New legislation requires companies to alert Illinoisans to personal and financial information breaches         

[MAY 17, 2005]  CHICAGO -- Gov. Rod Blagojevich and Attorney General Lisa Madigan applauded the General Assembly on Monday for passing the Personal Information Protection Act, which requires all companies and organizations, regardless of where they are based, to notify Illinois residents in the event of a security breach. House Bill 1633, sponsored in the House by Rep. John Fritchey, D-Chicago, and in the Senate by Sen. Ira Silverstein, D-Chicago, now moves to the governor's desk for approval.

"When a consumer's personal information falls into the wrong hands, it can lead to devastating outcomes," Gov. Blagojevich said. "This legislation will help prevent thieves from gaining access to personal information and will help consumers react quickly to protect their credit when identity thieves succeed. I applaud the General Assembly for passing this legislation, so that Illinoisans are no longer left in the dark when their personal information is at risk."

"Too often these days, it seems that security breaches of personal information are the rule rather than the exception," Attorney General Madigan said. "Consumers need the power to fight back. The most effective way to prevent the destructive effects of identity theft is to act quickly to regain control of your personal and financial information, but this can be accomplished only if the consumer is quickly notified when the security of this information has been compromised. This legislation is a clear victory for consumers."

The governor proposed the legislation days after public disclosure of a massive security failure in October involving Georgia-based ChoicePoint, which resulted in the theft of personal information, including Social Security numbers, of approximately 145,000 people in all 50 states -- including roughly 5,000 in Illinois.

The Personal Information Protection Act requires that any entity that collects and maintains personal consumer information must notify all affected Illinois customers in the event of a security breach. Personal information is defined as a Social Security number, a driver's license number, bank or credit card number, and PIN codes in combination an individual's first name or first initial and last name.

The bill requires that notifications be made without unreasonable delay. The provisions of the Personal Information Protection Act would be enforced by the Office of the Attorney General through the Illinois Consumer Fraud Act. Current Illinois law does not require companies to notify consumers when their private information may have been hacked into or exposed to unauthorized sources.

"Once signed into law by Gov. Blagojevich, this legislation will ensure that consumers get the information they need to help prevent them from becoming victims of identity theft," Rep. Fritchey said.

The stronger requirement will provide dual benefits: making sure that those whose personal information has been stolen are quickly notified, and motivating organizations to improve their security systems to better protect personal information.

"This legislation ensures that consumers are not kept in the dark if someone has possible access to their personal and financial information," Sen. Silverstein said. "Taking immediate action in the case of a security breach is critical in protecting consumers' identities."

"By forcing companies to take identity theft seriously, they will have to increase protections and notify consumers immediately," said John Gaudette, consumer advocate at the Illinois Public Interest Research Group.

The number of reported identity theft cases in Illinois rose 49 percent in the past year, from 7,474 reported identity theft victims in 2003 to 11,138 reported victims in 2004. A 2004 FBI cybercrime study found that only 20 percent of companies report computer hackings to the police and half do not report them to anyone. Identity theft and consumer fraud are rapidly growing problems, costing Americans nearly $550 million last year, up from $430 million in 2003, according to the Federal Trade Commission. The FTC received 635,000 consumer complaints in 2004 about identity theft and consumer fraud.

After the ChoicePoint breach in late February, the company initially notified only residents of California who might have been affected, because of a California state law requiring the company to do so. However, in response to a letter initiated by Madigan and signed by 38 other state attorneys general, ChoicePoint agreed to notify more than 140,000 consumers nationwide whose personal and financial information might have been compromised, including those in Illinois.

In addition to the legislation, the governor and the attorney general reminded consumers of practical steps they can take to protect their personal information from thieves:

1. Never provide any personal information in response to an unsolicited request.
2. Review your account statements regularly to ensure that your transactions are in order.
3. Check your credit report to make sure no new credit accounts have been opened in your name.
4. Do not use information that can be used to steal your identity (birthdays, names, Social Security numbers, account numbers) as passwords or account numbers.
5. Limit the amount of personal information you divulge over the phone or to websites.

[News release from the governor's office]