HB 78: An Act providing for consumer data privacy, for duties of controllers and for duties of processors; and imposing penalties. - Pennsylvania

Printer's No. PN1476 → Printer's No. PN3688 · 6 edits

MODERATE

The bill was amended to expand the number of consumers required for a company to be classified as a 'controller' from 50,000 to 100,000, thereby reducing the number of companies subject to the law. The Senate also added new sponsors, updated the printer's number, and inserted a controversial clause stating that the bill cannot be used to create a private right of action for individuals to sue for violations.

Scope change

The bill's scope was narrowed by increasing the consumer threshold for applicability, meaning fewer companies will be legally required to comply with its data privacy rules.

ELIGIBILITY

Increased the minimum number of consumers a company must handle annually to be considered a 'controller' under the law from 50,000 to 100,000.

ENFORCEMENT

Added a specific provision stating that the bill cannot be used to create a private right of action, preventing individuals from suing companies for violations.

DEFINITION

Added new sponsors to the bill, including Senators Inglis, Schlegel, Scott, M. Brown, Hanbidge, Pielli, and Munroe.

Updated the definition of 'biometric data' to explicitly list fingerprints, voiceprints, and eye retinas as examples.

Added 'Driver's License Number or State Identification Card Number' to the list of sensitive personal data.

REQUIREMENT

Added a requirement for controllers to refrain from processing personal data in violation of laws prohibiting unlawful discrimination against consumers.

Printer's No. PN1024 → Printer's No. PN1476 · 6 edits

MODERATE

The bill was updated to reflect its progression through the legislative process, adding new co-sponsors and recording a second committee amendment. Substantively, the bill now includes a new definition for 'Sensitive Data' covering specific categories like genetic information and precise geolocation. It also expands consumer rights to explicitly opt out of the sale of personal data and profiling for automated decisions, while adding a new section allowing consumers to designate an authorized agent to exercise these rights on their behalf.

Scope change

The bill's scope was expanded to include new exemptions for nonprofit organizations, institutions of higher education, and national securities associations, and it added specific exemptions for patient safety work product and credit reporting activities.

TIMELINE

The effective date was changed from a fixed date of January 1, 2026, to a relative date of one year after the act's effective date, providing more flexibility in implementation.

DEFINITION

A new definition for 'Sensitive Data' was added, listing specific categories such as racial origin, religious beliefs, mental or physical health conditions, genetic data, and precise geolocation that require higher protection.

REQUIREMENT

Consumers gained the explicit right to opt out of the sale of their personal data and profiling used for automated decisions that have legal or significant effects on them.

A new section allows consumers to designate an authorized agent to act on their behalf to exercise privacy rights, such as opting out of data processing.

New requirements for data processors were added, mandating that their contracts with controllers must clearly state processing instructions and include specific compliance obligations.

EXEMPTIONS

New exemptions were added for nonprofit organizations, colleges, securities associations, and specific uses like patient safety work product and credit reporting.

Printer's No. PN0065 → Printer's No. PN1024 · 6 edits

MODERATE

This bill update primarily clarifies and expands the definitions of 'biometric data' and 'processing' to include broader biological patterns and operational activities. It adds new exemptions for covered entities like financial institutions and healthcare providers, ensuring they are not subject to the bill's restrictions. The effective date for certain compliance requirements has been delayed to allow more time for organizations to prepare, and the Attorney General's enforcement process now includes a mandatory notice period before legal action can be taken.

Scope change

The bill's scope was expanded to include more types of biometric data and processing activities, while simultaneously narrowing its applicability by adding specific exemptions for financial institutions, healthcare entities, and other regulated industries.

DEFINITION

The definition of 'biometric data' was broadened to explicitly include unique biological patterns or characteristics used for identification, beyond just fingerprints and voiceprints.

The definition of 'processing' was updated to ensure it covers a comprehensive range of operations on personal data.

ELIGIBILITY

New exemptions were added for financial institutions, affiliates, and data subjects under the Gramm-Leach-Bliley Act, as well as covered entities and business associates under HIPAA.

TIMELINE

The effective date for specific compliance requirements was changed from a fixed calendar date to a relative date, delaying implementation by one year from the act's effective date.

ENFORCEMENT

The Attorney General must now issue a notice of violation and allow a 60-day cure period before initiating legal action for certain violations.

REQUIREMENT

New criteria were added for opt-out preference signals, requiring them to be consumer-friendly and consistent with other similar mechanisms.

An Act providing for consumer data privacy, for duties of controllers and for duties of processors; and imposing penalties.

What changed between versions

How they voted

Actions timeline

Sponsors