In our modern technological age, information continues to transition away from physical paperwork and become digitized. While the ability to access data electronically is convenient, not disposing of it carefully can be dangerous.
Confidential information can fall into the wrong hands and lead to theft of bank money, stolen identities, and other problems during a data breach. Organizations that handle such sensitive data have a responsibility to ensure that the information of their clients and customers is secure. To that end, many locations have enacted consumer protection laws and guidelines that individuals must follow, and Pennsylvania is no exception.
As of June 20, 2006, the Breach of Personal Information Notification Act went into effect in Pennsylvania. The Act encompasses a lot of facets and can be difficult to comprehend, given how many specifics and nuances there are. To learn more about this essential Act, here’s an overview of the Pennsylvania data breach notification law.
What Is the Pennsylvania Data Breach Notification Law?
According to the Breach of Personal Information Notification Act, any entity that maintains, stores, or manages computerized data, which includes sensitive information, has an obligation to notify individuals if a data breach materially compromises the security or confidentiality of their personal data. Anyone violation of this Act is considered unfair or deceptive, meaning it must be upheld for the safety of Pennsylvania citizens. There is much to unpack and define with this Act, so let’s review the specifics.
Who Must Follow Pennsylvania Data Privacy Laws?
Under the Pennsylvania data breach notification law, the entities that need to notify residents must meet three criteria: the information is stored, the data is computerized, and the stolen data is considered personal information.
Storing Data
Any company or individual that stores or manages data is considered an entity. If there is a breach of the security of the system they manage, it must be reported.
Computerized
The data stored must be digital and stored electronically. Written documents and paper records do not fall within the scope of the Act. However, this computerized data can be on either a physical device or in a cloud-based system.
Personal Info
The Pennsylvania data breach notification law only protects personal information, which includes an individual’s first name or initial and last name along with one of the following:
- Social Security Number
- Driver’s License Number
- Credit or Debit Card Number, or Other Forms of Financial Account Numbers
Although medical and legal data is incredibly sensitive, it does not fall within the confines of the Act. Further, any publicly available information that anyone can obtain isn’t protected either.
Lastly, personal information must be encrypted or redacted. Encryption involves converting data into a code which can then be received through a special key. It is commonly used as a means to safeguard confidential information.
How Do Pennsylvania Data Privacy Laws Define Breaches?
The Breach of Personal Information Notification Act has a specific definition for what it considers a breach. A breach involves unauthorized access and acquisition of confidential data. Note that for it to compromise the security of personal information, it must specifically be taken from the system.
Additionally, if it was reasonably believed to be a breach, it must still be reported. You may need to consult an expert to determine the scope of the breach. The sensitive material acquired during the breach must also be believed to inflict serious loss or injury.
Further, the information must be contained in a database along with the material of other individuals. Should the data be acquired from an email, for example, it will not count. Lastly, the person to whom the data belonged must be from the Commonwealth of Pennsylvania.
Reporting for the Pennsylvania Data Breach Notification Law
When all the criteria are met, the entity must report the breach with no unreasonable delay. Because losing personal information is an urgent matter, they must learn about it as soon as possible to take action. However, the reporting can be delayed should it prevent compromising investigations conducted by homeland security.
How many people were affected by the breach can also influence your response. Should the number of individuals exceed 1000, the Act would require you to notify all consumer reporting agencies that maintain the files of the time and distribution of the report. Additionally, there are certain things you should mention in the notification email written to an affected person. These details can include:
- The specific circumstances of the breach.
- What they can do to protect their identity.
- How they can reach your organization in the future.
- Other pertinent information.
Companies that offer data destruction services also handle sensitive information and must take care to follow the Act. At Keystone Technology Management, we’re dedicated to wiping devices so that your confidential information will be safe from third parties. You can also reach out to us to sell used IT equipment and for a variety of other services.