HB 78

                            SENATE AMENDED
PRIOR PRINTER'S NOS. 65, 1024, 1476  PRINTER'S NO.   3688
               THE GENERAL ASSEMBLY OF PENNSYLVANIA
                   HOUSE BILL
                   No. 78
                                             Session of
                                               2025
INTRODUCED BY NEILSON, SCIALABBA, HOWARD, MENTZER, LEADBETER,
   SANCHEZ, HILL-EVANS, GIRAL, FRANKEL, KHAN, ARMANINI, WARREN,
   FREEMAN, OTTEN, ZIMMERMAN, GILLEN, CIRESI, T. DAVIS,
   K. HARRIS, INGLIS, SCHLEGEL, SCOTT, M. BROWN, HANBIDGE,
   PIELLI AND MUNROE, JANUARY 14, 2025
SENATOR PENNYCUICK, COMMUNICATIONS AND TECHNOLOGY, IN SENATE,
   RE-REPORTED AS AMENDED, JUNE 24, 2026
                                AN ACT
1 Providing for consumer data privacy, for duties of controllers
2    and for duties of processors; and imposing penalties.
3    The General Assembly of the Commonwealth of Pennsylvania
4 hereby enacts as follows:
5 Section 1.   Short title.
6    This act shall be known and may be cited as the Consumer Data
7 Privacy Act.
8 Section 2.   Definitions.
9    The following words and phrases when used in this act shall
10 have the meanings given to them in this section unless the
11 context clearly indicates otherwise:
12    "Affiliate."   A legal entity that shares common branding with
13 another legal entity or controls, is controlled by or is under
14 common control with another legal entity.
15    "Biometric data."   Data generated by automatic measurements
1 of an individual's biological characteristics, including
2 fingerprints, voiceprints, eye retinas, irises or other unique
3 biological patterns or characteristics that are used to identify
4 a specific individual. The term does not include a digital or
5 physical photograph, an audio or video recording or any data
6 generated from a digital or physical photograph or an audio or
7 video recording. The term does not include information captured
8 and converted to a mathematical representation, including a
9 numeric string or similar method that cannot be used to recreate
10 the data captured or converted to create the mathematical
11 representation.
12    "Business associate."     As defined in 45 CFR 160.103 (relating
13 to definitions).  <--
14    "Child."     As defined in 15 U.S.C. § 6501 (relating to
15 definitions).
16    "Common branding."    A shared name, servicemark or trademark.
17    "Consent."     A clear affirmative act signifying a consumer's
18 freely given, specific, informed and unambiguous agreement to
19 allow the processing of personal data relating to the consumer.
20 The term includes a written statement, including by electronic
21 means, or any other unambiguous affirmative action specified in
22 this definition. The term does not include acceptance of general
23 or broad terms of use or a similar document that contains
24 descriptions of personal data processing along with other
25 unrelated information, hovering over, muting, pausing or closing
26 a given piece of content or an agreement obtained through the
27 use of dark patterns.
28    "Consumer."     An individual who is a resident of this
29 Commonwealth. The term does not include an individual acting in
30 a commercial or employment context or as an employee, owner,
20250HB0078PN3688  - 2 -
1 director, officer or contractor of a company, partnership, sole
2 proprietorship, nonprofit or government agency whose
3 communications or transactions with a controller occur solely
4 within the context of that individual's role with the company,
5 partnership, sole proprietorship, nonprofit or government
6 agency.
7    "Control."  Any of the following:
8(1)   Ownership of or the power to vote on more than 50%
9    of the outstanding shares of any class of voting security of
10    a controller.
11(2)   Control in any manner over the election of a
12    majority of the directors or over the individuals exercising
13    similar functions.
14(3)   The power to exercise a controlling influence over
15    the management of a company.
16    "Controller."  As follows:
17(1)   A sole proprietorship, partnership, limited
18    liability company, corporation, association or other legal
19    entity that meets all of the following criteria:
20(i)    Is organized or operated for the profit or
21financial benefit of its shareholders or other owners.
22(ii)    Alone or jointly with others, determines the
23purposes and means of the processing of consumers'
24personal information.
25(iii)    Does business in this Commonwealth.
26(iv)    Satisfies any of the following thresholds:
27(A)   Has annual gross revenues in excess of
28$10,000,000.
29(B)   Alone or in combination, annually buys or
30receives, sells or shares for commercial purposes,
20250HB0078PN3688  - 3 -
1alone or in combination, the personal information of
2at least 50,000 100,000 consumers, households or  <--
3devices.
4(C)    Derives at least 50% of annual revenues from
5selling consumers' personal information.
6(2)   An entity that controls a sole proprietorship,
7    partnership, limited liability company, corporation,
8    association or other legal entity under paragraph (1). or  <--
9    shares common branding with the sole proprietorship,
10    partnership, limited liability company, corporation,
11    association or other legal entity.
12    "Covered entity."      As defined in 45 CFR 160.103.
13    "Dark pattern."      A user interface designed or manipulated
14 with the substantial effect of subverting or impairing user
15 autonomy, decision making or choice, including a practice the
16 Federal Trade Commission refers to as a dark pattern.
17    "Decisions that produce legal or similarly significant
18 effects concerning the consumer."        Decisions made by a
19 controller that result in the provision or denial by the
20 controller of financial or lending services, housing, insurance,
21 education enrollment or opportunity, criminal justice,
22 employment opportunities, health care services or access to
23 essential goods or services.
24    "De-identified data."      Data that cannot reasonably be used to
25 infer information about, or otherwise be linked to, an
26 identified or identifiable individual or a device linked to the
27 individual, if the controller that possesses the data complies
28 with the following criteria:
29(1)   Takes reasonable measures to ensure that the data
30    cannot be associated with an individual.
20250HB0078PN3688  - 4 -
1(2)   Publicly commits to process the data only in a de-
2    identified fashion and not attempt to re-identify the data.
3(3)   Contractually obligates a recipient of the data to
4    satisfy the criteria specified under paragraphs (1) and (2).
5    "HIPAA."    The Health Insurance Portability and Accountability
6 Act of 1996 (Public Law 104-191, 110 Stat. 1936).
7    "Identified or identifiable individual."     An individual who
8 can be readily identified, directly or indirectly.
9    "Institution of higher education."     As defined in section
10 118(c) of the act of March 10, 1949 (P.L.30, No.14), known as
11 the Public School Code of 1949.
12    "Nonprofit organization."    An organization that is exempt
13 from taxation under 26 U.S.C. § 501(c)(3), (4), (6) or (12)
14 (relating to exemption from tax on corporations, certain trusts,
15 etc.).
16    "Personal data."    As follows:
17(1)   Any information that is linked or reasonably
18    linkable to an identified or identifiable individual.
19(2)   The term does not include publicly available
20    information, de-identified data or biometric data captured
21    and converted to a mathematical representation.
22    "Precise geolocation data."     Information derived from
23 technology, including global positioning system level latitude
24 and longitude coordinates or other mechanisms, that directly
25 identifies the specific location of an individual with precision
26 and accuracy within a radius of 1,750 feet. The term does not
27 include the content of communications, or any data generated by
28 or connected to advanced utility metering infrastructure systems
29 or equipment for use by a utility.
30    "Process" or "processing."     An operation or set of operations
20250HB0078PN3688  - 5 -
1 performed, whether by manual or automated means, on personal
2 data or on sets of personal data, including the collection, use,
3 storage, disclosure, analysis, deletion or modification of
4 personal data.
5    "Processing activities that present a heightened risk of harm
6 to a consumer."      The term includes any of the following:
7(1)   The processing of personal data for the purpose of
8    targeted advertising.
9(2)   The sale of personal data.
10(3)   The processing of personal data for the purpose of
11    profiling if the profiling presents a reasonably foreseeable
12    risk of any of the following:
13(i)    Unfair or deceptive treatment of, or an unlawful
14disparate impact on, a consumer.
15(ii)    Financial, physical or reputational injury to a
16consumer.
17(iii)    A physical or other intrusion upon the
18solitude or seclusion of a consumer or the private
19affairs or concerns of a consumer where the intrusion
20would be offensive to a reasonable person.
21(iv)    Any other substantial injury to a consumer.
22(4)   The processing of sensitive data.
23    "Processor."      An individual who, or legal entity that,
24 processes personal data on behalf of a controller.
25    "Profiling."      Any form of automated processing performed on
26 personal data to evaluate, analyze or predict personal aspects
27 related to an identified or identifiable individual's economic
28 situation, health, personal preferences, interests, reliability,
29 behavior, location or movements.
30    "Protected health information."       As defined in 45 CFR
20250HB0078PN3688  - 6 -
1 160.103.
2    "Pseudonymous data."    Personal data that cannot be attributed
3 to a specific individual without the use of additional
4 information if the additional information is kept separately and
5 is subject to appropriate technical and organizational measures
6 to ensure that the personal data is not attributed to an
7 identified or identifiable individual.
8    "Publicly available information."
9Information that:
10(1)     is lawfully available through Federal, State or
11    municipal records or widely distributed media; or
12(2)     a controller has a reasonable basis to believe a
13    consumer has lawfully made available to the general public.
14    "Sale of personal data."    The exchange of personal data for
15 monetary or other valuable consideration by a controller to a
16 third party. The term does not include any of the following:
17(1)     The disclosure of personal data to a processor that
18    processes the personal data on behalf of the controller.
19(2)     The disclosure of personal data to a third party for
20    the purpose of providing a product or service requested by a
21    consumer.
22(3)     The disclosure or transfer of personal data to an
23    affiliate of the controller.
24(4)     The disclosure of personal data when a consumer
25    directs the controller to disclose the personal data or
26    intentionally uses the controller to interact with a third
27    party.
28(5)     The disclosure of personal data that a consumer:
29(i)   intentionally made available to the general
30public via a channel of mass media; and
20250HB0078PN3688  - 7 -
1(ii)    did not restrict to a specific audience.
2(6)   The disclosure or transfer of personal data to a
3    third party as an asset that is part of a merger,
4    acquisition, bankruptcy or other transaction or a proposed
5    merger, acquisition, bankruptcy or other transaction, in
6    which the third party assumes control of all or part of the
7    controller's assets.
8    "Sensitive data."     Personal data that includes data revealing <--
9 any of the following:
10(1)   A racial or ethnic origin.
11(2)   Religious beliefs.
12(3)   Mental or physical health condition or diagnosis.
13(4)   Sex life or sexual orientation.
14(5)   Citizenship or immigration status.
15(6)   The processing of genetic or biometric data for the
16    purpose of uniquely identifying an individual.
17(7)   Personal data collected from a known child.
18(8)   Precise geolocation data.
19    "SENSITIVE DATA."     AS FOLLOWS:  <--
20(1)   PERSONAL DATA THAT INCLUDES DATA REVEALING ANY OF
21    THE FOLLOWING:
22(I)    A RACIAL OR ETHNIC ORIGIN.
23(II)    RELIGIOUS BELIEFS.
24(III)    MENTAL OR PHYSICAL HEALTH CONDITION OR
25DIAGNOSIS.
26(IV)    SEX LIFE OR SEXUAL ORIENTATION.
27(V)    CITIZENSHIP OR IMMIGRATION STATUS.
28(VI)    THE PROCESSING OF GENETIC OR BIOMETRIC DATA FOR
29THE PURPOSE OF UNIQUELY IDENTIFYING AN INDIVIDUAL.
30(VII)    PERSONAL DATA COLLECTED FROM A KNOWN CHILD.
20250HB0078PN3688  - 8 -
1(VIII)    PRECISE GEOLOCATION DATA.
2(IX)    SOCIAL SECURITY NUMBER.
3(X)    DRIVER'S LICENSE NUMBER OR A STATE
4IDENTIFICATION CARD NUMBER ISSUED IN LIEU OF A DRIVER'S
5LICENSE.
6(XI)    FINANCIAL ACCOUNT NUMBER, CREDIT OR DEBIT CARD
7NUMBER, IN COMBINATION WITH ANY REQUIRED SECURITY CODE,
8ACCESS CODE OR PASSWORD THAT WOULD PERMIT ACCESS TO AN
9INDIVIDUAL'S FINANCIAL ACCOUNT.
10(2)   THE TERM DOES NOT INCLUDE PUBLICLY AVAILABLE
11    INFORMATION THAT IS LAWFULLY MADE AVAILABLE TO THE GENERAL
12    PUBLIC FROM FEDERAL, STATE OR LOCAL GOVERNMENT RECORDS OR
13    WIDELY DISTRIBUTED MEDIA.
14    "Targeted advertising."     Displaying advertisements to a
15 consumer if the advertisement is selected based on personal data
16 obtained or inferred from the consumer's activities over time
17 and across nonaffiliated Internet websites or online
18 applications to predict the consumer's preferences or interests.
19 The term does not include any of the following:
20(1)   Advertisements based on activities within a
21    controller's own Internet websites or online applications.
22(2)   Advertisements based on the context of a consumer's
23    current search query, visit to an Internet website or online
24    application.
25(3)   Advertisements directed to a consumer in response to
26    the consumer's request for information or feedback.
27(4)   Processing personal data solely to measure or report
28    advertising frequency, performance or reach.
29    "Third party."     An individual or legal entity, including a
30 public authority, agency or body, other than a consumer,
20250HB0078PN3688  - 9 -
1 controller or processor or an affiliate of the processor or the
2 controller.
3    "Trade secret."       As defined in 12 Pa.C.S. § 5302 (relating to
4 definitions).
5 Section 3.     Consumer data privacy.
6    (a)   Rights of consumers.--A consumer shall have the right to
7 do the following:
8(1)   Confirm whether or not a controller is processing or
9    accessing the consumer's personal data, unless the
10    confirmation or access would require the controller to reveal
11    a trade secret.
12(2)   Correct inaccuracies in the consumer's personal
13    data, taking into account the nature of the personal data and
14    the purposes of the processing of the consumer's personal
15    data.
16(3)   Delete personal data provided by or obtained about
17    the consumer.
18(4)   Obtain a copy of the consumer's personal data
19    processed by a controller in a portable and, to the extent
20    technically feasible, readily usable format that allows the
21    consumer to transmit the data to another controller without
22    hindrance, where the processing is carried out by automated
23    means in a manner that would disclose the controller's trade
24    secrets.
25(5)   Opt out of the processing of the consumer's personal
26    data for the purpose of any of the following:
27(i)    Targeted advertising.
28(ii)    The sale of personal data, except as provided
29under section 5(b).
30(iii)    Profiling in furtherance of solely automated
20250HB0078PN3688  - 10 -
1decisions that produce legal or similarly significant
2effects concerning the consumer.
3    (b)   Exercise of rights.--A consumer may exercise the rights
4 under subsection (a) by a secure and reliable means established
5 by a controller and described to the consumer in the
6 controller's privacy notice. A consumer may designate an
7 authorized agent in accordance with section 4 to exercise the
8 consumer's right under subsection (a)(5) to opt out of the
9 processing of the consumer's personal data on behalf of the
10 consumer. For processing personal data of a known child, the
11 parent or legal guardian may exercise the consumer's rights
12 under subsection (a) on the child's behalf. For processing
13 personal data concerning a consumer subject to a guardianship,
14 conservatorship or other protective arrangement, the guardian or
15 the conservator of the consumer may exercise the consumer's
16 rights under subsection (a) on the consumer's behalf.
17    (c)   Compliance.--Except as otherwise provided in this act, a
18 controller shall comply with a request by a consumer to exercise
19 the consumer's rights under subsection (a) as follows:
20(1)   The controller shall respond to the consumer without
21    undue delay, but no later than 45 days after receipt of the
22    request. The controller may extend the response period under
23    this paragraph by an additional 45 days when reasonably
24    necessary, considering the complexity and number of the
25    consumer's requests, if the controller informs the consumer
26    of the extension within the initial 45-day response period
27    and the reason for the extension.
28(2)   If the controller declines to take action regarding
29    the consumer's request, the controller shall inform the
30    consumer without undue delay, but no later than 45 days after
20250HB0078PN3688  - 11 -
1  receipt of the request, of the justification for declining to
2  take action and instructions for how to appeal the decision.
3      (3)   Information provided in response to consumer
4  requests shall be provided by the controller, free of charge,
5  once per consumer during a 12-month period. If a request from
6  a consumer is manifestly unfounded, excessive or repetitive,
7  the controller may charge the consumer a reasonable fee to
8  cover the administrative costs of complying with the request
9  or decline to act on the request. The controller bears the
10  burden of demonstrating the manifestly unfounded, excessive
11  or repetitive nature of the request.
12      (4)   If a controller is unable to authenticate a request
13  to exercise a right afforded under subsection (a)(1), (2),
14  (3) or (4) using commercially reasonable efforts, the
15  controller shall not be required to comply with a request
16  under this subsection and shall provide notice to the
17  consumer that the controller is unable to authenticate the
18  request to exercise the right until the consumer provides
19  additional information reasonably necessary to authenticate
20  the consumer and the consumer's request to exercise the
21  right. A controller shall not be required to authenticate an
22  opt-out request under subsection (a)(5), but the controller
23  may deny an opt-out request if the controller has a good
24  faith, reasonable and documented belief that the request is
25  fraudulent. If a controller denies an opt-out request under
26  subsection (a)(5) because the controller believes the request
27  is fraudulent, the controller shall send a notice to the
28  person who made the request disclosing that the controller
29  believes the request is fraudulent, why the controller
30  believes the request is fraudulent and that the controller
20250HB0078PN3688  - 12 -
1    will not comply with the request.
2(5)   A controller that has obtained personal data about a
3    consumer from a source other than the consumer shall be
4    deemed in compliance with a consumer's request to delete the
5    personal data in accordance with subsection (a)(3) by
6    retaining a record of the deletion request and the minimum
7    data necessary for the purpose of ensuring that the
8    consumer's personal data remains deleted from the
9    controller's records and not using such retained data for any
10    other purpose in accordance with the provisions of this act
11    or opting the consumer out of the processing of the data for
12    any purpose except for those exempted under section 11(a)(3).
13    (d)   Appeals.--A controller shall establish a process for a
14 consumer to appeal the controller's refusal to take action on a
15 request by a consumer to exercise the consumer's rights under
16 subsection (a) within a reasonable period of time after the
17 consumer's receipt of the decision under subsection (c)(2). The
18 appeal process shall be conspicuously available and similar to
19 the process for submitting requests to initiate an action under
20 subsection (b). No later than 60 days after receipt of an
21 appeal, the controller shall inform the consumer in writing of
22 an action taken or not taken in response to the appeal,
23 including a written explanation of the reason for the decision.
24 If the appeal is denied, the controller shall also provide the
25 consumer with an online mechanism, if available, or other method
26 through which the consumer may contact the Attorney General to
27 submit a complaint.
28 Section 4.     Designation of authorized agent.
29    A consumer may designate another person to serve as the
30 consumer's authorized agent and act on the consumer's behalf to
20250HB0078PN3688  - 13 -
1 opt out of the processing of the consumer's personal data for
2 the purposes specified under section 3(a)(5). A controller shall
3 comply with an opt-out request received from an authorized agent
4 under section 3(a)(5) if the controller is able to verify, with
5 commercially reasonable effort, the identity of the consumer and
6 the authorized agent's authority to act on the consumer's
7 behalf.
8 Section 5.      Duties of controllers.
9    (a)    Duties.--A controller shall have all of the following
10 duties:
11(1)   Limit the collection of personal data to what is
12    adequate, relevant and reasonably necessary in relation to
13    the purposes for which the data is processed, as disclosed to
14    the consumer.
15(2)   Except as otherwise provided in this act, refrain
16    from processing personal data for purposes that are neither
17    reasonably necessary to, nor compatible with, the disclosed
18    purposes for which the personal data is processed, as
19    disclosed to the consumer, unless the controller obtains the
20    consumer's consent.
21(3)   Process personal data in a manner that ensures
22    reasonable and appropriate administrative, technical,
23    organizational and physical safeguards of personal data
24    collected, stored and processed.
25(4)   Refrain from processing sensitive data concerning a
26    consumer without obtaining the consumer's consent or, in the
27    case of the processing of sensitive data concerning a known
28    child, without processing the data, in accordance with 15
29    U.S.C. Ch. 91 (relating to children's online privacy
30    protection).
20250HB0078PN3688  - 14 -
1(5)   Refrain from processing personal data in violation
2    of a Federal or State law that prohibits unlawful
3    discrimination against a consumer.
4(6)   Provide an effective mechanism for a consumer to
5    revoke the consumer's consent that is at least as easy as the
6    mechanism by which the consumer provided the consumer's
7    consent and, upon revocation of the consent, cease to process
8    the data as soon as practicable, but no later than 15 days
9    after the receipt of the request.
10(7)   Refrain from processing the personal data of a
11    consumer for the purpose of targeted advertising or selling
12    the consumer's personal data without the consumer's consent
13    under circumstances where the controller has actual knowledge
14    and willfully disregards that the consumer is younger than 16
15    years of age.
16(8)   Refrain from discriminating against a consumer for
17    exercising any of the consumer rights under section 3(a),
18    including denying goods or services, charging different
19    prices or rates for goods or services or providing a
20    different level of quality of goods or services to the
21    consumer.
22    (b)   Construction.--Nothing in subsection (a) shall be
23 construed to require a controller to provide a product or
24 service that requires the personal data of a consumer that the
25 controller does not collect or maintain nor prohibit a
26 controller from offering a different price, rate, level, quality
27 or selection of goods or services to a consumer, including
28 offering goods or services for no fee, if the offering is in
29 connection with a consumer's voluntary participation in a bona
30 fide loyalty, rewards, premium features, discounts or club card
20250HB0078PN3688  - 15 -
1 program.
2    (c)     Privacy notice.--A controller shall provide a consumer
3 with a reasonably accessible, clear and meaningful privacy
4 notice that includes all of the following:
5(1)   The categories of personal data processed by the
6    controller.
7(2)   The purpose for processing personal data.
8(3)   How the consumer may exercise the consumer's rights,
9    including how the consumer may appeal the controller's
10    decision with regard to the consumer's request under section
11    3(d).
12(4)   The categories of personal data that the controller
13    shares with each third party.
14(5)   The categories of each third party with which the
15    controller shares personal data.
16(6)   An active email address or other online mechanism
17    that the consumer may use to contact the controller.
18    (d)     Disclosures.--If a controller sells personal data to a
19 third party or processes personal data for targeted advertising,
20 the controller shall clearly and conspicuously disclose the sale
21 or processing and the manner in which a consumer may exercise
22 the right to opt out of the sale or processing.
23    (e)     Means to exercise rights.--
24(1)   A controller shall establish and describe in the
25    privacy notice under subsection (c) a secure and reliable
26    means for consumers to submit a request to exercise the
27    consumer's rights under section 3(a). The secure and reliable
28    means under this paragraph shall take into account the manner
29    in which a consumer normally interacts with the controller,
30    the need for secure and reliable communication for the
20250HB0078PN3688  - 16 -
1  request and the ability of the controller to verify the
2  identity of the consumer making the request. A controller may
3  not require a consumer to create a new account in order to
4  exercise the consumer's rights under section 3(a), but may
5  require the consumer to use an existing account. The secure
6  and reliable means shall include all of the following:
7(i)    Providing a clear and conspicuous link on the
8      controller's Internet website to an Internet web page
9      that enables a consumer, or an agent of the consumer, to
10      opt out of the targeted advertising or sale of the
11      consumer's personal data under section 3(a)(5).
12(ii)    No later than January 1 of the year commencing
13      two years after the effective date of this subparagraph,
14      allowing a consumer to opt out of the processing of the
15      consumer's personal data for the purpose of targeted
16      advertising or the sale of the consumer's personal data
17      under section 3(a)(5) through an opt-out preference
18      signal sent, with the consumer's consent, by a platform,
19      technology or mechanism to the controller indicating the
20      consumer's intent to opt out of the processing or sale.
21      The platform, technology or mechanism shall comply with
22      all of the following criteria:
23(A)   Not unfairly disadvantage another
24controller.
25(B)   Not make use of a default setting, but
26instead require the consumer to make an affirmative,
27freely given and unambiguous choice to opt out of the
28processing or sale of the consumer's personal data.
29(C)   Be consumer friendly and easy to use by the
30average consumer.
20250HB0078PN3688  - 17 -
1(D)    Be as consistent as possible with any other
2similar platform, technology or mechanism required by
3a Federal or State law or regulation.
4(E)    Enable the controller to accurately
5determine whether the consumer is a resident of this
6Commonwealth and whether the consumer has made a
7legitimate request to opt out of processing or sale
8of the consumer's personal data.
9(F)    Be in compliance with this section. A
10controller that recognizes signals approved by other
11states shall be considered in compliance with this
12section.
13(iii)   If a consumer's decision to opt out of the
14      processing of the consumer's personal data for the
15      purpose of targeted advertising or the sale of the
16      consumer's personal data under section 3(a)(5) through an
17      opt-out preference signal sent under subparagraph (ii)
18      conflicts with the consumer's existing controller-
19      specific privacy setting or voluntary participation in a
20      controller's bona fide loyalty, rewards, premium
21      features, discounts or club card program, the controller
22      shall comply with the consumer's opt-out preference
23      signal, but may notify the consumer of the conflict and
24      provide to the consumer the choice to confirm the
25      controller-specific privacy setting or participation in
26      the program.
27      (2)   If a controller responds to a consumer's opt-out
28  request under paragraph (1)(i) by informing the consumer of a
29  charge for the use of a product or service, the controller
30  shall present the terms of a bona fide loyalty, rewards,
20250HB0078PN3688  - 18 -
1    premium features, discounts or club card program for the
2    retention, use, sale or sharing of the consumer's personal
3    data.
4 Section 6.     Duties of processors.
5    (a)   Assistance.--A processor shall adhere to the
6 instructions of a controller and shall assist the controller in
7 complying with the controller's duties under this act. The
8 assistance shall include all of the following:
9(1)   Taking into account the nature of processing and the
10    information available to the processor, by appropriate
11    technical and organizational measures, insofar as is
12    reasonably practicable, to fulfill the controller's duty to
13    comply with a request by a consumer to exercise the
14    consumer's rights under section 3(a).
15(2)   Taking into account the nature of processing and the
16    information available to the processor, by assisting the
17    controller in meeting the controller's duties in relation to
18    the security of processing the personal data and in relation
19    to the notification of a breach of security of the system of
20    the processor.
21(3)   Providing necessary information to enable the
22    controller to conduct and document data protection
23    assessments.
24    (b)   Contracts.--A contract between a controller and a
25 processor shall govern the processor's data processing
26 procedures with respect to processing performed on behalf of the
27 controller. The contract shall be binding and clearly state the
28 instructions for processing data, the nature and purpose of
29 processing, the type of data subject to processing, the duration
30 of processing and the rights and obligations of both parties.
20250HB0078PN3688  - 19 -
1 The contract shall also require that the processor comply with
2 all of the following:
3(1)   Ensure that each person processing personal data is
4    subject to a duty of confidentiality with respect to the
5    data.
6(2)   At the controller's direction, delete or return all
7    personal data to the controller as requested at the end of
8    the provision of services, unless retention of the personal
9    data is required by Federal or State law.
10(3)   Upon the reasonable request of the controller, make
11    available to the controller all information in the
12    processor's possession necessary to demonstrate the
13    processor's compliance with the provisions of this act.
14(4)   After providing the controller with an opportunity
15    to object, engage a subcontractor pursuant to a written
16    contract that requires the subcontractor to meet the
17    obligations of the processor with respect to the personal
18    data.
19(5)   Allow and cooperate with a reasonable assessment by
20    the controller or the controller's designated assessor, or
21    arrange for a qualified and independent assessor to conduct
22    an assessment of the processor's policies and technical and
23    organizational measures in support of the requirements under
24    this act, using an appropriate and accepted control standard
25    or framework and assessment procedure for the assessment. The
26    processor shall provide a report of the assessment to the
27    controller upon request.
28    (c)   Construction.--Nothing in this section shall be
29 construed to relieve a controller or processor from the
30 liabilities imposed on the controller or processor by virtue of
20250HB0078PN3688  - 20 -
1 the role of the controller or processor in the processing
2 relationship specified under this act.
3    (d)   Acting as controller or processor.--A determination of
4 whether a person is acting as a controller or processor with
5 respect to a specific processing of data shall be a fact-based
6 determination that depends upon the context in which personal
7 data is to be processed. The following shall apply:
8(1)   A person who is not limited in the person's
9    processing of personal data pursuant to a controller's
10    instructions or who fails to adhere to the instructions shall
11    be a controller and not a processor with respect to a
12    specific processing of data.
13(2)   A processor who continues to adhere to a
14    controller's instructions with respect to a specific
15    processing of personal data shall remain a processor.
16(3)   If a processor begins, alone or jointly with others,
17    determining the purposes and means of the processing of
18    personal data, the processor shall be a controller with
19    respect to the processing and may be subject to an
20    enforcement action under section 10.
21 Section 7.     Data protection assessment.
22    (a)   Assessment.--A controller shall conduct and document a
23 data protection assessment for each of the controller's
24 processing activities that present a heightened risk of harm to
25 a consumer.
26    (b)   Benefits and risks.--In conducting a data protection
27 assessment under subsection (a), a controller shall identify and
28 weigh the benefits that may flow, directly and indirectly, from
29 the processing to the controller, the consumer, other
30 stakeholders and the public against the potential risks to the
20250HB0078PN3688  - 21 -
1 consumer's rights under section 3(a) associated with the
2 processing, as mitigated by safeguards that can be employed by
3 the controller to reduce the risks. The controller shall factor
4 all of the following into the data protection assessment:
5(1)   The use of de-identified data.
6(2)   The reasonable expectations of the consumer.
7(3)   The context of the processing and the relationship
8    between the controller and the consumer whose personal data
9    will be processed.
10    (c)   Availability of assessments.--The Attorney General may
11 require a controller to disclose a data protection assessment
12 under subsection (a) that is relevant to an investigation
13 conducted by the Attorney General, and the controller shall make
14 the data protection assessment available to the Attorney
15 General. The Attorney General may evaluate a data protection
16 assessment for compliance with the provisions of this act. A
17 data protection assessment shall be confidential and exempt from
18 disclosure under 5 U.S.C. § 552 (relating to public information;
19 agency rules, opinions, orders, records, and proceedings) and
20 the act of February 14, 2008 (P.L.6, No.3), known as the Right-
21 to-Know Law. To the extent that information contained in a data
22 protection assessment disclosed to the Attorney General under
23 this subsection includes information subject to attorney-client
24 privilege or work product protection, the disclosure shall not
25 constitute a waiver of the privilege or protection.
26    (d)   Comparison of processing operations.--A single data
27 protection assessment under subsection (a) may address a
28 comparable set of processing operations that includes similar
29 activities.
30    (e)   Compliance.--If a controller conducts a data protection
20250HB0078PN3688  - 22 -
1 assessment for the purpose of complying with another applicable
2 Federal or State law or regulation, the data protection
3 assessment shall be deemed to satisfy the requirements under
4 this section if the data protection assessment is reasonably
5 similar in scope and effect to the data protection assessment
6 that would otherwise be conducted under this section.
7    (f)   Applicability.--The data protection assessment
8 requirements under this section shall apply to processing
9 activities created or generated after July 1 of the year
10 commencing one year after the effective date of this subsection
11 and shall not apply retroactively.
12 Section 8.     De-identified data and pseudonymous data.
13    (a)   Duties.--A controller in possession of de-identified
14 data shall have the following duties:
15(1)   Take reasonable measures to ensure that the de-
16    identified data cannot be associated with an individual.
17(2)   Publicly commit to maintaining and using de-
18    identified data without attempting to re-identify the data.
19(3)   Contractually obligate a recipient of the de-
20    identified data to comply with the provisions of this act.
21    (b)   Construction.--Nothing in this act shall be construed to
22 require a controller or processor to:
23(1)   require a controller or processor to re-identify de-
24    identified data or pseudonymous data;
25(2)   maintain data in identifiable form or collect,
26    obtain, retain or access data or technology in order to be
27    capable of associating an authenticated consumer rights
28    request under section 3(a); or
29(3)   comply with an authenticated consumer rights request
30    under section 3(a) if the controller:
20250HB0078PN3688  - 23 -
1(i)    is not reasonably capable of associating the
2request with the personal data, or it would be
3unreasonably burdensome for the controller to associate
4the request with the consumer's personal data;
5(ii)    does not use the personal data to recognize or
6respond to the specific consumer who is the subject of
7the personal data or does not associate the personal data
8with other personal data about the same specific
9consumer; and
10(iii)    does not sell the personal data to a third
11party or otherwise voluntarily disclose the personal data
12to a third party other than a processor, except as
13authorized under this section.
14(c)   Pseudonymous data.--The consumer rights specified under
15 section 3(a)(1), (2), (3) or (4) shall not apply to pseudonymous
16 data if a controller is able to demonstrate that any information
17 necessary to identify the consumer is kept separately and is
18 subject to effective technical and organizational controls that
19 prevent the controller from accessing the information.
20(d)   Oversight.--A controller that discloses pseudonymous
21 data or de-identified data shall exercise reasonable oversight
22 to monitor compliance with a contractual commitment to which the
23 pseudonymous data or de-identified data is subject and shall
24 take appropriate steps to address a breach of the contractual
25 commitment.
26 Section 9.      Exemptions on restrictions for controllers or
27processors.
28(a)   Legal compliance.--Nothing in this act shall be
29 construed to restrict the ability of a controller or processor
30 to:
20250HB0078PN3688  - 24 -
1      (1)    comply with Federal or State laws or local
2  ordinances or regulations;
3      (2)    comply with a civil, criminal or regulatory inquiry,
4  investigation, subpoena or summons by a Federal, State,
5  municipal or other governmental authority;
6      (3)    cooperate with a law enforcement agency concerning a
7  conduct or activity that the controller or processor
8  reasonably and in good faith believes may violate a Federal
9  or State law or local ordinance or regulation;
10      (4)    investigate, establish, exercise, prepare for or
11  defend legal claims;
12      (5)    provide a product or service specifically requested
13  by a consumer;
14      (6)    perform under a contract to which a consumer is a
15  party, including fulfilling the terms of a written warranty;
16      (7)    take steps at the request of a consumer prior to
17  entering into a contract;
18      (8)    take immediate steps to protect an interest that is
19  essential for the life or physical safety of a consumer or
20  another individual, including when processing cannot be
21  manifestly based on the provisions of this act;
22      (9)    prevent, detect, protect against or respond to a
23  security incident, identity theft, fraud, harassment,
24  malicious or deceptive activity or illegal activity, preserve
25  the integrity or security of a system or investigate, report
26  or prosecute an individual responsible for an incident
27  specified under this paragraph;
28      (10)    engage in public or peer-reviewed scientific or
29  statistical research in the public interest that adheres to
30  all other applicable Federal or State ethics and privacy laws
20250HB0078PN3688  - 25 -
1    and is approved, monitored and governed by an institutional
2    review board or a similar independent oversight entity that
3    determines whether:
4(i)    the deletion of information is likely to provide
5substantial benefits to the research that do not
6exclusively accrue to the controller;
7(ii)    the expected benefits of the research outweigh
8the privacy risks; and
9(iii)    the controller has implemented reasonable
10safeguards to mitigate privacy risks associated with the
11research, including risks associated with re-
12identification;
13(11)    assist another controller, processor or third party
14    with any of the requirements under this act; or
15(12)    process personal data for reasons of public
16    interest in the area of public health, community health or
17    population health, but solely to the extent that the
18    processing is:
19(i)    subject to suitable and specific measures to
20safeguard the rights of the consumer whose personal data
21is being processed; and
22(ii)    under the responsibility of a professional
23subject to confidentiality obligations under Federal or
24State law or local ordinance.
25    (b)   Data collection.--The requirements imposed on a
26 controller or processor under this act shall not restrict the
27 ability of a controller or processor to collect, use or retain
28 data for internal use for any of the following purposes:
29(1)    Conducting internal research to develop, improve or
30    repair products, services or technology.
20250HB0078PN3688  - 26 -
1(2)   Effectuating a product recall.
2(3)   Identifying and repairing technical errors that
3    impair existing or intended functionality.
4(4)   Internal operations that are reasonably aligned with
5    the expectations of a consumer or reasonably anticipated
6    based on the consumer's existing relationship with the
7    controller or are otherwise compatible with processing data
8    in furtherance of the provision of a product or service
9    specifically requested by a consumer.
10    (c)   Evidentiary privilege.--The requirements imposed on a
11 controller or processor under this act shall not apply if
12 compliance by the controller or processor with requirements
13 would violate an evidentiary privilege under the laws of this
14 Commonwealth. Nothing in this act shall be construed to prevent
15 a controller or processor from providing personal data
16 concerning a consumer to an individual covered by an evidentiary
17 privilege under the laws of this Commonwealth as part of a
18 privileged communication.
19    (d)   Third parties.--A controller or processor that discloses
20 personal data to a third-party controller or third-party
21 processor in accordance with this act shall not be deemed to
22 have violated the provisions of this act if the third-party
23 controller or third-party processor violates the provisions of
24 this act if, at the time of the disclosure, the disclosing
25 controller or processor did not have actual knowledge that the
26 third-party controller or third-party processor would violate
27 the provisions of this act. A third-party controller or third-
28 party processor who receives personal data under this subsection
29 in accordance with this act shall not be deemed to have violated
30 the provisions of this act for a violation by the disclosing
20250HB0078PN3688  - 27 -
1 controller or processor.
2    (e)   Individual liberties.--Nothing in this act shall be
3 construed to:
4(1)   impose an obligation on a controller or processor
5    that adversely affects the rights or freedoms of an
6    individual, including the freedom of speech or freedom of the
7    press guaranteed in the First Amendment to the Constitution
8    of the United States or section 7 of Article I of the
9    Constitution of Pennsylvania; or
10(2)   apply to an individual's processing of personal data
11    in the course of the individual's purely personal or
12    household activities.
13    (f)   Personal data.--
14(1)   Personal data processed by a controller may be
15    processed to the extent that the processing meets all of the
16    following criteria:
17(i)    Is reasonably necessary and proportionate to the
18purposes specified under this section.
19(ii)   Is adequate, relevant and limited to what is
20necessary in relation to the specific purposes specified
21under this section.
22(2)   A controller or processor that collects, uses or
23    retains personal data under subsection (b) shall, when
24    applicable, take into account the nature and purpose of the
25    collection, use or retention of the personal data. The
26    personal data under subsection (b) shall be subject to
27    reasonable administrative, technical and physical measures to
28    protect the confidentiality, integrity and accessibility of
29    the personal data and reduce reasonably foreseeable risks of
30    harm to a consumer related to the collection, use or
20250HB0078PN3688  - 28 -
1    retention of the personal data.
2    (g)   Exemptions.--If a controller processes personal data in
3 accordance with an exemption under this section, the controller
4 shall be responsible for demonstrating that the processing
5 qualifies for the exemption and complies with the requirements
6 under subsection (f).
7    (h)   Legal entities.--The processing of personal data for the
8 purposes expressly specified under this section shall not solely
9 make a legal entity a controller with respect to the processing.
10 Section 10.     Penalties, enforcement and private rights of
11action.
12    (a)   Enforcement.--The Attorney General shall have exclusive
13 authority to enforce the provisions of this act. The following
14 shall apply:
15(1)   During the period beginning January 1 and ending
16    July 1 of the year commencing one year after the effective
17    date of this paragraph, the Attorney General shall, prior to
18    initiating an action for a violation of a provision of this
19    act, issue a notice of violation to the controller or
20    processor if the Attorney General determines that a cure is
21    possible. If the controller fails to cure the violation
22    within 60 days of receipt of the notice of violation, the
23    Attorney General may initiate an action under this section.
24(2)   Beginning January 1 of the year commencing one year
25    after the effective date of this paragraph, the Attorney
26    General may, in determining whether to grant a controller or
27    processor the opportunity to cure an alleged violation under
28    paragraph (1), consider all of the following:
29(i)    The number of violations.
30(ii)    The size and complexity of the controller or
20250HB0078PN3688  - 29 -
1processor.
2(iii)    The nature and extent of the processing
3activities of the controller or processor.
4(iv)    The substantial likelihood of injury to the
5public.
6(v)    The safety of persons or property.
7(vi)    Whether the alleged violation was likely caused
8by human or technical error.
9(3)   The right to cure shall apply for 60 days.
10    (b)   Private rights of action.--Nothing NOTWITHSTANDING ANY  <--
11 OTHER PROVISION OF LAW, NOTHING in this act shall be construed
12 as providing the basis for a TO CREATE, BE USED FOR THE BASIS OR <--
13 PREDICATE FOR OR OTHERWISE GIVE RISE TO ANY private right of
14 action for a violation of the provisions of this act.
15    (c)   Unfair trade practice.--Violations of the provisions of
16 this act shall constitute "unfair methods of competition" and
17 "unfair or deceptive acts or practices" under the act of
18 December 17, 1968 (P.L.1224, No.387), known as the Unfair Trade
19 Practices and Consumer Protection Law, and shall be enforced
20 exclusively by the Attorney General.
21    (d)   Regulations.--The Attorney General shall promulgate
22 regulations necessary to implement this section.
23 Section 11.     Nonapplicability, exemption and consent.
24    (a)   Nonapplicability.--This act shall not apply to any of
25 the following:
26(1)   The Commonwealth or any of its political
27    subdivisions.
28(2)   A nonprofit organization.
29(3)   An institution of higher education.
30(4)   A national securities association that is registered
20250HB0078PN3688  - 30 -
1    under 15 U.S.C. § 78o-3 (relating to registered securities
2    associations).
3(5)   A financial institution or an affiliate of a
4    financial institution or data subject to Title V of the
5    Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.).
6(6)   A covered entity or business associate.
7    (b)   Exemptions.--The following shall be exempt from the
8 provisions of this act:
9(1)   Protected health information under HIPAA.
10(2)   Patient-identifying information for purposes of 42
11    U.S.C. § 290dd-2 (relating to confidentiality of records).
12(3)   Identifiable private information for purposes of the
13    Federal policy for the protection of human subjects under 45
14    CFR Subt. A Subch. A Pt. 46 (relating to protection of human
15    subjects).
16(4)   Identifiable private information that is otherwise
17    information collected as part of human subjects research in
18    accordance with the good clinical practice guidelines issued
19    by the International Council for Harmonisation of Technical
20    Requirements for Pharmaceuticals for Human Use on the
21    effective date of this paragraph.
22(5)   The protection of human subjects under 21 CFR Ch. I
23    Subch. A Pt. 50 (relating to protection of human subjects) or
24    56 (relating to institutional review boards) or personal data
25    used or shared in research, as defined in 45 CFR 164.501
26    (relating to definitions), that is conducted in accordance
27    with the standards specified under this subsection or other
28    research conducted in accordance with applicable Federal or
29    State law.
30(6)   Information and documents created for the purposes
20250HB0078PN3688  - 31 -
1  of 42 U.S.C. Ch. 117 (relating to encouraging good faith
2  professional review activities).
3      (7)    Patient safety work product for the purposes of 42
4  U.S.C. Ch. 6A Subch. VII Pt. C (relating to patient safety
5  improvement).
6      (8)    Information derived from any of the health-care-
7  related information exempt under this subsection that is de-
8  identified in accordance with the requirements for de-
9  identification under HIPAA.
10      (9)    Information originating from and intermingled to be
11  indistinguishable with, or information treated in the same
12  manner as, information exempt under this subsection that is
13  maintained by a covered entity or business associate, program
14  or qualified service organization as specified in 42 U.S.C. §
15  290dd-2.
16      (10)    Information used for public health activities and
17  purposes as authorized by HIPAA, community health activities
18  and population health activities.
19      (11)    The collection, maintenance, disclosure, sale,
20  communication or use of personal information bearing on a
21  consumer's credit worthiness, credit standing, credit
22  capacity, character, general reputation, personal
23  characteristics or mode of living by a consumer reporting
24  agency, furnisher or user that provides information for use
25  in a consumer report or by a user of a consumer report, but
26  only to the extent that the activity is regulated by and
27  authorized under 15 U.S.C. Ch. 41 Subch. III (relating to        <--
28  credit reporting agencies) THE FAIR CREDIT REPORTING ACT  <--
29  (PUBLIC LAW 91-508, 15 U.S.C. § 1681 ET SEQ.).
30      (12)    Personal data collected, processed, sold or
20250HB0078PN3688  - 32 -
1  disclosed in compliance with 18 U.S.C. Ch. 123 (relating to      <--
2  prohibition on release and use of certain personal
3  information from state motor vehicle records) THE DRIVER'S       <--
4  PRIVACY PROTECTION ACT OF 1994 (PUBLIC LAW 103-322, 18 U.S.C.
5  § 2721 ET SEQ.).
6      (13)    Personal data regulated by 20 U.S.C. Ch. 31 Subch.
7  III Pt. 4 (relating to records; privacy; limitation on
8  withholding Federal funds).
9      (14)    Personal data collected, processed, sold or
10  disclosed in compliance with 12 U.S.C. Ch. 23 (relating to
11  farm credit system).
12      (15)    Data processed or maintained:
13(i)    in the course of an individual applying to,
14      employed by or acting as an agent or independent
15      contractor of a controller, processor or third party to
16      the extent that the data is collected and used within the
17      context of that role;
18(ii)    as the emergency contact information of an
19      individual specified under this act and used for
20      emergency contact purposes; or
21(iii)    as necessary to administer benefits for
22      another individual related to an individual who is the
23      subject of the information under paragraph (1) and used
24      for the purposes of administering the benefits.
25      (16)    Personal data collected, processed, sold or
26  disclosed in relation to price, route or service by an air
27  carrier under 49 U.S.C. Subt. VII Pt. A. Subpt. I Ch. 401
28  (relating to general provisions) to the extent preempted
29  under 49 U.S.C. § 41713 (relating to preemption of authority
30  over prices, routes, and service).
20250HB0078PN3688  - 33 -
1(17)   PERSONAL DATA COLLECTED AND USED FOR PURPOSES OF   <--
2    THE FEDERAL POLICY DEVELOPED UNDER 21 U.S.C. § 830 (RELATING
3    TO REGULATION OF LISTED CHEMICALS AND CERTAIN MACHINES).
4    (c)   Parental consent.--A controller or processor that
5 complies with the verifiable parental consent requirements under
6 15 U.S.C. Ch. 91 (relating to children's online privacy
7 protection) shall be deemed compliant with an obligation to
8 obtain parental consent under this act.
9 Section 12.     Effective date.
10    This act shall take effect in one year.
20250HB0078PN3688  - 34 -