Pennsylvania Makes Significant Changes to Its Data Breach Notification Law
On June 28, 2024, Pennsylvania Governor Josh Shapiro signed an amendment to Pennsylvania’s Breach of Personal Information Notification Act into law. The amended law, which includes significant changes to the Keystone State’s data breach notification law, goes into effect on September 26, 2024 . Below, we discuss the major changes set forth in the amended law. Modification to the Definition of “Personal Information” Pennsylvania law previously defined “personal information” as an individual’s first name or first initial with last name in combination with one or more of the following: Social Security number Driver’s license or identification card number Account number or credit or debit card number, in combination with a linked security or access code or the password of an individual’s financial account The amended law brings the following data elements within the definition of “personal information” as well: Medical information in the possession of a state agency or state agency...