Illinois Data Breach Bill Passes the Senate

Legislation that would dramatically increase the potential liability for marketers in the event of a data breach was approved by the Illinois Senate today.  SB1833, a bill crafted by the Illinois Attorney General, passed by a vote of 35-13.  The bill would add “consumer marketing information” to the definition of personal information under the state’s data breach law.  It would require notification if there is a breach of “information related to a consumer’s online browsing history, online search history, or purchasing history.”  

ANA is working with other industry groups to push for federal data breach legislation that would pre-empt the patchwork of 47 inconsistent state data breach laws.  The Illinois bill is the “poster child” example of why federal legislation is necessary.  At the same time, we are working in the state legislatures to oppose unreasonable changes in current state data breach laws, such as the Illinois bill.  Our letter in opposition to SB1833 is available here.

We need your help to defeat this sweeping, dangerous legislation.  Everyone agrees that consumers should be notified if there is a breach of personal information that creates a risk of identity theft or some other financial harm to consumers.  However, there is no trigger for breach notification in this legislation because of a threat of a specific harm.  The vast preponderance of consumer marketing information does not present such a risk.  

This unprecedented expansion of the scope of the current data breach law could cost Illinois companies multi-millions of dollars each year to protect non-sensitive information that poses no material risk of identity theft or financial harm to residents.  In addition, consumers could eventually succumb to “notice fatigue” if they receive notices about breaches that involve no serious risk of harm to them.

SB1833 now moves to the Illinois House of Representatives, where we believe it may have substantial support.  We strongly urge you to contact members of the House to let them know what an unnecessary cost and burden this bill would place on your company. Contact information for members of the House is available here.  We also urge you to contact Governor Bruce Rauner to express your opposition to this bill.  A veto by the Governor may be the ultimate backstop if this legislation is approved by the House.