Did You Know?

• There is a detailed list which governs what is considered “personally identifiable information”
• There are specific considerations when determining if a breach is reportable in Pennsylvania
• There are comprehensive requirements for information to be included in notifications
• Notifications may only be given by specific methods
• If your breach affects residents in other states you will need to notify those residents using that state’s rules
• There are vendor-specific notification requirements
• There are notification requirements for consumer reporting agencies in certain circumstances
• A violation of the Breach of Personal Information Notification Act shall be deemed to be an unfair or deceptive act or practice under the Unfair Trade Practices and Consumer Protection Law, of which the Office of Attorney General shall have exclusive authority to bring an action for violation
• Federal laws, industry regulations, and/or out-of-country laws may also apply