorneys' fees under 815 ILCS 505/10a and to an Attorney General action for injunctive relief and a civil penalty of up to $50,000, or up to $50,000 per violation where the court finds intent to defraud, under 815 ILCS 505/7.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
815 ILCS 530/45 states no penalty of its own; a violation is deemed an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act by 815 ILCS 530/20. Under 815 ILCS 505/7(b), the Attorney General or a State's Attorney may request a civil penalty of up to $50,000; where the court finds the conduct was entered into with intent to defraud, the ceiling is up to $50,000 per violation, which is the highest stated tier and the one coded. Section 505/7(c) adds a civil penalty of up to $10,000 for each violation committed against a person 65 years of age or older.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
815 ILCS 530/45 names no enforcement mechanism of its own. Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, so the Attorney General or a State's Attorney may seek injunctive relief and a civil penalty under 815 ILCS 505/7, and any person who suffers actual damage may bring a private action for damages under 815 ILCS 505/10a.
Settledness
- As of
- Open questions
- What security measures count as 'reasonable security measures' under 815 ILCS 530/45(a), a term the definitions in 815 ILCS 530/5 do not define?
- How is 'greater protection' measured under 815 ILCS 530/45(c) when another state or federal law protects only some of the records, or only some of the risks, that 815 ILCS 530/45(a) lists?
What this law does
A data collector, defined to include a government agency, a public or private university, and a privately or publicly held corporation, that owns or licenses, or maintains or stores without owning or licensing, records containing personal information about an Illinois resident must implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
It must require by contract that any party to whom it discloses that information do the same. A data collector already subject to and compliant with Gramm-Leach-Bliley Act Title V standards, or with a state or federal law requiring greater protection, is deemed to comply.
The duty carries no penalty of its own; Section 20 deems a violation of the Act an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act, exposing a violator to the Attorney General's injunctive and civil-penalty authority and to a private action for actual damages.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .