A bill before the Illinois General Assembly (SB 1624) proposes to amend that state’s Personal Information Protection Act (815 ILCS 530/10) to require notification to the Attorney General if a security breach affects more than 500 Illinois residents. The measure has already passed the state Senate and is expected to pass the House soon. If passed and signed into law, Illinois will join 28 other states that have similar notification requirements.

Among the 28 states that...