(20 ILCS 450/1) Sec. 1. Short title. This Act may be cited as the Data Security on State Computers Act. (Source: P.A. 93-306, eff. 7-23-03.)

(20 ILCS 450/5) Sec. 5. Findings. The General Assembly finds that: (a) The Massachusetts Institute of Technology, in a recent study, discovered that many companies and individuals are regularly selling or donating computer hard drives with sensitive information still on them, such as credit card numbers, bank and medical records, and personal e-mail. (b) Illinois currently has no law addressing data security and removal of data from surplus State-owned computers that are to be (i) disposed of by sale, donation, or transfer or (ii) relinquished to a successor executive administration. (c) In order to ensure the protection of sensitive information relating to the State and its citizens, it is necessary to implement policies to (i) overwrite all hard drives of surplus State-owned electronic data processing equipment that are to be sold, donated, or transferred and (ii) preserve the data on State-owned electronic data processing equipment that is to be relinquished to a successor executive administration for the continuity of government functions. (Source: P.A. 93-306, eff. 7-23-03.)

(20 ILCS 450/10) Sec. 10. Purpose. The purpose of this Act is to (i) require the Department of Central Management Services or any other authorized agency that disposes of surplus electronic data processing equipment by sale, donation, or transfer to implement a policy mandating that computer hardware be cleared of all data and software before disposal by sale, donation, or transfer and (ii) require the head of each Agency to establish a system for the protection and preservation of State data on State-owned electronic data processing equipment necessary for the continuity of government functions upon relinquishment of the equipment to a successor executive administration. (Source: P.A. 93-306, eff. 7-23-03.)

(20 ILCS 450/15) Sec. 15. Definitions. As used in this Act: "Agency" means all parts, boards, and commissions of the executive branch of State government, other than public universities or their governing boards, including, but not limited to, all departments established by the Civil Administrative Code of Illinois. "Disposal by sale, donation, or transfer" includes, but is not limited to, the sale, donation, or transfer of surplus electronic data processing equipment to other agencies, schools, individuals, and not-for-profit agencies. "Electronic data processing equipment" includes, but is not limited to, computer (CPU) mainframes, and any form of magnetic storage media. "Authorized agency" means an agency authorized by the Department of Central Management Services to sell or transfer electronic data processing equipment under Sections 5010.1210 and 5010.1220 of Title 44 of the Illinois Administrative Code. "Department" means the Department of Central Management Services. "Overwrite" means the replacement of previously stored information with a pre-determined pattern of meaningless information. (Source: P.A. 96-45, eff. 7-15-09.)

(20 ILCS 450/17) Sec. 17. Exemption from Act. This Act does not apply to the legislative branch of State government, the Office of the Lieutenant Governor, the Office of the Attorney General, the Office of the Secretary of State, the Office of the State Comptroller, or the Office of the State Treasurer. (Source: P.A. 96-45, eff. 7-15-09.)

(20 ILCS 450/20) Sec. 20. Establishment and implementation. The Data Security on State Computers Act is established to protect sensitive data stored on State-owned electronic data processing equipment to be (i) disposed of by sale, donation, or transfer or (ii) relinquished to a successor executive administration. This Act shall be administered by the Department or an authorized agency. The governing board of each public university in this State must implement and administer the provisions of this Act with respect to State-owned electronic data processing equipment utilized by the university. The Department or an authorized agency shall implement a policy to mandate that all hard drives of surplus electronic data processing equipment be erased, wiped, sanitized, or destroyed in a manner that prevents retrieval of sensitive data and software before being sold, donated, or transferred by (i) overwriting the previously stored data on a drive or a disk at least 3 times or physically destroying the hard drive and (ii) certifying in writing that the overwriting process has been completed by providing the following information: (1) the serial number of the computer or other surplus electronic data processing equipment; (2) the name of the overwriting software or physical destruction process used; and (3) the name, date, and signature of the person performing the overwriting or destruction process. The head of each State agency shall establish a system for the protection and preservation of State data on State-owned electronic data processing equipment necessary for the continuity of government functions upon it being relinquished to a successor executive administration. For purposes of this Act and any other State directive requiring the clearing of data and software from State-owned electronic data processing equipment prior to sale, donation, or transfer by the General Assembly or a public university in this State, the General Assembly or the governing board of the university shall have and maintain responsibility for the implementation and administration of the requirements for clearing State-owned electronic data processing equipment utilized by the General Assembly or the university. (Source: P.A. 96-45, eff. 7-15-09; 97-390, eff. 8-15-11.)

(20 ILCS 450/25) Sec. 25. Mandatory State employee training.(a) As used in this Section, "employee" has the meaning ascribed to it in Section 1-5 of the State Officials and Employees Ethics Act, but does not include an employee of the legislative branch, the judicial branch, a public university of the State, or a constitutional officer other than the Governor.(b) Every employee shall annually undergo training by the Department of Innovation and Technology concerning cybersecurity. The Department may, in its discretion, make the training an online course. The training shall include, but need not be limited to, detecting phishing scams, preventing spyware infections and identity theft, and preventing and responding to data breaches.(c) The Department of Innovation and Technology may adopt rules to implement the requirements of this Section. (Source: P.A. 100-40, eff. 1-1-18.)

(20 ILCS 450/50) Sec. 50. (Amendatory provisions; text omitted). (Source: P.A. 93-306, eff. 7-23-03; text omitted.)

(20 ILCS 450/99) Sec. 99. Effective date. This Act takes effect upon becoming law. (Source: P.A. 93-306, eff. 7-23-03.)