Public Sector Alert
(by Michael Korns and Ember Holmes)
On Thursday, November 3, 2022, Governor Tom Wolf signed PA Senate Bill 696, also known as Act 151 of 2022 or the Breach of Personal Information Notification Act. Act 151 amends Pennsylvania’s existing Breach of Personal Information Notification Act, strengthening protections for consumers, and imposing stricter requirements for state agencies, state agency contractors, political subdivisions, and certain individuals or businesses doing business in the Commonwealth. Act 151 expands the definition of “personal information,” and requires Commonwealth entities to implement specific notification procedures in the event that a Commonwealth resident’s unencrypted and unredacted personal information has been, or is reasonably believed to have been, accessed and acquired by an unauthorized person. The requirements for state-level and local entities differ slightly; this Alert will address the impact of Act 151 on local entities. While this law does not take effect until May 22, 2023, it is critical that all entities impacted by this law be aware of these changes.
For the purposes of Act 151, the term “local entities” includes municipalities, counties, and public schools. The term “public school” encompasses all school districts, charter schools, intermediate units, cyber charter schools, and area career and technical schools. Act 151 requires that, in the event of a security breach of the system used by a local entity to maintain, store, or manage computerized data that includes personal information, the local entity must notify affected individuals within seven business days of the determination of the breach. In addition, local entities must notify the local district attorney of the breach within three business days.
The definition of “personal information” has been updated, and includes a combination of (1) an individual’s first name or first initial and last name, and (2) one or more of the following items, if unencrypted and unredacted:
- Social Security number;