Pennsylvania’s amendments to data breach notification law take effect

• If notice of a breach must be given to more than 500 individuals, notice must made at the same time to the Office of the Attorney General. Notice to the Attorney General must include the following information to the extent known by the notifying entity:
  • the organization name and location;
  • the date of the breach of the security of the system;
  • a summary of the breach incident of the security of the system;
  • an estimated total number of individuals affected by the breach; and
  • an estimated number of Pennsylvania residents affected by the breach.

Entities subject to 40 Pa.C.S. Ch. 45 (relating to insurance data security) are exempt from the Attorney General notice requirements.

• If the breach affected 500 or more individuals, the entity must report to the nationwide credit reporting agencies. The threshold for reporting to these agencies was previously 1,000 or more individuals.
• If the breach involves an individual’s Social Security number, bank account number, or Driver's license or State ID number, the entity must provide no-cost credit monitoring services for a period of 12 months, and access to one independent credit report from a consumer reporting agency if the individual is unable to obtain one free of charge.
• “Medical information” under the statute’s definition of “Personal Information” has been changed to “medical information in the possession of a State agency or State agency contractor.”

These amendments bring the Pennsylvania statute into line with other state data breach statutes. However, Pennsylvania’s inclusion of driver’s license, state identification number, and bank account numbers as elements of personal information that require credit monitoring is unique.

Along with the amendments to the statute, the Office of the Attorney General has established a new online reporting portal.

Businesses and governmental entities covered by the Pennsylvania legislation should continue to review and update incident response plans to reflect these and other legislative changes. Staying informed of current cybersecurity threats, identifying and addressing vulnerabilities, and confirming the adequacy of administrative, technical, and physical controls continues to be essential.