What does Pennsylvania's data breach law ask a business to do?

Who does this law apply to?

The law applies to an entity that maintains, stores or manages computerized data with personal information. An entity is a state agency, a political subdivision, or an individual or business doing business in Pennsylvania.

An entity that maintains, stores or manages computerized data that includes personal information shall provide notice of any breach of the security of the system following determination of the breach of the security of the system to any resident of this Commonwealth whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.

What counts as personal information?

Personal information is a first name or first initial and last name linked to another listed item, when that item is not encrypted or redacted. The list in the text includes a social security number, a driver's licence or state ID number, a financial account or card number with the code that opens it, medical information held by a state agency or its contractor, and health insurance information.

A user name or email address together with a password or security question and answer that opens an online account also counts.

An individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted:

A user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The text sets no fixed number of days for a business. Notice must be given without unreasonable delay, allowing for law enforcement and for the steps needed to find the scope of the breach and restore the system.

Except as provided in section 4 or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system, the notice shall be made without unreasonable delay.

Who else must be told?

When more than 500 Pennsylvania residents must be told, notice goes to the Office of Attorney General at the same time.

When an entity notifies more than 500 people at one time, it must also tell the nationwide consumer reporting agencies without unreasonable delay.

When notice of the breach of the security of the system under this section must be given to more than 500 affected individuals in this Commonwealth, notice shall be made concurrently to the Office of Attorney General.

When an entity provides notification under this act to more than 500 persons at one time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis,

Is encrypted information treated differently?

Yes. Notice is about unencrypted and unredacted information. Encrypted information still counts if it is taken in unencrypted form, if the breach is linked to a breach of the encryption, or if it involves a person with access to the encryption key.

An entity must provide notice of the breach if encrypted information is accessed and acquired in an unencrypted form, if the security breach is linked to a breach of the security of the encryption or if the security breach involves a person with access to the encryption key.

What if a vendor holds the data?

A vendor that keeps data for another entity must tell that entity after the vendor discovers a breach. The entity then makes the decisions and carries out the remaining duties under the act.

A vendor that maintains, stores or manages computerized data on behalf of another entity shall provide notice of any breach of the security of the system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.