Addressing the growing concerns about identity theft and data breach, the Illinois Governor on June 16, 2005, signed into law the Illinois Personal Information Protection Act (“PIPA”). This law applies to privately and publicly held corporations, retail operators, government agencies, public and private universities,

financial institutions, and any other entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information of an Illinois resident. In essence, all organizations that use or maintain Illinois consumer personal information will be subject to this law. The law requires any such organization to promptly notify the Illinois resident in cases where their personal information has been compromised due to a breach in organization’s security. A violation of this law can result in monetary, statutory, and punitive damages against the organization. The Illinois PIPA law took effect January 1, 2006. How well does your privacy program comply?