Deleting Paycomonline.net Company Job Application Portal Account

Location: Illinois

Sorry if this is kind of long, I just want to be thorough.

A few weeks back I was job hunting and one of the companies I tried applying to had a paycomonline.net portal (like a few other more reputable places I also applied to) where you registered an account with your email as a candidate, and then could apply for listed job positions.

Except on the application there was a tax credit questionnaire section (which was optional, but the opt-out was turned off at the start and a little tricky to find), allegedly to help the company determine eligibility for tax credit benefits in regards to certain employees, which straight-up asked for my full SSN, this early in the process. Even after realizing that section of the application was optional, the whole thing made me feel uncomfortable enough to pause the application and go to bed (it was night).

The very next morning, even though my application was still incomplete and unsubmitted, I got an message through the portal from someone claiming to be the company HR coordinator saying they wanted to consider my candidacy and to provide a time for a quick phone call, and then a repeat message some hours later the same day. This weirded me out, and after doing more research on top of my previous cursory confirmation that the company legit existed and had a functional office located in their claimed area, I found that there were a lot of poor customer reviews and some employee review complaints of toxic workplace culture. I ended up deciding to just pass on the company and forget that place.

Except two weeks or so later I got another message (which I saw via auto email notification) out of the blue with the same thing, and I decided to delete my entire account with that company. I followed the instructions provided in account settings and filed a deletion request before leaving the website. Except today I went back to check and the account was not deleted.

There was a message logged from the HR person that they had received and were reviewing my deletion request, and another one sent a mere 8 minutes later saying it was denied because they had to keep my data for furthering a legal obligation or "completely legitimate internal interest" like record retention requirements. It also said I could possibly appeal depending on "applicable jurisdiction", and to contact the company for further information regarding appeals.

My full name, full address, email, phone number, and resume were still in there. I just went in and edited and saved the incomplete application to remove most of those, but I couldn't delete my full name and my email is intrinsically linked to my portal account. So only my name and email is still listed now, but I don't know if that actually means the company no longer has my other data.

Unfortunately I don't know the Illinois laws regarding deleting a paycomonline.net company employment portal account when I don't actually intend on submitting any applications, and whether they're allowed to keep my data. I wanted to clarify things and get an actual understanding of Illinois policy before I go contact that company for an appeal, so any help would be greatly appreciated.

EDIT: Um, so u/booyakasha mentioned the Illinois Personal Information Protection Act to me, but I checked and PIPA only seems to cover first initial and last name in conjunction with SSN, driver's license number, or financial/card information, none of which I provided in my application. I think a birthdate might be considered personal rather than public information, but I'm not sure if I ever entered mine on the application (it's gone now on the current version). Unfortunately stuff like address and phone number seem to be considered public information you can find on government records, and is not covered under PIPA. Also, the law seems to be more about addressing data breaches, when I just don't want this company hanging onto my info at all.

They also suggested I look into the company's data policies, before filing an appeal while ready to cite relevant laws, but I'm still looking into that.

Though wasn't this kind of against Rule 1 of this sub, taking discussion off the original post and its comment section, even if it was tagging my username on a post rather than a PM?