Bill Text: PA SB155 | 2009-2010 | Regular Session | Introduced

---

Bill Title: Further providing for notification of breach.

Spectrum: Slight Partisan Bill (Republican 22-11)

Status: (Engrossed - Dead) 2009-04-03 - Referred to STATE GOVERNMENT [SB155 Detail]

Download: Pennsylvania-2009-SB155-Introduced.html

---

PRINTER'S NO. 125
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 155 Session of2009
INTRODUCED BY PILEGGI, WONDERLING, FOLMER, KITCHEN, ROBBINS, TARTAGLIONE, STOUT, TOMLINSON, YAW, ORIE, EARLL, BOSCOLA, LOGAN, FONTANA, BAKER, KASUNIC, GORDNER, RAFFERTY, ERICKSON, O'PAKE, VANCE, WOZNIAK, ALLOWAY, PICCOLA, CORMAN AND BRUBAKER, JANUARY 30, 2009
REFERRED TO COMMUNICATIONS AND TECHNOLOGY, JANUARY 30, 2009
AN ACT
Amending the act of December 22, 2005 (P.L.474, No.94), entitled
"An act providing for the notification of residents whose
personal information data was or may have been disclosed due
to a security system breach; and imposing penalties," further
providing for notification of breach.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Section 3 of the act of December 22, 2005 (P.L.
474, No.94), known as the Breach of Personal Information
Notification Act, is amended by adding a subsection to read:
Section 3. Notification of breach.
* * *
(a.1) Notification by government entity.--If a State agency
or political subdivision is the subject of a breach of security
of the system, the State agency or political subdivision shall
provide notice of the breach of security of the system required
under subsection (a) within seven days following discovery of
the breach. Notification shall be provided to the Office of
Attorney General within three business days following discovery
of the breach. Notification shall occur regardless of the
existence of procedures and policies under section 7.
* * *
Section 2. The act is amended by adding a section to read:
Section 3.1. Investigation of breach involving a government
entity.
(a) Investigation.--Upon receipt of notification under
section 3(a.1), the Office of Attorney General shall investigate
the breach. The investigation shall include a review of
procedures, a determination of the cause of the breach and
recommendations to the agency relating to prevention of similar
breaches in the future.
(b) Cost.--The cost of the investigation shall be paid by
the agency in which the breach occurred.
Section 3. This act shall take effect in 60 days.
20090SB0155PN0125 - 2 -