Law / United States / 
Pennsylvania
House Bill 78, Attorney General enforcement and private right of action
Pa. H.B. 78, sec. 10 (PN 3688)
Before the second chamber, dated , as of .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
Where it has got to
The text described here is Printer's Number 3688, as amended by the Senate Communications and Technology Committee. That print is PN 3688, published .
Locally, this stage is second consideration in the Senate.
The stage above is recorded at www.palegis.us.
House passed HB 78 (PN 1476) 127-76 on . Senate Consumer Protection and Professional Licensure Committee reported it as committed 14-0 on and re-referred it to Communications and Technology same day; that committee re-reported it as amended (PN 3688) 11-0 on . Senate gave it first consideration and second consideration , and laid it on the table and removed it from the table on ; no later action recorded. The 2025-2026 session runs through .
What it requires
- Comply with HB 78 as amended by Printer's Number 3688: a violation is deemed an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law, enforceable exclusively by the Attorney General, and the Act gives no private right of action.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When does the Attorney General determine that 'a cure is possible' under section 10(a)(1) of House Bill 78 (Printer's No. 3688), which decides whether a controller or processor first receives a notice of violation and a 60-day opportunity to cure?
What it makes you log
Logging duty
Section 10 gives the Attorney General exclusive authority to enforce the Act, with a 60 day notice and right to cure during the first period after the effective date and factors the Attorney General may weigh in offering a cure, bars any private right of action, makes a violation an unfair or deceptive act under the Unfair Trade Practices and Consumer Protection Law enforced only by the Attorney General, and directs the Attorney General to promulgate regulations. It states no log, record or audit duty and does not itself give the Attorney General a power to demand a record. The Attorney General's power to require a controller to disclose a data protection assessment is in section 7(c), and the reach of the Act (a controller that does business in the Commonwealth, a consumer who is a resident) is in the section 2 definitions; neither section is cited by this row. The text is Printer's No. 3688 of a bill that has not been enacted.
- Kind
- None
- As of
What this law does
As amended (PN 3688), HB 78 would give the Attorney General exclusive authority to enforce the Act and would foreclose a private right of action twice over: subsection (b), strengthened by the Senate amendment, provides that nothing in the Act creates, is used as the basis or predicate for, or otherwise gives rise to a private right of action; and subsection (c) deems a violation an unfair or deceptive practice under the Unfair Trade Practices and Consumer Protection Law but makes that deeming enforceable exclusively by the Attorney General, closing the UDAP route the deeming clause would otherwise open, the same double-foreclosure shape as the enacted breach statute below.
The bill passed the House 127-76 on and had second consideration in the Senate on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .