Vote Smart's Synopsis:

Vote to pass a bill that requires companies in Pennsylvania that collect personal data to take steps to protect that data from hacking.

Highlights:

• Defines “access device” as a card issued by a financial institution that contains means for storage of information, including a credit card, debit card, or stored value card (Sec. 2).

• Expands the definition of “personal information” to include the following (Sec. 2):

• A passport number;

• A username or email address in combination with a password or security question that would permit access to an online account;

• Medical history;

• Health insurance policy number or subscriber identification number;

• Unique biometric data based on human body characteristics for authentication purposes; and

• An individual taxpayer identification number.

• Requires entities that store data that includes personal information to provide notice of any breach of security following discovery or notification of the breach (Sec. 3).

• Requires entities to provide notice of a security breach if encrypted data is accessed by any individual who learns of the encryption key (Sec. 3).

• Specifies that the notification required by this Act may be delayed for up to three days if a law enforcement agency determines the delay is necessary for a criminal or civil investigation (Sec. 4).

• Requires any person who conducts business in the State and owns, licenses, or maintains personal information to implement reasonable procedures to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information (Sec. 9).

• Authorizes individuals adversely affected by a violation of this Act to bring civil action to recover actual damages or up to $5,000 for each violation (Sec. 10).

• Authorizes the Attorney General to bring civil action against a person who violates this Act to recover a penalty of up to $10,000 per violation (Sec. 10).

• Specifies a statute of limitations for civil action under this Section of three years from the discovery of a violation (Sec. 10).

• Authorizes a court to increase the penalty for repeated violations of this Act (Sec. 10).

• Specifies that this Act takes effect 60 days after passage (Sec. 6).

Full Bill Text