§ 2302. Definitions
Purdon's Pennsylvania Statutes and Consolidated StatutesTitle 73 P.S. Trade and CommerceEffective: June 20, 2006
Effective: June 20, 2006
73 P.S. § 2302
§ 2302. Definitions
The following words and phrases when used in this act shall have the meanings given to them in this section unless the context clearly indicates otherwise:
“Breach of the security of the system.” The unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information maintained by the entity as part of a database of personal information regarding multiple individuals and that causes or the entity reasonably believes has caused or will cause loss or injury to any resident of this Commonwealth. Good faith acquisition of personal information by an employee or agent of the entity for the purposes of the entity is not a breach of the security of the system if the personal information is not used for a purpose other than the lawful purpose of the entity and is not subject to further unauthorized disclosure.
“Business.” A sole proprietorship, partnership, corporation, association or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered or holding a license or authorization certificate under the laws of this Commonwealth, any other state, the United States or any other country, or the parent or the subsidiary of a financial institution. The term includes an entity that destroys records.
“Encryption.” The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.
“Entity.” A State agency, a political subdivision of the Commonwealth or an individual or a business doing business in this Commonwealth.
“Individual.” A natural person.
“Notice.” May be provided by any of the following methods of notification:
(1) Written notice to the last known home address for the individual.
(2) Telephonic notice, if the customer can be reasonably expected to receive it and the notice is given in a clear and conspicuous manner, describes the incident in general terms and verifies personal information but does not require the customer to provide personal information and the customer is provided with a telephone number to call or Internet website to visit for further information or assistance.
(3) E-mail notice, if a prior business relationship exists and the person or entity has a valid e-mail address for the individual.
(4)(i) Substitute notice, if the entity demonstrates one of the following:
(A) The cost of providing notice would exceed $100,000.
(B) The affected class of subject persons to be notified exceeds 175,000.
(C) The entity does not have sufficient contact information.
(ii) Substitute notice shall consist of all of the following:
(A) E-mail notice when the entity has an e-mail address for the subject persons.
(B) Conspicuous posting of the notice on the entity's Internet website if the entity maintains one.
(C) Notification to major Statewide media.
(1) An individual's first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted:
(i) Social Security number.
(ii) Driver's license number or a State identification card number issued in lieu of a driver's license.
(iii) Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account.
(2) The term does not include publicly available information that is lawfully made available to the general public from Federal, State or local government records.
“Records.” Any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed or electromagnetically transmitted. The term does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address or telephone number.
“Redact.” The term includes, but is not limited to, alteration or truncation such that no more than the last four digits of a Social Security number, driver's license number, State identification card number or account number is accessible as part of the data.
“State agency.” Any agency, board, commission, authority or department of the Commonwealth and the General Assembly.
2005, Dec. 22, P.L. 474, No. 94, § 2, effective in 180 days [June 20, 2006].
73 P.S. § 2302, PA ST 73 P.S. § 2302
Current through 2018 Regular Session Act 76
|End of Document||© 2018 Thomson Reuters. No claim to original U.S. Government Works.|