Illinois Data Breach Bill Presents a Serious Danger for Advertisers

Legislators in Illinois are currently considering a bill that would drastically increase advertisers’ liability in the event of a data breach. SB 1833, a bill crafted by the Illinois Attorney General’s office, would greatly expand security breach notice obligations in Illinois far beyond notice obligations in any other state and would include breaches of strictly marketing data as well as many other categories. The bill is still under active consideration in the Illinois Senate.

The bill would be a dramatic departure in U.S. state security breach notice requirements, which over their 10-year history have focused primarily on breaches of information that create a risk of identity theft or fraud to individuals. Generally, notice is required for breaches of name plus: government ID number, financial account number, biometric authentication information, health insurance number or medical information (because of risk of medical ID theft), or user name and password for an online account that can be used to impersonate an individual. SB 1833 would go far beyond these requirements. It would mandate notice for marketing information, geolocation information, and name plus any two of: (1) phone number, email or physical address; (2) mother’s maiden name (which is part of virtually every Hispanic surname); or (3) date of birth.  

Furthermore, the bill as it stands does not include a risk of harm trigger. This means that even information that is already publicly available or that creates no risk to state residents whose information has been breached would be cause for notification.  

This bill is of particular importance to ANA’s Illinois members or those doing substantial business in Illinois because of the inclusion of consumer marketing information, which is an unprecedented break from other state laws throughout the country. However, this proposal could impact virtually all advertisers as passage of such a proposal could clearly create a very dangerous precedent that other states might try to emulate. A breach of data could end up costing your companies hundreds of millions of dollars under this new law. ANA is working to defeat this piece of legislation and to protect advertisers as they increasingly become the targets of state data breach bills throughout the country.