Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On June 28, Pennsylvania Governor Josh Shapiro signed into law Senate Bill (SB) 824, which amended the state’s personal data breach notification statute, commonly known as the Breach of Personal Information Notification Act (PA Notification Act). In particular, SB 824 amends the term “personal information,” requires organizations to notify government authorities of certain types of data breaches and mandates that organizations (under certain conditions) provide credit monitoring services to individuals whose personal information was compromised during a data breach. The law goes into effect on September 26, 2024. Organizations impacted by the law should update their data breach response plans to account for new notification requirements and assess whether their cyber insurance policies cover new credit monitoring services obligations.

contentpilot/introduction

Background: State and Private Sector Breach Reporting Obligations

core/heading

Like most data breach notification laws, the PA Notification Act requires organizations that maintain “computerized data that includes personal information” to provide notice of a data breach wherein an individual’s “unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.” This notice must “be made without unreasonable delay.”

core/paragraph

The law also provides that if a Pennsylvania state agency determines that it is the subject of a data breach affecting personal information “maintained by the State agency or State agency contractor,” then it must provide notice of the breach to affected persons within 7 business days following determination of the breach. The Pennsylvania state agency must also concurrently provide notification of the breach to the Pennsylvania Office of Attorney General.

The PA Notification Act further provides that a “vendor that maintains, stores or manages computerized data on behalf of another entity shall provide notice of any breach of the security of the system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data.” In turn, it is the private sector entity or state agency that maintains the personal information that is “responsible for making the determinations and discharging [its] remaining duties” with respect to facilitating its data breach notification obligations under the law.

An important aspect of the PA Notification Act is that private sector entities and state agencies are only required to notify individuals of a data breach when certain types of personal information have been compromised. SB 824 narrows the definition of what constitutes personal information. Previously, the term “personal information” was defined as an individual's name, in connection with any of the following identifiable (i.e., non-encrypted) data elements:

core/list

Importantly, SB 824 amends the definition of “personal information” to add a qualifier to “medical information” so the phrase is now “[m]edical information in the possession of a State agency or State agency contractor,” which is similar to the terminology used in other parts of the law where defining the reporting obligations for state agencies and their contractors (see above). SB 824 did not change the definition of “medical information,” which the PA Notification Act defines as “[a]ny individually identifiable information contained in the individual's current or historical record of medical history or medical treatment or diagnosis created by a health care professional.”

According to the Fiscal Notes by the PA Senate Appropriations Committee (PA Senate Fiscal Notes), SB 824 amends the definition of “personal information” to “specifically include medical information in the possession of a state agency or state agency contractor.” However, with the specific changes mandated by SB 824, it appears that now only a state agency or state agency contractor (and not a private sector entity) is required to notify individuals of a data breach impacting medical information. It is unclear whether the intent of SB 824 was to exclude private sector entities from having to inform individuals of a data breach that impacts medical information, and this ambiguity appears to be a consequence of the amendment.

Consumer Reporting Agency and Regulatory Notifications

As previously written, the PA Notification Act only required private sector entities to provide notice of a data breach affected individuals, and in some instances, to consumer reporting agencies. SB 824 now requires organizations impacted by a data breach to furnish notice to the PA Attorney General.

First, with respect to consumer reporting agencies, the PA Notification Act previously required organizations to furnish (without reasonable delay) notice of a data breach to consumer reporting agencies when more than 1,000 individuals were affected by the breach at one time. SB 824 changed this notification threshold from 1,000 individuals to 500 individuals affected by a data breach at one time. This notice to consumer reporting agencies must address the timing, distribution and number of data breach notices delivered to affected individuals.

Next, SB 824 mandates that when a private sector organization provides notice of a data breach to more than 500 affected Pennsylvania residents, then it must also “concurrently” furnish notice of the same to the Office of Attorney General. This notice to the PA Attorney General must include the following information, to the extent known by the notifying organization:

This regulatory reporting requirement, however, does not apply to an entity subject to Pennsylvania law regulating data security requirements for certain types of insurance-related companies. Organizations should update their data breach response plans to justify these new consumer agency and regulatory reporting requirements.

For organizations that are required to provide notice of a data breach to consumer reporting agencies under the law (see above), and the notice concerns a confidentiality breach of a person’s Social Security number, bank account number, driver's license number, or state identification number, they are now required to incur additional obligations. More specifically, SB 824 provides that these entities must “assume all costs and fees” with respect to providing the affected individuals with the following:

According to the PA Senate Fiscal Notes, the “[r]etail prices for credit monitoring services can range between $8.99 per month to $39.95 per month” and “[a]ssuming a breach of 500 individuals, the incurred costs for monitoring services range from $54,000 to $240,000 annually.” According to PA Senate Fiscal Notes, this cost would be paid by the organization that was responsible for the data breach and “would likely be accommodated within existing budgeted amounts.” It will be important for organizations to ensure their cyber insurance coverage addresses credit monitoring services.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

https://admin.thompsonhine.com/wp-content/uploads/2024/07/Pennsylvania-Amends-Data-Breach-Reporting-Law-Requires-Credit-Monitoring-for-Victims.pdf

Pennsylvania Amends Data Breach Reporting Law; Requires Credit Monitoring for Victims

Services