Although the Personal Information Protection Act (PIPA) does not define an owner or licensor of personal data, we believe that the bank would be considered an owner/licensor of personal data (as opposed to a maintainer/storer of personal data), given that the bank stores that data for its own purposes and not on behalf of another entity. Therefore, we believe the notice requirements of the Act would apply in this situation.

PIPA does not make any exceptions to the requirement that data collectors include specific information when notifying customers about a data breach, including the consumer reporting agencies and FTC contact information. 815 ILCS 530/10. If the bank falls into PIPA’s scope, it should include all of the required information in the notices of breach.