Guide to the Personal Information Protection Act (PIPA)

The Personal Information Protection Act (PIPA) specifically requires public universities, such as the University of Illinois, and other data collectors to notify affected individuals whenever a breach of the security of the data collector's system data occurs. PIPA is the enactment of House Bill 1633, which was signed into law by Governor Rod Blagojevich in June, 2005, and went into effect on January 1, 2006. With PIPA, Illinois became only the second state in the country to respond to major security breach cases (e.g., ChoicePoint).

The Personal Information Protection Act creates several stipulations for notifying affected persons of a data breach.

What is a breach of security systems?

The definition of a breach under the Act is: "unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the data collector." As long as an institution "handles, collects, disseminates, or otherwise deals with nonpublic personal information" it is considered a data collector. Accessing the data is not a breach, so notification does not have to occur every time the data is collected. But if the data is accessed and used for a purpose unrelated to the University's business or if it is made available to further unauthorized disclosure, this would also be considered a breach.

What data is protected?

"Personal data" is the term for protected information that is used in PIPA and it is defined as:

An individual's first name or first initial and last name, in combination with any one or more of the following:

1. Social security number
2. Driver's license number or State identification card number
3. Account number or credit or debit card number, or an account number or credit card number in combination with any security code, access code or password that would permit access to an individual's financial account.

It is important to note, as the University is a public institution, "personal information" does not include publicly available information or public records.

Who do I contact if I have questions or suspect I have had a security breach?

For additional information on the Personal Information Protection Act or if you have had a security breach consult directly with Mike Corn, Director of Security Services and Information Privacy (Office of the CIO), by calling 265-0588 or emailing him at mcorn [at] uiuc [dot] edu.

The University has a formal procedure for handling security-related incidents and units must not attempt to respond to incidents involving confidential information on their own. The responses will be coordinated by the Security Office within the Office of the CIO in partnership with Campus Legal Counsel.

What types of notification required?

Notification to individuals

Notification must be made in the most expedient time possible without unreasonable delay. However, time may be taken to determine the scope or the breach as well as to restore the integrity and security of the system.

There are three acceptable means of notification:

• Written notice
• Electronic notice
• "Substitute notice" - This is when it is not feasible to provide written or electronic notice because
  • the cost of the notice would exceed $250,000 or
  • there are over 500,000 people to notify or
  • the data collector doesn't have sufficient contact info

If substitute notice was the only option available, then there are three steps that must be taken for substitute notice:

1. email notice if the data collector has an email address for the subject persons
2. conspicuous posting of the notice on the data collector's web site
3. notification to major statewide media.

Recommended actions

• Review all current administrative processes for confidential information
• Inventory computer systems and databases for confidential information
• Delete confidential data where not absolutely necessary
• Encrypt confidential data, such as SSNs, if they must be used
• Do not permit the storage of confidential data on home computers or laptops
• Do not send confidential data through email unless it is encrypted
• Do not use the web as a file transfer mechanism without adequate protections
• Do not allow commercial search engines to index confidential web sites
• Review the University's SSN policy at http://www.ssn.uillinois.edu
• Review the University's Information Security Policy at http://www.obfs.uillinois.edu/manual/central_p/sec19-15.html

Additional notes

The act specifically forbids a waiver of the notification requirement. Therefore, even if someone agreed to exempt the University of Illinois from the notification requirement, the exemption would be void.