THE GENERAL ASSEMBLY OF PENNSYLVANIA

SENATE BILL

INTRODUCED BY PILEGGI, SCARNATI, ORIE, COSTA, ERICKSON, BROWNE, FOLMER, PICCOLA, YAW, SMUCKER, RAFFERTY, D. WHITE, PIPPY, ALLOWAY, WARD, BOSCOLA, FARNESE, WILLIAMS, BRUBAKER, WASHINGTON, TOMLINSON, GORDNER, WAUGH, MENSCH, GREENLEAF, EARLL, BAKER, KITCHEN, ROBBINS AND WOZNIAK, JANUARY 20, 2011

AS AMENDED ON SECOND CONSIDERATION, SEPTEMBER 20, 2011   

AN ACT

Amending the act of December 22, 2005 (P.L.474, No.94), entitled

"An act providing for the notification of residents whose

personal information data was or may have been disclosed due

to a security system breach; and imposing penalties," further

providing for notification of breach; and providing for

<--

investigation of breach involving a State agency, for

investigation of breach involving a county, school district

or municipality and for individuals responsible for breach.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

Section 1.  Section 3 of the act of December 22, 2005

(P.L.474, No.94), known as the Breach of Personal Information

Notification Act, is amended by adding a subsection subsections 

<--

to read:

Section 3.  Notification of breach.

* * *

(a.1)  Notification by government entity State agency.--If a

<--

State agency or political subdivision is the subject of a breach

<--

of security of the system, the State agency or political

<--

subdivision shall provide notice of the breach of security of

the system required under subsection (a) within seven days

following discovery of the breach. Notification shall be

provided to the Office of Attorney General within three business

days following discovery of the breach. Notification shall occur

regardless of the existence of procedures and policies under

section 7.

(a.2)  Notification by county, school district or

<--

municipality.--If a county, school district or municipality is

the subject of a breach of security of the system, the county,

school district or municipality shall provide notice of the

breach of security of the system required under subsection (a)

within seven days following discovery of the breach.

Notification shall be provided to the district attorney in the

county in which the breach occurred within three business days

following discovery of the breach. Notification shall occur

regardless of the existence of procedures and policies under

section 7.

* * *

Section 2.  The act is amended by adding a section sections 

<--

to read:

Section 3.1.  Investigation of breach involving a government

<--

entity State agency.

<--

(a)  Investigation.--Upon receipt of notification under

section 3(a.1), the Office of Attorney General shall investigate

the breach. The investigation shall include a review of

procedures, a determination of the cause of the breach and

recommendations to the agency relating to prevention of similar

breaches in the future.

(b)  Cost.--The cost of the investigation shall be paid by

the agency in which the breach occurred.

Section 3.2.  Investigation of breach involving a county, school

<--

district or municipality.

(a)  Investigation.--Upon receipt of notification under

section 3(a.2), the district attorney shall investigate the

breach. The investigation shall include a review of procedures,

a determination of the cause of the breach and recommendations

to the county, school district or municipality relating to

prevention of similar breaches in the future.

(b)  Cost.--The cost of the investigation under section

3(a.2) shall be paid by the county, school district or

municipality where the breach occurred.

(c)  Attorney General.--If the district attorney determines

that the breach of security of the system warrants an

investigation by the Office of Attorney General, the district

attorney may request that the Attorney General join or take over

the investigation.

Section 3.3.  Individuals responsible for breach.

Notwithstanding any other provision of this act, if a breach

of security of the system was caused by an intentional act or

misuse of the system or intentional unauthorized access to the

system, an individual determined by a court to be responsible

for the breach may be ordered by the court to pay for the cost

of the investigation and the cost of repairing and restoring the

system.

Section 3.  This act shall take effect in 60 days.