HB 997 — An Act amending the act of December 22, 2005 (P.L.474, No.94), known as the Breach of Personal Information Notification Act, further providing for definitions, for notification of the breach of the security of the system, for exceptions and for notice exemption; repealing provisions relating to civil relief; providing for protection of personal information, for civil relief, for information security and for applicability; and repealing provisions relating to applicability.

PRIOR PRINTER'S NO.

1086 PRINTER'STHE NO.GENERAL ASSEMBLY OF PENNSYLVANIA HOUSE BILL Session of No.

1621 THE GENERAL ASSEMBLY OF PENNSYLVANIA HOUSE BILL Session of No.

WILLIAMS, CIRESI, STEELE, SHUSTERMAN, DEASY, GREEN, DALEY AND GILLEN, MARCH 24, 2025 ASREFERRED REPORTEDTO FROM COMMITTEE ON COMMERCE, HOUSEMARCH OF24, REPRESENTATIVES, AS AMENDED, MAY 6, 2025 AN ACT Amending the act of December 22, 2005 (P.L.474, No.94), entitled the"An notificationact ofproviding residentsfor whosesecurity personalof informationcomputerized data and for was or may have been disclosed due to a breach of thetheion data security of the system;

providing for protection of personal information, for civil <-- relief for financial institution's liability, for civil relief, for information security, for access devices and <-- breach of security and for applicability;

"Business." A sole proprietorship, partnership, corporation, association or other group, however organized and whether or not organized to operate at a profit.[, including a financial institution organized, chartered or holding a license or authorization certificate under the laws of this Commonwealth, 20250HB0997PN162120250HB0997PN1086 - 2 - any other state, the United States or any other country, or the parent or the subsidiary of a financial institution.] The term includes an entity that destroys records.

* * * 20250HB0997PN162120250HB0997PN1086 - 3 - "Notice." [May be provided by any of the following methods of notification] As follows:

20250HB0997PN162120250HB0997PN1086 - 4 - (ii) Substitute notice shall consist of all of the following:

(ii) Driver's license number or a Federal or State identification card number [issued in lieu of a driver's 20250HB0997PN162120250HB0997PN1086 - 5 - license].

(2) The term does not include publicly available 20250HB0997PN162120250HB0997PN1086 - 6 - information that is lawfully made available to the general public from Federal, State or local government records or widely distributed media.

Except as provided in section 4 or in order 20250HB0997PN162120250HB0997PN1086 - 7 - to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system, the notice shall be made without unreasonable delay.

* * * (b) Compliance with Federal requirements.-- [(1) A financial institution that complies with the notification requirements prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized 20250HB0997PN162120250HB0997PN1086 - 8 - Access to Customer Information and Customer Notice is deemed to be in compliance with this act.] (2) An entity[, a State agency or a State agency's contractor] that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures or guidelines established by the entity's[, State agency's or State agency's contractor's] primary State or functional Federal regulator, shall be in compliance with this act.

<-- (a) Reimbursement.--If there is a breach of the security of 20250HB0997PN162120250HB0997PN1086 - 9 - the system of a person or entity that has violated this section, or that person's or entity's service provider, that person or entity shall reimburse the financial institution that issued any access devices affected by the breach for the costs of reasonable actions undertaken by the financial institution as a result of the breach in order to protect the information of the entity's cardholders or to continue to provide services to cardholders, including any cost incurred in connection with:

20250HB0997PN162120250HB0997PN1086 - 10 - Section 1111. 10.

<-- (a) Remedies for residents.--A resident of this Commonwealth who is adversely affected by a violation of this act, in addition to and cumulative of all other rights and remedies available at law, may bring an action to:

A contract entered into on or after the effective 20250HB0997PN162120250HB0997PN1086 - 11 - date of this section shall not include language that requires arbitration or restricts a resident's right to legal action.

Section 1212. 11.

<-- (a) Security or identification information.--An entity that maintains, stores or manages computerized data that includes personal information shall take reasonable measures, consistent with the nature and size of the entity, to secure the system and personal information of residents of this Commonwealth that is not redacted.

<-- (a) Security or identification information and retention prohibited.--A person or entity conducting business in this Commonwealth that accepts an access device in connection with a transaction may not retain the card security code data, the PIN verification code number or the full contents of any tract magnetic stripe data, subsequent to the authorization of the transaction or in the case of a PIN debit transaction, subsequent to 48 hours after authorization of the transaction.

A person or entity is in violation of this section if the person's or entity's service provider retains the data subsequent to the 20250HB0997PN162120250HB0997PN1086 - 12 - authorization of the transaction or, in the case of a PIN debit transaction, subsequent to 48 hours after authorization of the transaction.

(c) Recovery.--The financial institution shall also be entitled to recover costs for damages paid by the financial institution to cardholders injured by a breach of the security 20250HB0997PN162120250HB0997PN1086 - 13 - of the system of a person or entity that has violated this section.

Section 1414. 12.

<-- This act shall apply to the discovery or notification of a breach in the security of personal information that occurs on or after the effective date of this section.

20250HB0997PN162120250HB0997PN1086 - 14 -