Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: PA St. 73 P.S. § 2302 et seq.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

The term “personal information” means: (1) An individual’s first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted: (i) Social Security number. (ii) Driver’s license number or a state identification card number issued in lieu of a driver’s license. (iii) Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial account. (iv) Medical information. (v) Health insurance information. (vi) A user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.

core/separator

The term “breach of the security of the system” means the unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals and that causes or the entity reasonably believes has caused or will cause loss or injury to any resident of this commonwealth.

Good faith acquisition of personal information by an employee or agent of the entity for the purposes of the entity is not a breach of the security of the system if the personal information is not used for a purpose other than the lawful purpose of the entity and is not subject to further unauthorized disclosure.

Except for the law enforcement exception (See Security and Investigations Exceptions) or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system, the breach notice shall be made without unreasonable delay.

A breach notification may be delayed if a law enforcement agency determines and advises the entity in writing specifically referencing this breach notification law that the notification will impede a criminal or civil investigation. The notification required by this act shall be made after the law enforcement agency determines that it will not compromise the investigation or national or homeland security.

See Delivery Methods (content requirements for telephonic notices).

A breach notice may be provided by one of the following methods: (1) Written notice to the last known home address for the individual. (2) Telephonic notice, if the individual can be reasonably expected to receive the notice and it is given in a clear and conspicuous manner, describes the incident in general terms and verifies personal information but does not require the individual to provide personal information, and the individual is provided with a telephone number to call or Internet website to visit for further information or assistance. (3) Email notice, if a prior business relationship exists and the person or entity has a valid email address for the individual. (3) (i) Electronic notice, if the notice directs the person whose personal information has been materially compromised by a breach of the security of the system to promptly change the person's password and security question or answer, as applicable, or to take other steps appropriate to protect the person's online account to the extent the entity has sufficient contact information for the person (4)(i) Substitute notice, if the entity demonstrates one of the following: (A) The cost of providing notice would exceed $100,000. (B) The affected class of subject persons to be notified exceeds 175,000. (C) The entity does not have sufficient contact information.

Substitute notice shall consist of all of the following: (A) Email notice when the entity has an email address for the subject persons. (B) Conspicuous posting of the notice on the entity’s Internet website if the entity maintains one. (C) Notification to major Statewide media.

When an entity provides notification under this act to more than 1,000 persons at one time, the entity shall also notify, without unreasonable delay, all consumer reporting agencies of the timing, distribution, and number of notices.

A financial institution that complies with the notification requirements prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with this act.

An entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the entity’s primary or functional federal regulator shall be in compliance with this act.

A vendor that maintains, stores, or manages computerized data on behalf of another entity shall provide notice of any breach of the security system following discovery by the vendor to the entity on whose behalf the vendor maintains, stores, or manages the data. The entity shall be responsible for making the determinations and discharging any remaining duties under this law.

An entity must provide notice of the breach if encrypted information is accessed and acquired in an unencrypted form, if the security breach is linked to a breach of the security of the encryption or if the security breach involves a person with access to the encryption key.

Electronic notification: In the case of a breach of the security of the system involving personal information for a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account, the entity, to the extent that it has sufficient contact information for the person, may comply with this section by providing the breach of the security of the system notification in electronic or other form that directs the person whose personal information has been materially compromised by the breach of the security of the system to promptly change the person's password and security question or answer, as applicable or to take other steps appropriate to protect the online account with the entity and other online accounts for which the person whose personal information has been materially compromised by the breach of the security of the system uses the same user name or e-mail address and password or security question or answer.

Pennsylvania