Amendments Expand Pennsylvania's Data Breach Notification Law

Businesses suffering a data breach affecting Pennsylvania residents may have new compliance obligations pursuant to a recent amendment to the Commonwealth's data breach notification law. Earlier this year, Pennsylvania lawmakers enacted a bill amending the state's Breach of Personal Information Notification Act (BPINA). Those changes came into effect on September 26 (the September Amendments) and represent the second update to BPINA in two years. The September Amendments contain several significant changes to the law, including imposing new obligations and reporting requirements on companies that have experienced a breach.

Required Notice to the Attorney General

Unlike the data breach reporting laws of many other states, BPINA had previously not imposed any requirement that the state Attorney General be notified in the event of a breach. That changed when the September Amendments came into effect—the AG must now be notified of any breach affecting more than 500