Data Breach Bill in Illinois Threatens to Set a Dangerous Precedent

April 23, 2015

Yesterday, a very troubling data breach bill was passed out of the Illinois State Senate and advanced to the House chamber. The bill, SB 1833, is especially bad for advertisers as it would greatly expand security breach notice obligations in Illinois far beyond notice obligations in any other state and would include breaches of strictly marketing data as well as many other categories, including geolocation data. Furthermore, the bill contains no risk of harm trigger. This means that even information that is already publicly available or that creates no risk to state residents whose information has been breached would be cause for notification. ANA has already sent an opposition letter to the Illinois Senate and will also be sending one to House members. We strongly encourage advertisers with a presence in Illinois to contact the Illinois legislature to let them know what an unnecessary burden this bill creates.

Bills like SB 1833 are becoming more prevalent in state legislatures as the states attempt to create their own powerful privacy regimes in the absence of federal legislation. Currently, the patchwork of 47 (with Alabama slated to institute the 48th) different state laws regarding data security and data breach have created a very difficult, inconsistent, and constantly shifting regulatory environment for businesses throughout the country.

As advertisers, we must work hard to ensure bills such as SB 1833 do not become law, instituting requirements that are overbroad and unnecessarily burdensome for companies. If SB 1833 does become law, it will set a dangerous precedent for other states around the country. Ideas that appear in one state very quickly spread to the others, meaning that one bad bill could be multiplied substantially in just a few years.  

The extraordinarily overbroad Illinois breach proposal is one more poster-child for why ANA is strongly urging Congress to pass a federal data breach law that preempts the expanding patchwork of state breach laws. Without federal preemption, we will continue to need to fight attempts to put in place unreasonable standards. Until federal preemption is put into place, advertisers will continue to fall victim to attacks seriously burdening companies while not providing reasonable protection for consumers.

You must be logged in to submit a comment.