Illinois Enacts Sweeping Changes To The Illinois Personal Information Protection Act

On May 6, 2016, Illinois joined a growing number of states that have strengthened their data breach notification requirements and expanded the definition of protected personal information. Effective January 1, 2017, HB1260 amends the Illinois Personal Information Protection Act (PIPA) to broaden the definition of protected personal information, which will now include an individual's first name or first initial and last name in combination with medical information, health insurance information, or unique biometric data (such as "a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data"). Additionally, Illinois will join several other states in defining personal information to include a user name or email address (with a password or a security question and answer that would permit access to an online account). Under the current law, personal information is limited to an individual's first name or first