Processes personal data, in Pennsylvania

73 P.S. secs. 2302, 2303, 2305, 2308 (Act 94 of 2005) · Read the law's page

• Notify each affected Pennsylvania resident of a breach of system security involving personal information without unreasonable delay.
• Notify each nationwide consumer reporting agency if you notify more than 500 persons of a breach at one time.
• Notify the Pennsylvania Office of Attorney General concurrently if you must give notice of a breach to more than 500 affected individuals in the Commonwealth.
• If you determine a breach of the security of the system has occurred and reasonably believe an individual's name in combination with a Social Security number, bank account number, or driver's license or State ID number has been accessed, assume the cost of one independent credit report for an individual not eligible for a free one and of credit monitoring services for 12 months following notification, and inform the affected individual of those no-cost services when you notify them (Section 5.4).
• If you are a State agency, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach, and notify the Office of Attorney General concurrently (Section 3(a.1)(1)).for a public body
• If you are a State agency under the Governor's jurisdiction, also notify the Governor's Office of Administration of a breach of the security of the system within 3 business days following determination of the breach (Section 3(a.1)(3)).for a public body
• If you are a county, public school or municipality, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach (Section 3(a.2)).for a public body
• If you are a county, public school or municipality, also notify the district attorney of the county where the breach occurred within 3 business days following determination of the breach (Section 3(a.2)).for a public body
• Do not rely on this statute to cover a breach of biometric data alone. It does not fold biometric identifiers into personal information.
• Expect this Act's notice duty to be enforced exclusively by the Pennsylvania Attorney General, never by a private plaintiff, even though a violation is deemed an unfair trade practice.

74 P.S. § 201 (Act 60 of 2006) · Read the law's page

• Do not publicly post or publicly display an individual's Social Security number in any manner; to post or display means to intentionally communicate or otherwise make it available to the general public.
• Do not print an individual's Social Security number on any card required to access your products or services, or on materials mailed to the individual unless Federal or State law requires it. A number permitted in a mailing may not be printed, in whole or in part, on a postcard or other mailer that needs no envelope, or be visible on the envelope or without opening it.
• Do not require an individual to transmit a Social Security number over the Internet unless the connection is secure or the number is encrypted, or to use it to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
• Do not disclose, except to the agency issuing the license, the Social Security number of an individual who applies for a recreational license under 30 Pa.C.S. (fish) or 34 Pa.C.S. (game).
• If you continue a use of Social Security numbers that began before the effective date and is inconsistent with these limits, make the use continuous, give each individual an annual disclosure of the right to stop it, and discontinue it within 30 days of a written request, at no fee and without denying services.

196 A.3d 1036 (Pa. 2018)

• Applies to an employer that stores its employees' sensitive personal information on an internet-accessible computer system.
• Exercise reasonable care to safeguard that information: the Supreme Court of Pennsylvania held, on review of an order sustaining preliminary objections in the nature of a demurrer, that such an employer has a legal duty to do so.

Pa. H.B. 78, sec. 10 (PN 3688) · Read the law's page

• Comply with HB 78 as amended by Printer's Number 3688: a violation is deemed an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, enforceable exclusively by the Attorney General, and the Act gives no private right of action.

Pa. H.B. 78, secs. 2, 5, 6, 7 (PN 3688) · Read the law's page

• As amended by Printer's Number 3688, HB 78 applies to a for-profit business meeting a revenue or data-volume threshold and requires it to conduct data protection assessments before high-risk processing.