Law / United States / 
Pennsylvania
Breach of Personal Information Notification Act
73 P.S. secs. 2302, 2303, 2305, 2308 (Act 94 of 2005)
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected Pennsylvania resident of a breach of system security involving personal information without unreasonable delay.NIST Privacy FrameworkCM.AW-P7
- Notify each nationwide consumer reporting agency if you notify more than 500 persons of a breach at one time.NIST Privacy FrameworkCM.AW-P7
- Notify the Pennsylvania Office of Attorney General concurrently if you must give notice of a breach to more than 500 affected individuals in the Commonwealth.NIST Privacy FrameworkCM.AW-P7
- If you determine a breach of the security of the system has occurred and reasonably believe an individual's name in combination with a Social Security number, bank account number, or driver's license or State ID number has been accessed, assume the cost of one independent credit report for an individual not eligible for a free one and of credit monitoring services for 12 months following notification, and inform the affected individual of those no-cost services when you notify them (Section 5.4).NIST Privacy FrameworkCM.AW-P8
- If you are a State agency, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach, and notify the Office of Attorney General concurrently (Section 3(a.1)(1)).NIST Privacy FrameworkCM.AW-P7
- If you are a State agency under the Governor's jurisdiction, also notify the Governor's Office of Administration of a breach of the security of the system within 3 business days following determination of the breach (Section 3(a.1)(3)).NIST Privacy FrameworkCM.AW-P7
- If you are a county, public school or municipality, notify each affected Pennsylvania resident of a breach of the security of the system within 7 business days following determination of the breach (Section 3(a.2)).NIST Privacy FrameworkCM.AW-P7
- If you are a county, public school or municipality, also notify the district attorney of the county where the breach occurred within 3 business days following determination of the breach (Section 3(a.2)).NIST Privacy FrameworkCM.AW-P7
- Do not rely on this statute to cover a breach of biometric data alone. It does not fold biometric identifiers into personal information.
- Expect this Act's notice duty to be enforced exclusively by the Pennsylvania Attorney General, never by a private plaintiff, even though a violation is deemed an unfair trade practice.
These lines are LexLint's reading of the law's text. Also read by: Pennsylvania Office of Attorney General (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.attorneygeneral.gov/report-a-data-breach/bpina/
- Guidance body
- Pennsylvania Office of Attorney General
- Open questions
- What makes an unauthorized access and acquisition of computerized data one that 'materially compromises the security or confidentiality of personal information', so that it is a 'breach of the security of the system' under Section 2 of the Act?
- Is the unauthorized acquisition of a store that holds the personal information of only one individual outside the Section 2 definition of 'breach of the security of the system', because the definition requires 'a database of personal information regarding multiple individuals'?
What it makes you log
Logging duty
Sections 2, 3, 5 and 8 define the covered breach, require an entity to notify each affected resident without unreasonable delay after determining that a breach occurred, require notice to the nationwide consumer reporting agencies when more than 500 persons are notified (section 5), and make a violation an unfair or deceptive act that only the Attorney General may enforce. Each is a duty to notify. No cited section tells an entity to keep a record of breaches, notified or not, or to document its determination. The content list for the notice to the Attorney General when more than 500 individuals are affected (section 3(c.1)) is a notice and not a record. The annual policy review and the storage policy duties of sections 5.1 and 5.2, which bind entities holding data for the Commonwealth and are policies, sit in sections this row does not cite. The Act reaches an entity doing business in the Commonwealth and protects a resident, a resident being a person whose principal mailing address in the entity's data is in the Commonwealth.
- Kind
- None
- As of
What this law does
An entity that maintains, stores, or manages computerized data including personal information must provide notice of a breach of the security of the system, without unreasonable delay, to any Pennsylvania resident whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.
Personal information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, medical information held by a state agency or contractor, health insurance information, or a username or email with a password or security question, and excludes publicly available information lawfully available from government records or widely distributed media (added by the amendment); it does not reach biometric identifiers as such.
An entity that notifies more than 500 persons at one time (section 5 was amended on ) must also notify nationwide consumer reporting agencies. A state agency's own breach separately requires Attorney General notice within seven business days. Since the amendment, an entity that must give notice to more than 500 affected individuals in the Commonwealth must also notify the Office of Attorney General concurrently.
An entity subject to the insurance data security chapter of Title 40 is exempt from that Attorney General notice duty. Since the amendment, an entity that determines a breach of the security of the system has occurred, and reasonably believes that an individual's name in combination with a Social Security number, bank account number, or driver's license or State ID number has been accessed, is subject to the credit reporting and monitoring requirements.
Those requirements are that the entity assume the cost of one independent credit report for an individual not eligible for a free one and of credit monitoring services for 12 months following notification, a requirement the entity may satisfy by notifying the individual that monitoring is available for 12 months at no cost.
A violation is deemed an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, 73 P.S. secs. 201-1 to 201-9.3, but the Office of Attorney General has exclusive authority to bring that action, so the Act creates no private right of action even though its deeming clause would otherwise open a UDAP route the way Connecticut's breach statute does.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .