Introduction

The Illinois Personal Information Protection Act (PIPA) contains provisions that establish standards for the disposal of the personal information (“Data Disposal Statutes”) of Illinois residents collected and processed by private legal entities and government agencies. The Data Disposal Statute contains two distinct provisions, 530/30 and 530/40. The former provision, adopted in 2006, applies to state government agencies. The latter provision, adopted in 2012, applies to individuals, business organizations, local and state government.

Applicability

The Data Disposal Statutes apply to both electronic media and paper materials that contain personal information. Section 530/30 applies a single disposal standard to both formats, while Section 530/40 applies a single disposal standard and includes examples of proper disposal methods for each format.

The Data Disposal Statutes utilize differing language to define each provision’s applicability to state government entities. Section 530/30 applies solely to State of Illinois government agencies. Section 530/40 applies much more broadly to the State of Illinois, its constitutional officers, agencies, departments, divisions, bureaus, boards, commissions, or committees. Despite the differences in language, the provisions may be determined to be coterminous. 

Requirements

Section 530/30 simply states that disposal must be carried out in such a manner as to ensure the security and confidentiality of the material. In contrast, Section 530/40 is much more descriptive with its requirements. Section 530/40 requires that disposal be carried out in a manner that renders the personal information unreadable, unusable, and undecipherable. It also expressly allows entities to contract with third parties to dispose of personal information on behalf of the entity. The third party must implement and monitor compliance with disposal policies and procedures.

Enforcement & Liability

The Attorney General of the State of Illinois is authorized to file a civil action in the state’s circuit court to remedy a violation of Section 530/40. The Attorney General may seek any appropriate relief; however, they must give notice to the person accused of a violation and provide an opportunity to be heard before the action is filed.

Penalties

Violators are subject to a civil penalty of up to $100 for each person whose personal information is disposed of in violation of Section 530/40(a). However, the aggregate of the civil penalties may not exceed $50,000 for each instance of improper disposal.