ILCS » Chapter 815 · Act 530
Illinois Compiled Statutes

815 ILCS 530/45 (2026)

Data security

✓ current as of May 2026
Find cases: SyfertCases citing this section IL-ILGAilga.gov JustiaChapter on Justia CornellLII Search CasesGoogle Scholar
(815 ILCS 530/45)
    Sec. 45. Data security.
    (a) A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
    (b) A contract for the disclosure of personal information concerning an Illinois resident that is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
    (c) If a state or federal law requires a data collector to provide greater protection to records that contain personal information concerning an Illinois resident that are maintained by the data collector and the data collector is in compliance with the provisions of that state or federal law, the data collector shall be deemed to be in compliance with the provisions of this Section.
    (d) A data collector that is subject to and in compliance with the standards established pursuant to Section 501(b) of the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. Section 6801, shall be deemed to be in compliance with the provisions of this Section.
(Source: P.A. 99-503, eff. 1-1-17.)

    
Notes of Decisions
Cited in 14 cases (13 in the last 5 years), 2019–2026 · leading case: Flores v. Aon Corp., 2023 IL App (1st) 230140 (Ill. App. Ct. 2023).
Sort: Relevance Newest Treatment
Flores v. Aon Corp., 2023 IL App (1st) 230140 (Ill. App. Ct. 2023). “1, 2017) (adding 815 ILCS 530/45). Given that the legislature has now created a duty to maintain reasonable security measures under the Information Protection Act, the reasoning of the Cooney court no longer applies.”
Petta v. Christie Bus. Holding Co., 2023 IL App (5th) 220742 (Ill. App. Ct. 2023). “The circuit court dismissed Petta’s negligence claims and claim for violation of the Personal Information Protection Act (815 ILCS 530/45(a) (West 2022)) for failure to state a claim.”
Roper v. Rise Interactive Media & Analytics, LLC (N.D. Ill. 2023). · cites it 2× “” 815 ILCS 530/45; [Dkt. 21 at 5.] Plaintiffs argue that the creation of this duty is consistent with Cooney because Cooney only rejected broadening the common-law duty beyond what was statutorily prescribed.”
Archey v. Osmose Utils. Servs., Inc. (N.D. Ill. 2021). “” 815 ILCS 530/45(a). It also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay.”
Archey v. Osmose Utils. Servs., Inc. (N.D. Ill. 2022). “” 815 ILCS 530/45(a). PIPA also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay.”
Wittmeyer v. Heartland All. for Human Needs & Human Rights (N.D. Ill. 2024). “2022) (citing 815 ILCS 530/45(a)). Indeed, the Illinois Appellate Court recently explained that, given this amendment to PIPA, “the reasoning of the Cooney court no longer applies.”
D. v. Aspen Dental Mgmt., Inc. (N.D. Ill. 2024). “, entities that handle, collect, disseminate, or otherwise deal with nonpublic personal information, to protect this information from “unauthorized access, acquisition, destruction, use, modification, or disclosure.”
Fox, Yvonne v. Iowa Health Sys. (W.D. Wis. 2019). “The court will assume, without deciding, that the Iowa statute works the same way as the Illinois statute, and that a violation of § 715C.2 can give rise to a claim under § 714H.”
Stein v. Edward Elmhurst Health (N.D. Ill. 2025). “See Smith, 2024 WL 3338941 , at *7 (collecting cases); see also 815 ILCS 530/45(a) (“A data collector that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident shall implement and maintain…”
Nguyen v. Abbott Labs., Inc. (N.D. Ill. 2025). “¶¶ 307–314 (citing 815 ILCS 530/45(a)). Plaintiff Ortega alleges a violation of the California Invasion of Privacy Act.”
Padma Rao v. J.P. Morgan Chase Bank, N.A. (7th Cir. 2025). “815 ILCS 530/45(a) (emphasis added). Personal information can include an individual’s name, unredacted and unen- crypted, in combination with their social security number, driver’s license, financial account number, among other iden- tifying information.”
Gittings-Barrera v. Mem'l Hosp. Ass'n (C.D. Ill. 2025). “” 815 ILCS 530/45; see Flores, 242 N.E.3d at 354 .”
Show all 14 citing cases →
— 815 ILCS 530/45(a) — 11 cases
Petta v. Christie Bus. Holding Co., 2023 IL App (5th) 220742 (Ill. App. Ct. 2023). “The circuit court dismissed Petta’s negligence claims and claim for violation of the Personal Information Protection Act (815 ILCS 530/45(a) (West 2022)) for failure to state a claim.”
Archey v. Osmose Utils. Servs., Inc. (N.D. Ill. 2021). “” 815 ILCS 530/45(a). It also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay.”
Archey v. Osmose Utils. Servs., Inc. (N.D. Ill. 2022). “” 815 ILCS 530/45(a). PIPA also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay.”
Wittmeyer v. Heartland All. for Human Needs & Human Rights (N.D. Ill. 2024). “2022) (citing 815 ILCS 530/45(a)). Indeed, the Illinois Appellate Court recently explained that, given this amendment to PIPA, “the reasoning of the Cooney court no longer applies.”
Roper v. Rise Interactive Media & Analytics, LLC (N.D. Ill. 2023). “” 815 ILCS 530/45; [Dkt. 21 at 5.] Plaintiffs argue that the creation of this duty is consistent with Cooney because Cooney only rejected broadening the common-law duty beyond what was statutorily prescribed.”
Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.