Ben Mishkin is quoted in Privacy Daily’s article discussing two data privacy bills passed by the Pennsylvania House. HB-78, introduced by Representative Ed Neilson, aims to give consumers more control over their personal data, especially in online transactions. The second bill, HB-997, would amend Pennsylvania’s data breach notification law to allow consumers to sue companies for damages resulting from data breaches. The bill was inspired by a breach at the East Coast convenience store chain, Wawa, and seeks to hold companies accountable for securing personal data. While only the attorney general can currently enforce violations, the bill would introduce a private right of action. The state Senate has until December 31, 2025, to act.

Ben noted that while HB-78 is “mostly consistent with predecessor consumer privacy laws in other states,” the law has some unique features. The bill would apply to businesses operating in Pennsylvania that meet certain thresholds, such as having $10 million in annual revenue or handling data from at least 50,000 consumers. “Businesses would be subject to the law just by virtue of doing business in [Pennsylvania] and hitting a monetary threshold,” said Ben. “This would make it the only law [besides the California Consumer Privacy Act (CCPA)] to make businesses subject to the law based on an economic threshold alone.” He added that the proposed $10 million threshold is lower than the CCPA’s $25 million requirement. HB-78 includes a broad definition of sensitive data and requires a consumer’s affirmative consent for processing such data. Ben believes the bill’s inclusion of Social Security numbers, drivers’ licenses, and state ID numbers as sensitive types of data is currently unique to California. Enforcement would be handled solely by the state attorney general, with a one-year delay before the law takes effect and a six-month grace period for businesses to comply.

To read more, click here (subscription required).