What happens if your company faces a data breach in PA?
In 2024, Pennsylvania updated its Breach of Personal Information Notification Act (BPINA) to include a new reporting portal that makes reporting breaches easier and more efficient for covered entities. Effective September 26, 2024, those required to report a data breach can access the portal, which prompts the user through a few reporting questions such as information regarding the breach details, personal information, and an upload of any pertinent documents related to the breach for the PA Attorney General’s Office to review.
There were no changes to the “who” has to report, which as previously shared, includes PA individuals, public and private organizations, agencies and respective vendor parties of these covered entities that maintain a database of personal information about customers or constituents.
Businesses should pay attention to requirements like whether or not the breach affects more than 500 Pennsylvanians. In addition, if the breach involves the person’s name and Social Security Number, bank account number, or driver’s license or state ID number, companies must provide impacted individuals with 12 months of credit monitoring and access to a credit report.
Violations of the BPINA can result in penalties under the Pennsylvania Unfair Trade Practice and Consumer Protection Law. It’s important for covered entities to comply with BPINA and take steps to avoid legal action against them.
Please contact our Corporate, Business & Banking team if you’re unsure of your legal obligations and to clarify questions and responsibilities.
