{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Troutman Pepper Locke LLP"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Pennsylvania"]
["Key Legislation Overview"]
["What is the key legislation?"," Pennsylvania has no single comprehensive data privacy legislation. Rather, Pennsylvania has adopted several different laws addressing data privacy and related consumer protection issues. Important state laws relating to data privacy include Pennsylvania’s data breach notification statute and law relating to the privacy of social security numbers. Entities and persons in Pennsylvania also may have to comply with applicable Federal laws relating to data privacy and security. Relevant state laws relating to data privacy include Pennsylvania’s: \n\n \n\t Breach of Personal Information Notification Act (73 Pa. Stat. §2301, et. seq.); \n\t Statute prohibiting deceptive privacy policies (18 Pa. C.S. § 4107(a)(10)); \n\t Criminal History Record Information Act and other laws governing the use of criminal records (18 Pa. C.S. §9101 et. seq.); \n\t Statute protecting the privacy of social security numbers (71 Pa. Stat. §2601, et. seq.); and \n\t Unsolicited Telecommunication Advertisement Act (73 Pa. Stat. §2250.1, et seq.). \n \n\n Depending upon the nature of the data and the identity of the entity or person collecting, using and disclosing the data, entities and persons in Pennsylvania may also have to comply with United States Federal laws relating to data privacy and security. Potentially applicable Federal laws include laws relating to the collection, use and disclosure of health information (e.g., Health Insurance Portability and Accountability Act (\" HIPAA \"), the Genetic Information Nondiscrimination Act (\" GINA \") and regulations on the confidentiality of patient records relating to the treatment of substance abuse), financial information (e.g., Gramm-Leach-Bliley Act and the Fair Credit Reporting Act ), educational records (e.g., Family Educational Rights and Privacy Act ) and regulatory guidance regarding the privacy and security of personally identifiable information in general promulgated by the Federal Trade Commission (\" FTC \"). \n\n Entities should consult all relevant up-to-date state and federal laws when collecting, using and disclosing personally identifiable information in Pennsylvania, and continue to monitor developments at both the state and federal levels. \n"]
["Key Data Protection Provisions"]
["What data is protected?","The definition of protected data varies by statute.\nNote:\nData Breach Notification LawPennsylvania’s data breach notification statute defines “personal information” as an individual’s first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted: Social Security number; driver license number or state identification card number issued in lieu of a driver's license; or financial account number or credit card number or debit card number in combination with any required security code, access code or password that would permit access to an individual’s financial account. (\n73 Pa. Stat. § 2302).  “Personal information” does not include publicly available information that is lawfully made available to the general public from Federal, State, or local government records.  (73 Pa. Stat. §2302).\nCriminal History Record Information Act“Criminal history record information” under \nPennsylvania’s Criminal History Record Information Act means information collected by criminal justice agencies concerning individuals, and arising from the initiation of a criminal proceeding, consisting of identifiable descriptions, dates and notations of arrests, indictments, informations or other formal criminal charges and any dispositions arising therefrom. The term does not include intelligence information, investigative information or treatment information, including certain medical and psychological information, or information and records specified in \n18 Pa. C.S. §9104. (18 Pa. C.S. §9102).Laws Relating to Privacy of Social Security NumbersPennsylvania’s \nPrivacy of Social Security Numbers Law protects the privacy of individuals’ Social Security numbers. (\n71 Pa. State § 2601; 74 Pa. Stat § 201 et. seq.)\nFederal LawAs stated above, persons and entities collecting, using and disclosing personally identifiable information in Pennsylvania may also be subject to United States Federal laws applicable to the industry in which the person or entity operates or the type of data at issue (e.g., health information, financial information, educational records, and other personally identifiable information).\n"]
["Who is subject to privacy obligations?","Applicability varies by law. Laws may apply to all persons and entities doing business in Pennsylvania unless otherwise stated or to a specific subset of persons and entities such as employers.\nNote:\nData Breach Notification LawPennsylvania’s data breach notification statute applies to any agency or political subdivision of the Commonwealth of Pennsylvania, and individuals and entities doing business in Pennsylvania. (\n73 Pa. Stat. § 2302)\nCriminal History Record Information ActPennsylvania’s \nCriminal History Record Information Act applies to a board, commission or department of the Commonwealth and to employers. (18 Pa. C.S. §§9124 and 9125).\nCity of Philadelphia’s Criminal Records Screening StandardsThe \nCity of Philadelphia’s Criminal Records Screening Standards applies to any person, company, corporation, labor organization or association which employs any persons within the City of Philadelphia and agencies of the City of Philadelphia. (\nPhiladelphia Code, Title 9, Chapter 9-3502)\nLaws Relating to Privacy of Social Security NumbersPennsylvania’s\n Privacy of Social Security Numbers Law applies to all persons, entities, agencies and political subdivisions of the Commonwealth of Pennsylvania. (\n74 Pa. Stat. § 201(a))\n"]
["What are the principles applicable to personal data processing?","In general, personal data collection practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. Pennsylvania law also prescribes specific rules for the collection of criminal history data and Social Security numbers.\nAs stated above, persons and entities collecting, using and disclosing personally identifiable information in Pennsylvania may also be subject to United States Federal laws applicable to the industry in which the person or entity operates or the type of data at issue (e.g., health information, financial information, educational records, and other personally identifiable information).\nNote:\nAccuracy of Privacy PoliciesPersonal data collection practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. It is a violation of Pennsylvania law to knowingly make a false or misleading statement in a privacy policy, published on the Internet or otherwise distributed or published, regarding the use of personal information submitted by members of the public. (\n18 Pa. Stat. § 4107(a)(10)). Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law also makes it unlawful to engage in fraudulent or deceptive business conduct which creates a likelihood of confusion or of misunderstanding. (\n73 Pa. Stat. 201-2(4)(xxi)). Accordingly, an entity’s failure to adhere to the personal data collection practices described in its privacy policies can result in a violation of Pennsylvania law.\nCity of Philadelphia’s Criminal Records Screening StandardsPrivate employers in the City of Philadelphia are prohibited from inquiring about or requiring disclosure by an applicant for the employment of any prior arrest which is no longer pending and did not result in a conviction for a criminal offense unless specifically authorized by law. In addition, private employers in the City of Philadelphia are prohibited from inquiring about or requiring disclosure of an applicant’s previous criminal conviction from the time the applicant inquires about employment until the employer extends a conditional offer of employment (which can only be withdrawn under certain individualized circumstances). (\nPhiladelphia Code, Title 9, Chapter 9-3503 - 9-3504).Laws Relating to Privacy of Social Security NumbersPennsylvania law prohibits any person, entity or agency or political subdivision from requiring an individual to transmit his or her Social Security number over the Internet unless the connection is secure or the Social Security number is encrypted or to use his or Social Security number to access an Internet website unless a password or unique personal identification number or other authentication device is also required to access the website. (\n74 Pa. Stat. § 201(a)). Pennsylvania agencies and municipalities must provide any individual that is applying for or renewing a professional license or certification, occupational license or certification, or recreational license with the opportunity to submit a Pennsylvania driver’s license number in lieu of a Social Security number. (\n71 Pa. Stat. § 2603).\n"]
["How is the processing of personal data regulated?","In general, personal data use and disclosure practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. Pennsylvania law also prescribes specific rules for the use and disclosure of criminal history data and Social Security numbers.\nAs stated above, persons and entities collecting, using and disclosing personally identifiable information in Pennsylvania may also be subject to United States Federal laws applicable to the industry in which the person or entity operates or the type of data at issue (e.g., health information, financial information, educational records, and other personally identifiable information).\nNote:\nAccuracy of Privacy PoliciesPersonal data disclosure practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. It is a violation of Pennsylvania law to knowingly make a false or misleading statement in a privacy policy, published on the Internet or otherwise distributed or published, regarding the use of personal information submitted by members of the public. (\n18 Pa. Stat. § 4107(a)(10)). Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law also makes it unlawful to engage in fraudulent or deceptive business conduct which creates a likelihood of confusion or of misunderstanding. (\n73 Pa. Stat. 201-2(4)(xxi)). Accordingly, an entity’s failure to adhere to the personal data use and disclosure practices described in its privacy policies can result in a violation of Pennsylvania civil and criminal law.\nCriminal History Record Information ActFelony and misdemeanor convictions may be considered by an employer as part of the evaluation of an applicant only to the extent to which the convictions relate to the applicant’s suitability for employment in the position for which the individual has applied. An employer must notify the applicant in writing if the decision not to hire the applicant is based in whole or in part on criminal history record information. \n(18 Pa. C.S. §9125(b) and (c)).Laws Relating to Privacy of Social Security NumbersNo person, entity or agency or political subdivision of Pennsylvania may: (i) publicly post or publicly display an individual’s Social Security number in any manner; (ii) print an individual’s Social Security number on any card required for the individual to access products or services provided by the person, entity, or Pennsylvania agency or political subdivision; (iii) require an individual to transmit his or her Social Security number over the Internet unless the connection is secure or the Social Security number is encrypted; (iv) require an individual to use his or her Social Security number to access an Internet website unless a password or unique identifier or other authentication device is also required to access the website; (v) print an individual’s Social Security number on any materials that are mailed to the individual unless Federal or state law requires the Social Security number to be on the document to be mailed; or (vi) disclose in any manner, except to the agency issuing the license the Social Security number of an individual who applies for a recreational license. \n(74 Pa. Stat. § 201(a))"]
["How are storage, security and retention of personal data regulated?","In general, personal data storage, security and retention practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. In addition, failure to adhere to publicly represented personal data storage, security, and retention practices may constitute unfair or deceptive trade practices under the \nFederal Trade Commission Act (the \"\nFTC Act\").\nIn addition to the \nFTC Act, as stated above, persons and entities collecting, using and disclosing personally identifiable information in Pennsylvania may also be subject to United States Federal laws applicable to the industry in which the person or entity operates or the type of data at issue (e.g., health information, financial information, educational records, and other personally identifiable information).\nNote: Personal data storage, security and retention practices must be accurately represented in any privacy policy utilized by an entity in Pennsylvania. It is a violation of Pennsylvania law to knowingly make a false or misleading statement in a privacy policy, published on the Internet or otherwise distributed or published, regarding the use of personal information submitted by members of the public. (\n18 Pa. Stat. § 4107(a)(10)). Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law also makes it unlawful to engage in fraudulent or deceptive business conduct which creates a likelihood of confusion or of misunderstanding. (\n73 Pa. Stat. 201-2(4)(xxi)). Accordingly, an entity’s failure to adhere to the personal data storage, security and retention practices described in its privacy policies can result in a violation of Pennsylvania civil and criminal law.\nIn addition, the Federal Trade Commission has brought enforcement actions against entities for unfair and deceptive trade practices under the \nFTC Act as a result false or misleading statements regarding the security of personal data, failure to maintain “reasonable” security safeguards, and failure to comply with stated privacy policies. (See, e.g., \nFTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015); LabMD, Inc. v. Federal Trade Commission No. 16-16270 (11th Cir. 2018); In the matter of Snapchat, Inc., No. C-4501, December 23, 2014[LG1] ; In the matter of Cambridge Analytica, LLC, Docket No. 9383, November 25, 2019; United States v. Facebook, Inc., Case No. 19-cv-2184 (D.D.C. July 24, 2019); In the Matter of Flo Health, Inc., Docket No. 4747 (June 17, 2021). Finally, the National Institute of Standards and Technology (\"\nNIST\") published guidance providing considerations for managing cybersecurity and privacy risks for the “internet of things” (“\nIoT”) (i.e., web-connected devices) on June 25, 2019. NIST has updated these standards periodically as trends and industry standards change. Additionally, on May 12, 2021, \nExecutive Order 14028 tasked \nNIST with issuing guidance and identifying practices that enhance the security of the software supply chain and developing a multi-faceted initiative related to cybersecurity labeling for consumers, including labeling for IoT products.  On February 4, 2022, \nNIST recommended criteria for cybersecurity labeling on \nIoT products.  A summary report about cybersecurity labeling is expected in May 2022. While \nNIST is a non-regulatory agency, this published guidance will serve to inform the “reasonableness” standard included in many privacy and security laws and regulations[LG2] . For example, \nExecutive Order 14028 further directed the Secretary of Homeland Security to develop a standard set of operational procedures to be used in planning and conducting a cybersecurity vulnerability and incident response activity respecting Federal Civilian Executive Branch Agency Information Systems, which shall incorporate all appropriate \nNIST standards.\n"]
["What are the data subjects' rights?","There are no general Pennsylvania laws governing data subjects’ rights to access or correct their personal information. However, under the Inspection of \nEmployee Records Law (\"\nPersonnel Files Act\"), employers are required to provide employees access to personnel files used to determine the employee’s qualifications for employment, promotion, additional compensation, termination, or disciplinary action. \n(43 Pa. Stat. §1322) Under specified circumstances, the Bureau of Labor Standards of the Department of Labor and Industry may make and enforce an order providing access to the personnel files and the opportunity for an employee to place a counter statement in the employee's file, in the event an alleged error is determined by the employee.\n (43 Pa. Stat. §1324)."]
["Are there restrictions on cross-border data transfers?","Not currently under Pennsylvania law.\nNote: Yes. Pennsylvania’s data breach notification statute (“\nBreach Notification Statute”) is codified at \n73 Pa. Stat. §2301 et. seq."]
["Are there any notification requirements for data breaches?","Yes. Pennsylvania’s data breach notification statute (“\nBreach Notification Statute”) is codified at \n73 Pa. Stat. §2301 et. seq.Note:\nWhen Notice is RequiredAny state agency, a political subdivision of Pennsylvania or an individual or business in Pennsylvania (\"\nentity\") that maintains, stores or manages computerized data that includes personal information must provide notice of any breach of the security of the system following the discovery of the breach to any resident of Pennsylvania whose unencrypted and unredacted personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person. \n(73 Pa. Stat. §2303(a))“Personal information” is defined as an individual’s first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted: Social Security number; driver's license number or state identification card number issued in lieu of a driver's license; or account number or credit card number or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account. \n(73 Pa. Stat. §2302).“Breach of the security of the system” is defined as the unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals and that causes or the entity reasonably believes has caused or will cause loss or injury to any resident of Pennsylvania.\n (73 Pa. Stat. §2302).An entity must provide notice of the breach if encrypted information is accessed and acquired in an unencrypted form, if the security breach is linked to a breach of the security of the encryption or if the security breach involves a person with access to the encryption key. \n(73 Pa. Stat. §2303(b)).Timing of NoticeNotification must be made without unreasonable delay. \n(73 Pa. Stat. §2303(a)). The notification may be delayed if a law enforcement agency determines and advises the entity in writing specifically referencing the statute that the notification will impede a criminal or civil investigation. Notification must be made after the law enforcement agency determines that it will not compromise the investigation or national or homeland security. \n(73 Pa. Stat. §2304). Notice may be delayed if the entity takes measures necessary to determine the scope of the breach and to restore the reasonable integrity of the data system. \n(73 Pa. Stat. §2303(a)).Method of Notice DeliveryNotice may be provided: (i) in writing to the last known home address for the individual; or (ii) by telephone if the affected individual can reasonably be expected to receive it and the notice is given in a clear and conspicuous manner, describes the incident in general terms, and verifies personal information, but does not require the individual to provide personal information and the individual is provided with a telephone number to call or Internet website to visit for further information or assistance; or (iii) by email if a prior business relationship exists and the person or entity has a valid email address for the individual. Substitute notice may be given if the cost of providing notice would exceed $100,000, the number of affected individuals exceeds $175,000, or the entity does not have sufficient contact information.  Substitute notice must consist of email, conspicuous posting of the notice on the entity’s website and publication in major statewide media. \n(73 Pa. Stat. §2302).Notification to Consumer Reporting AgenciesIf notice is required to be given to more than 1,000 individuals at one time, the entity must also notify all national consumer reporting agencies of the timing, distribution and number of notices, without unreasonable delay. \n(73 Pa. Stat. §2305).PreemptionAn entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures or guidelines established by the entity’s primary or functional federal regulator will be in compliance with the \nBreach Notification Statute. Financial institutions that comply with the notification requirements of the Federal Interagency Response Programs for Unauthorized Access to Customer Information and Customer Notice are specifically deemed to be in compliance with the \nBreach Notification Statute.\nVendor ComplianceA vendor that maintains, stores or manages computerized data on behalf of another entity must provide notice of any breach of the security of the system following the discovery by the vendor to the entity on whose behalf the vendor maintains, stores or manages the data. The entity on whose behalf the data is being maintained, stored or managed is responsible for compliance with the \nBreach Notification Statute. \n(73 Pa. Stat. §2303(c))."]
["Who is the privacy regulator?","The Pennsylvania Attorney General is the state regulator charged with enforcing Pennsylvania privacy laws. Certain laws also provide individuals with the right to sue for violations.\nNote:\nData Breach Notification LawThe Pennsylvania Attorney General has exclusive jurisdiction over the enforcement of Pennsylvania’s data breach notification statute. (\n73 Pa. Stat. §2308)\nUnfair Trade Practices and Consumer Protection LawThe Pennsylvania Attorney General or appropriate District Attorney may bring civil actions for violations of Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law. (\n73 Pa. Stat. §\n201-8) \nPennsylvania’s Unfair Trade Practices and Consumer Protection Law also provide for a private right of action. (\n73 Pa. Stat. §\n201-9.2)\nCriminal History Record Information ActPennsylvania's Attorney General, or any other individual or agency, may institute an action in a court of proper jurisdiction against any person, agency, or organization to enjoin any criminal justice agency, noncriminal justice agency, organization or individual violating the provisions of the \nPennsylvania Criminal History Record Information Act or to compel such agency, organization or person to comply with the provisions of the \nPennsylvania Criminal History Record Information Act.  Any person aggrieved by a violation of the provisions of the \nPennsylvania Criminal History Record Information Act or of the rules and regulations promulgated thereunder may bring an action for damages by reason of such violation. (\n18 Pa. C.S. §9183). \nCity of Philadelphia Fair Criminal Record Screening StandardsThe Philadelphia Commission on Human Relations (“\nCommission”) enforces the City’s Fair \nCriminal Record Screening Standards. A private right of action exists if certain requirements are met (e.g., the \nCommission must have concluded, within one year after the filing of a complaint, that it has not found sufficient evidence of a violation to proceed further with an investigation or has not entered into a conciliation agreement to which the complainant is a party). \n(Philadelphia Code, Title 9, Chapter 9-3506).Inspection of Employee Records Law (Personnel Files Act)The \nDepartment of Labor and Industry's Bureau of Labor Standards—now known as “\nLabor Law Compliance”—is responsible for the enforcement of the provisions of the \nPersonnel Files Act. (43 Pa. Stat. §1324).Federal RegulatorsApplicable Federal regulators may include the Federal Trade Commission, the Federal Communications Commission, the Office of Civil Rights of the Federal Department of Health and Human Services and the Securities and Exchange Commission, depending on the applicable law.\n"]
["What are the consequences of a privacy breach?","Violators of Pennsylvania privacy laws may be subject to civil penalties of varying amounts, depending upon the statute that has been violated.\nNote:\nData Breach Notification Law/ Unfair Trade Practices and Consumer Protection LawA violation of Pennsylvania’s data breach notification law is deemed to be a breach of Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law. (\n73 Pa. Stat. §2308) Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law provides for a USD $1,000 civil penalty per violation or a USD $5,000 penalty per violation for any person who violates the terms of an injunction or any of the terms of an assurance of voluntary compliance. \n(73 Pa. Stat. §201-8).Any person who purchases or leases goods or services primarily for personal, family or household purposes and thereby suffers any ascertainable loss of money or property, real or personal, as a result of the use or employment by any person of a method, act or practice declared unlawful by Pennsylvania’s \nUnfair Trade Practices and Consumer Protection Law, may bring a private action, to recover actual damages or USD $100, whichever is greater. The court may, in its discretion, award up to three times the actual damages sustained, but not less than USD $100, and may provide such additional relief as it deems necessary or proper. The court may award to the plaintiff, in addition to other relief provided in this section, costs and reasonable attorney fees. (\n73 Pa. Stat. §\n201-9.2)\nPennsylvania Criminal History Record Information ActPennsylvania's Attorney General or any other individual or agency may institute an action in a court of proper jurisdiction against any person, agency or organization to enjoin any criminal justice agency, noncriminal justice agency, organization or individual violating the provisions of the \nPennsylvania Criminal History Record Information Act or to compel such agency, organization or person to comply with the provisions of the \nPennsylvania Criminal History Record Information Act.  Any person aggrieved by a violation of the provisions of the \nPennsylvania Criminal History Record Information Act may bring an action for damages by reason of such violation. A person found by a court to have been aggrieved by a violation of the \nPennsylvania Criminal History Record Information Act or related rules and regulations is entitled to actual and real damages of not less than USD $100 for each violation and to reasonable costs of litigation and attorney's fees. Exemplary and punitive damages of not less than USD $1,000 nor more than USD $10,000 shall be imposed for any willful violation. (\n18 Pa. C.S. §9183). \nCity of Philadelphia Fair Criminal Record Screening StandardsViolations of the City’s \nFair Criminal Record Screening Standards are punishable by a fine of up to USD $2,000 per violation. (\nPhiladelphia Code, Title 9, Chapter 9-3506; 1-109(3))\nRestrictions on Disclosure of Social Security NumbersViolations of Pennsylvania’s laws regarding the use and disclosure of Social Security numbers is a summary offense punishable by a fine of not less than USD $50 and not more than USD $500. Subsequent violations are punishable by a fine of not less than USD $500 and not more than USD $5,000. (\n74 Pa. Stat. §201(g)).\n"]
["How is electronic marketing regulated?"," Electronic marketing is subject to Pennsylvania’s Unfair Trade Practices and Consumer Protection Law and the  Unsolicited Telecommunication Advertisement Act . Entities and individuals may also have to comply with federal law applicable to electronic marketing. \n \n Note: \n\n Unfair Trade Practices and Consumer Protection Law \n\n Pennsylvania’s Unfair Trade Practices and Consumer Protection Law prohibits several enumerated “unfair or deceptive acts and practices,” including engaging in any fraudulent or deceptive conduct which creates a likelihood of confusion or of misunderstanding. Electronic marketing practices in Pennsylvania must not utilize such unfair or deceptive acts and practices. ( 73 Pa. Stat. §§201-2 and 201-3 ). \n\n Unsolicited Telecommunication Advertisement Act \n\n Pennsylvania’s Unsolicited Telecommunication Advertisement Act prohibits initiating a transmission or assisting a transmission of an unsolicited commercial electronic mail message if the email (i) uses a third party’s Internet domain in the return email address without permission of the third party; (ii) includes false or misleading information in the return address portion of the email, facsimile or wireless advertisement; (iii) contains false or misleading information in the subject line; or (iv) fails to contain a valid sender-operated return email address mechanism or toll-free telephone number that the recipient of the unsolicited documents may email or call. ( 73 Pa. Stat. §2250.3(a) ). \n\n Additionally, a covered mobile telephone messaging system may not be used to transmit an unsolicited commercial electronic mail message. (73 Pa. Stat. §2250.3(b)). \n\n Commercial electronic mail message means an electronic mail message sent for the purpose of promoting real property, goods, or services, but does not include an electronic mail transmission: (i) to which an interactive computer service has attached an advertisement in exchange for the free use of an electronic mail account when the sender has agreed to such an arrangement; or (ii) sent as a result of an established business relationship. ( 73 Pa. Stat. §2250.2 ). \n\n Recipients of such emails are permitted to bring actions under the Pennsylvania Unfair Trade Practices and Consumer Protection Law . Attorneys’ fees are also recoverable. For willful violations, civil penalties of up to $1,500,000 are recoverable. The Pennsylvania Attorney General may bring claims and recover civil penalties for violations of the law. ISPs are permitted to initiate actions to enjoin conduct and to recover penalties in the amount of no less than $1 or no more than $10 per violation. ( 73 Pa. Stat. §§2250.7 and 2250.8 ). \n\n Federal Law \n\n Individuals and entities in Pennsylvania also must comply with Federal laws regulating electronic marketing. Notably, the Federal CAN-SPAM Act prohibits false or misleading header information and deceptive subject lines in commercial emails and requires senders of such emails to identify them as ads and provide a valid physical address and opt-out mechanism in the ads. Opt-outs must be honored within 10 business days. Each separate email in violation of the  CAN-SPAM Act  is subject to penalties of up to USD $46,517 as of December 2021. (15 U.S.C. 7701 et. seq.; 16 C.F.R. §1.98).    The Federal Telephone Consumer Protection Act (\" TCPA \"), which is enforced by the Federal Communications Commission, generally prohibits sending text marketing messages to individuals without prior express consent. The TCPA provides for a private right of action and damages of up to USD $500 per violation. ( See 47 U.S.C. 227 et. seq. ) \n "]
["Are there any recent developments or expected reforms?","None are currently pending under Pennsylvania law. However, please note the nation and federal trends noted in the “\nKey Legislation Overview” above. \nNote: \nAs of February 2022, Pennsylvania has a number of key cybersecurity-related bills and amendments passing through its Legislature. \nSenate Bill 696 amends Pennsylvania’s \nBreach of Personal Information Notification Act, 73 Pa. Stat. §2301, et seq.  Among the amendments are adding “medical information,” “health insurance information,” and “a user name or email address in combination with a password or security question and answer that would permit access to an online account,” into the statutory definition of “Personal Information.”  Additionally, the bill would require any state agency, county, school district, or municipality that experiences a data breach to provide notification of the breach to affected individuals within seven days of the discovery of the breach.  It also would require an affected agency to notify Pennsylvania’s Attorney General within three days of the breach, and any affected county, school district, or municipality affected to notify the district attorney in the county where the breach occurred within three business days following the breach.\nSenate Bill 482 provides a full-scale reform of Pennsylvania’s state information technology, data security, and cybersecurity infrastructure, including the establishment of the Office of Information Technology (“\nOIT”) within the Governor’s Office of Administration. The \nOIT is designed to, among other things, consolidate information technology functions and powers vested in state agencies; provide, operate, and manage information technology services for each state agency under the Governor’s jurisdiction; and provide documentation and training related to information technology and cybersecurity.  It creates the position of the director of the \nOIT to perform and carry out a variety of cybersecurity and information technology-related functions for the \nOIT.  It also imposes criminal penalties for any person to purchase, attempt to purchase or attempt to procure any property or services of the \nOIT for private use or benefit.  If signed into law, \nSenate Bill 482 will be codified at \n71 Pa. C.S. §4301, et seq.Further, \nSenate Bill 726 is designed to prohibit, prevent, and detect ransomware attacks, as well as restore systems and captured information quickly after disruption, provide timely notice of ransomware attacks, and permit the pursuit and prosecution of ransomware perpetrators. In short, the bill defines “ransomware,” and makes it illegal to develop, use, possess, sell, or threaten to use ransomware in the Commonwealth. The bill also provides penalties for violations, ranging from first-degree misdemeanors to first-degree felonies based on how much money is being demanded in ransom. If signed into law, \nSenate Bill 726 will be codified at \n18 Pa. C.S. §7671, et seq.Entities should consult all relevant and up-to-date state and federal laws when collecting, using and disclosing personally identifiable information in Pennsylvania, and continue to monitor developments at both the state and federal levels.\n"]