Pennsylvania's Breach Notification Act: How a 2005 Statute Was Rebuilt by Act 151 of 2022 and Act 33 of 2024

The Breach of Personal Information Notification Act

The statute is the Act of December 22, 2005, P.L. 474, No. 94, cited by its section 1 as the Breach of Personal Information Notification Act. Its original section 30 set the effective date at 180 days after enactment. The Office of Attorney General's BPINA page records that Governor Ed Rendell signed it on December 22, 2005.

The numbering is irregular. The operative sections run from 1 to 8, with sections 5.1 to 5.4 inserted by amendment, and then jump to section 29 (applicability) and section 30 (effective date). Section 6 declares the subject matter one of statewide concern and preempts local rules and ordinances on "the matters expressly set forth in this act." The long title was amended in 2022 so that the Act now describes itself as providing "for security of computerized data" as well as for notification.

Who Must Notify, and the Entity Categories

The duty in section 3(a) falls on "an entity that maintains, stores or manages computerized data that includes personal information." Section 2 defines an entity as "a State agency, a political subdivision of the Commonwealth or an individual or a business doing business in this Commonwealth." A business is any sole proprietorship, partnership, corporation, association or other group, for profit or not, and the definition names financial institutions chartered under the law of any state, the United States or another country, together with their parents and subsidiaries. It adds that the term "includes an entity that destroys records."

Section 3(c) separates the entity from its vendor. A vendor that maintains, stores or manages data on another entity's behalf notifies that entity "following discovery," and the entity on whose behalf the data is held is "responsible for making the determinations and discharging any remaining duties under this act." The vendor's clock runs from discovery; the entity's runs from determination.

The persons owed notice are Pennsylvania residents, and section 3(a) supplies a working test: a resident "may be determined to be an individual whose principal mailing address, as reflected in the computerized data," is in the Commonwealth. The breach definition itself has three limbs that all have to be met: unauthorized access and acquisition of computerized data; material compromise of the security or confidentiality of personal information held "as part of a database of personal information regarding multiple individuals"; and loss or injury, actual or reasonably believed, to a Pennsylvania resident. Good-faith acquisition by an employee or agent for the entity's purposes is excluded if the information is not misused or further disclosed.

Act 151 of 2022: State Agencies, Contractors and Local Government

The first rewrite was Senate Bill 696 of the 2021-2022 session, prime-sponsored by Senator Daniel Laughlin. The General Assembly's history shows it passed the Senate 32 to 17 on January 19, 2022, passed the House 199 to 0 on October 26, 2022 after amendment in the House State Government Committee, returned to the Senate for concurrence the same day, and was approved on November 3, 2022 as Act 151. Its section 6 set the effective date at 180 days.

The most consequential change for private entities was a single word in section 3(a): the notice duty now runs from "determination" of a breach instead of "discovery." Act 151 added both definitions. Discovery is "knowledge of or reasonable suspicion" that a breach has occurred; determination is "a verification or reasonable certainty" that one has. The applicability section was amended in the same way, so the Act applies to a determination or notification of a breach occurring on or after the amended section's effective date.

Most of Act 151 concerns government. It added a definition of State agency contractor, meaning a person, business or subcontractor whose contract with a State agency requires access to personal information, and new subsections 3(a.1) to 3(a.4):

• A State agency notifies affected residents within seven business days of determination, with concurrent notice to the Office of Attorney General
• A State agency contractor notifies the affected agency's chief information security officer, or a designee, on discovery, as soon as reasonably practical and no later than the period in its contract
• A State agency under the Governor's jurisdiction also notifies the Governor's Office of Administration within three business days of determination
• A State agency's later contracts involving personal information have to include provisions on the contractor's compliance with the Act
• A county, public school or municipality notifies affected residents within seven business days and the district attorney of the county where the breach occurred within three
• For breaches of online account credentials, notice may be given electronically, directing the person to change the password or security question and answer, and a contractor may meet its duty by giving the agency a list of affected residents and their email addresses

Act 151 also added sections 5.1 and 5.2, which apply to an entity that maintains, stores or manages personal information "on behalf of the Commonwealth": encryption or other appropriate measures for transmission over the Internet, and written transmission and storage policies reviewed at least annually. Section 5.3 deems a HIPAA covered entity or business associate in compliance with HIPAA and HITECH privacy and security standards to be in compliance with the Act. The definition of personal information gained medical information, health insurance information, and a user name or email address combined with a password or security question and answer. As enacted in 2022, the medical information element was unqualified.

Act 33 of 2024: What Changed in the Text

The second rewrite was Senate Bill 824 of the 2023-2024 session, prime-sponsored by Senator Tracy Pennycuick. It passed the Senate 50 to 0 on October 4, 2023 and the House 202 to 0 on June 25, 2024, and was approved on June 28, 2024 as Act 33, taking effect in 90 days.

Act 33 is best known for the Attorney General notice in section 3(c.1) and the credit report and monitoring duty in section 5.4. Two smaller changes in the same act are easy to miss. First, section 1 of Act 33 inserted the words "in the possession of a State agency or State agency contractor" into the medical information element, so that for a private business the element added in 2022 no longer applies; health insurance information remains a separate element with no such limit. Second, section 2 of Act 33 lowered the threshold for notifying the nationwide consumer reporting agencies under section 5 from more than 1,000 persons to more than 500. Because section 5.4 applies to "an entity that provides notification under section 5," the credit monitoring duty is tied to that same 500-person threshold.

The dates recorded for Act 33 differ between sources. The Act's text and the General Assembly's bill history both give approval as June 28, 2024. The Office of Attorney General's BPINA page says the amendments were approved on July 28, 2024 and became effective on September 26, 2024; September 26 is 90 days after June 28.

Timing, Content and Encryption

For entities outside government, section 3(a) sets no fixed number of days. Notice is due "without unreasonable delay," subject to two exceptions: measures necessary to determine the scope of the breach and restore the integrity of the system, and section 4. Section 4 allows delay only where a law enforcement agency "determines and advises the entity in writing specifically referencing this section" that notice will impede a criminal or civil investigation, and notice follows once the agency determines it will not compromise the investigation or national or homeland security.

The Act lists four permitted methods of individual notice in its definition of notice: written notice to the last known home address; telephone, if the call describes the incident in general terms and gives a number or website for further information without asking the individual for personal information; email, where there is a prior business relationship and a valid address; and electronic notice for compromised account credentials. Substitute notice by email, website posting and statewide media is available where notice would cost more than $100,000, more than 175,000 people are affected, or contact information is insufficient. Apart from the telephone method and the Attorney General report in section 3(c.1), the Act does not list what a notice has to say.

Encryption is defined in section 2 as "an algorithmic process" that transforms data so there is "a low probability of assigning meaning without use of a confidential process or key." Redaction includes alteration or truncation so that no more than the last four digits of a Social Security, driver's license, State ID or account number are accessible. Encrypted data is not a complete exemption: section 3(b) requires notice where encrypted information is accessed and acquired in unencrypted form, where the breach is linked to a breach of the encryption, or where it involves a person with access to the key.

Section 7 contains three routes to deemed compliance: an entity that follows its own notification procedures, if they are consistent with the Act's notice requirements; a financial institution that follows the federal interagency guidance on response programs for unauthorized access to customer information; and an entity, State agency or contractor that complies with the notification rules of its primary State or functional federal regulator.

Enforcement Under the Consumer Protection Law

Section 8 provides that a violation "shall be deemed to be an unfair or deceptive act or practice" under the Unfair Trade Practices and Consumer Protection Law, and that the Office of Attorney General "shall have exclusive authority" to bring the resulting action. That word narrows the usual route. Section 4 of the consumer protection law lets either the Attorney General or a district attorney seek an injunction, and section 8 of that law lets either of them petition for civil penalties; for a breach notice violation, only the Attorney General may sue.

The Act itself sets no penalty amounts. The remedies are the consumer protection law's, and the Office of Attorney General's BPINA page summarizes them as injunctive relief, restitution and penalties against a business entity that violates the Act.

Frequently Asked Questions