Pennsylvania HB 997: An Act amending the act of December 22, 2005 (P.L.474, No.94), known as the Breach of Personal Information Notification Act, further providing for definitions, for notification of the breach of the security of the system, for exceptions and for notice exemption; repealing provisions relating to civil relief; providing for protection of personal information, for civil relief, for information security and for applicability; and repealing provisions relating to applicability.

Bill Text

PRIOR PRINTER'S NOS. 1086, 1621 PRINTER'S NO. 2381
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 997
Session of
2025
INTRODUCED BY SOLOMON, HILL-EVANS, CERRATO, HOWARD, FREEMAN,
KAZEEM, GIRAL, GUENST, MERSKI, CEPEDA-FREYTIZ, PIELLI,
SANCHEZ, D. WILLIAMS, CIRESI, STEELE, SHUSTERMAN, DEASY,
GREEN, DALEY, GILLEN, RIVERA, WEBSTER AND MADSEN,
MARCH 24, 2025
AS AMENDED ON SECOND CONSIDERATION, HOUSE OF REPRESENTATIVES,
SEPTEMBER 30, 2025
AN ACT
Amending the act of December 22, 2005 (P.L.474, No.94), entitled
"An act providing for security of computerized data and for
the notification of residents whose personal information data
was or may have been disclosed due to a breach of the
security of the system; and imposing penalties," further
providing for definitions, for notification of the breach of
the security of the system, for exceptions and for notice
exemption; repealing provisions relating to civil relief;
providing for protection of personal information, for civil
relief, for information security and for applicability; and
repealing provisions relating to applicability.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. The definitions of "breach of the security of the
system," "business," "encryption," "notice" and "personal
information" in section 2 of the act of December 22, 2005
(P.L.474, No.94), known as the Breach of Personal Information
Notification Act, amended June 28, 2024 (P.L.427, No.33), are
amended and the section is amended by adding definitions to
read:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

Section 2. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Access device." A card issued by a financial institution
that contains a magnetic stripe, microprocessor chip or other
means for storage of information, including a credit card, debit
card or stored value card.
"Breach of the security of the system." The unauthorized
access and acquisition of computerized data that materially
compromises the security or confidentiality of personal
information maintained by the entity as part of a database of
personal information regarding multiple individuals and that
causes or the entity reasonably believes has caused or will
cause loss or injury to any resident of this Commonwealth. [Good
faith acquisition of personal information by an employee or
agent of the entity for the purposes of the entity is not a
breach of the security of the system if the personal information
is not used for a purpose other than the lawful purpose of the
entity and is not subject to further unauthorized disclosure.]
The term does not include good faith acquisition of personal
information by an employee or agent of the entity for the
purposes of the entity if the personal information is not used
for a purpose other than the lawful purpose of the entity and is
not subject to further unauthorized disclosure.
"Business." A sole proprietorship, partnership, corporation,
association or other group, however organized and whether or not
organized to operate at a profit.[, including a financial
institution organized, chartered or holding a license or
authorization certificate under the laws of this Commonwealth,
20250HB0997PN2381 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

any other state, the United States or any other country, or the
parent or the subsidiary of a financial institution.] The term
includes an entity that destroys records. The term does not
include a financial institution.
"Card security code." The three-digit or four-digit value
printed on an access device or contained in the microprocessor
chip or magnetic stripe of an access device that is used to
validate access device information during the authorization
process.
* * *
"Encryption." The use of an algorithmic process to transform
data into a form [in] which [there is] has a low probability of
assigning meaning without use of a confidential process or key.
"Encryption key." The confidential key or process designed
to render the encrypted personal information useable, readable
and decipherable.
* * *
"Financial institution." An office of a bank, bank and
trust, trust company with banking powers, savings bank,
industrial loan company, savings association, credit union or
regulated lender.
* * *
"Identity theft." The possession and use, by a person,
through any means, of identifying information of another person
without consent of the other person to further an unlawful
purpose.
* * *
"Magnetic stripe data." The data contained in the magnetic
stripe of an access device.
* * *
20250HB0997PN2381 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

"Notice." [May be provided by any of the following methods
of notification] As follows:
(1) Written notice to the last known home address for
the individual.
(2) Telephonic noti