THE GENERAL ASSEMBLY OF PENNSYLVANIA

SENATE BILL

INTRODUCED BY PILEGGI, SCARNATI, ORIE, COSTA, ERICKSON, BROWNE, FOLMER, PICCOLA, YAW, SMUCKER, RAFFERTY, D. WHITE, PIPPY, ALLOWAY, WARD, BOSCOLA, FARNESE, WILLIAMS, BRUBAKER, WASHINGTON, TOMLINSON, GORDNER, WAUGH, MENSCH, GREENLEAF, EARLL, BAKER AND KITCHEN, JANUARY 20, 2011

REFERRED TO COMMUNICATIONS AND TECHNOLOGY, JANUARY 20, 2011  

AN ACT

Amending the act of December 22, 2005 (P.L.474, No.94), entitled

"An act providing for the notification of residents whose

personal information data was or may have been disclosed due

to a security system breach; and imposing penalties," further

providing for notification of breach.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

Section 1.  Section 3 of the act of December 22, 2005 (P.L.

474, No.94), known as the Breach of Personal Information

Notification Act, is amended by adding a subsection to read:

Section 3.  Notification of breach.

* * *

(a.1)  Notification by government entity.--If a State agency

or political subdivision is the subject of a breach of security

of the system, the State agency or political subdivision shall

provide notice of the breach of security of the system required

under subsection (a) within seven days following discovery of

the breach. Notification shall be provided to the Office of

Attorney General within three business days following discovery

of the breach. Notification shall occur regardless of the

existence of procedures and policies under section 7.

* * *

Section 2.  The act is amended by adding a section to read:

Section 3.1.  Investigation of breach involving a government

entity.

(a)  Investigation.--Upon receipt of notification under

section 3(a.1), the Office of Attorney General shall investigate

the breach. The investigation shall include a review of

procedures, a determination of the cause of the breach and

recommendations to the agency relating to prevention of similar

breaches in the future.

(b)  Cost.--The cost of the investigation shall be paid by

the agency in which the breach occurred.

Section 3.  This act shall take effect in 60 days.