SB 1396

                                                    PRINTER'S NO.   1887
                THE GENERAL ASSEMBLY OF PENNSYLVANIA
                   SENATE BILL
                   No. 1396
                                           Session of
                                             2026
INTRODUCED BY CAPPELLETTI, COLLETT, COSTA, TARTAGLIONE, HAYWOOD,
   KEARNEY, KANE, VOGEL AND SCHWANK, JULY 10, 2026
REFERRED TO LAW AND JUSTICE, JULY 10, 2026
                                AN ACT
1 Amending Title 44 (Law and Justice) of the Pennsylvania
2    Consolidated Statutes, in preliminary provisions, providing
3    for public servant data privacy.
4    The General Assembly of the Commonwealth of Pennsylvania
5 hereby enacts as follows:
6    Section 1.    Title 44 of the Pennsylvania Consolidated
7 Statutes is amended by adding a chapter to read:
8CHAPTER 9
9PUBLIC SERVANT DATA PRIVACY
10 Sec.
11 901.   Scope of chapter.
12 902.   Definitions.
13 903.   Nondisclosure of protected information.
14 904.   Enforcement.
15 905.   Construction.
16 § 901.   Scope of chapter.
17    This chapter provides for public servant data privacy.
18 § 902.   Definitions.
1    The following words and phrases when used in this chapter
2 shall have the meanings given to them in this section unless the
3 context clearly indicates otherwise:
4    "Affiliate."   A legal entity that controls, is controlled by,
5 is under common control or shares common bonding with another
6 legal entity.
7    "Assignee."    A person or entity to whom a person's right to
8 bring a civil action for a violation of section 904 (relating to
9 enforcement) has been assigned, in writing, by the covered
10 person or the covered person's authorized agent.
11    "Associated person."   An individual connected to a principal
12 person by one of the following relationships:
13(1)   A parent, spouse, child or grandchild of a principal
14    person, whether a minor or adult.
15(2)   A person sharing a primary residence with a
16    principal person.
17    "Authorized agent."    Any of the following persons or entities
18 authorized to submit or revoke a request for nondisclosure of
19 protected information on behalf of a covered person and to
20 engage in communications and enforcement:
21(1)   A designated trustee or other agent acting under a
22    written power of attorney or other legal instrument on behalf
23    of any covered person who is physically or mentally
24    incapacitated.
25(2)   A parent or legal guardian on behalf of any child
26    who is a minor or who is otherwise entitled to nondisclosure
27    under this act.
28(3)   A person or entity that has been appointed under a
29    written power of attorney by a covered person to act on the
30    covered person's behalf with respect to this chapter.
20260SB1396PN1887  - 2 -
1(4)   An agent acting on behalf of a Federal judge, a
2    designee of the United States Marshals Service or the clerk
3    of any United States District Court.
4    "Covered person."        A principal person or associated person.
5    "Data broker."        A person or entity that sells to a third
6 party the protected information of an individual with whom the
7 person or entity does not have a direct relationship. The term
8 does not include a governmental agency or its representatives
9 acting in an official capacity. The term does not include
10 journalists, registered lobbyists, citizens acting in good faith
11 to investigate public officials or the disclosure of information
12 on matters of public interest lawfully obtained by the person or
13 entity.
14    "Home address."        A dwelling location at which an individual
15 resides, including a physical address, mailing address, street
16 address, parcel identification number, plot identification
17 number, legal property description, neighborhood name and lot
18 number, GPS coordinates and any other descriptive property
19 information that may reveal the home address.
20    "Home telephone number."        A telephone number used primarily
21 for personal communications or associated with personal
22 communications devices, including a landline or cellular number.
23    "Judge."     Any judge, judicial officer or magisterial district
24 judge, as defined in 42 Pa.C.S. § 102 (relating to definitions).
25    "Principal person."        Any active, formerly active or retired:
26(1)   Governor;
27(2)   Lieutenant Governor;
28(3)   member of the General Assembly; or
29(4)   judge.
30    "Protected information."        The term includes:
20260SB1396PN1887  - 3 -
1(1)   A full home address, which includes the number,
2    street, city and zip code of a primary residence or secondary
3    residence.
4(2)   A home telephone number.
5(3)   A Social Security number or driver's license number.
6    "Publicly available information."     As follows:
7(1)   Information that is made available to the general
8    public from:
9(i)    Federal, State or municipal government records;
10(ii)    widely distributed media, including protected
11information intentionally made available by the covered
12person to the general public and in which the covered
13person does not maintain a reasonable expectation of
14privacy; or
15(iii)    a disclosure that is made to the general
16public as required by Federal, State or local law.
17(2)   The term does not include:
18(i)    Protected information that is created through
19the combination of protected information with publicly
20available information.
21(ii)    Protected information made available by a
22covered person on a website or online service open to all
23members of the public, for free or for a fee, where the
24covered person maintains a reasonable expectation of
25privacy by restricting the protected information to a
26specific audience.
27    "Sale of protected information."      The exchange, combination,
28 interchange, exposure or any other provision of access of
29 protected information for monetary or other valuable
30 consideration to a third party. The term does not include:
20260SB1396PN1887  - 4 -
1(1)   the disclosure of protected information to a service
2    provider that processes the protected information on behalf
3    of the data broker;
4(2)   the disclosure of protected information to a third
5    party for purposes of providing a product or service
6    requested by the covered person;
7(3)   the disclosure or transfer of protected information
8    to an affiliate of the data broker;
9(4)   with the covered person's affirmative consent, the
10    disclosure of protected information where the covered person
11    affirmatively directs the data broker to disclose the
12    protected information or intentionally uses the data broker
13    to interact with a third party; or
14(5)   the disclosure of publicly available information.
15    "Service provider."    A person who collects, processes,
16 retains or transfers personal data on behalf of and at the
17 direction of a data broker or another service provider.
18 § 903.   Nondisclosure of protected information.
19    (a)   Prohibition.--A covered person or an authorized agent
20 seeking to prohibit the sale of protected information of the
21 covered person by a data broker shall provide written notice to
22 the data broker referencing this chapter and requesting that the
23 data broker cease the disclosure of the covered person's
24 protected information, as described in the notice.
25    (b)   Data brokers.--Upon notification under subsection (a),
26 and not later than 10 business days following physical or
27 electronic receipt of the notification, a data broker may not
28 recklessly disclose or redisclose or otherwise make available,
29 including on a publicly accessible Internet website, the
30 protected information of the covered person.
20260SB1396PN1887  - 5 -
1    (c)   Duration.--Nondisclosure under this section shall last
2 for the following time frames:
3(1)   A principal person shall receive coverage for life.
4(2)   An associated person shall receive coverage while
5    connected to a principal person and as follows:
6(i)    for a parent, spouse, child or grandchild of a
7principal person, or a person sharing custody of a minor
8child with a principal person, for 30 days after the
9connection terminates; or
10(ii)   for an individual sharing a primary residence
11with a principal person, for 90 days after the connection
12terminates.
13 § 904.   Enforcement.
14    (a)   Civil liability.--A data broker that violates section
15 903(b) (relating to nondisclosure of protected information)
16 shall be liable to the covered person, the covered person's
17 authorized agent or the covered person's assignee, who may bring
18 a civil action in the appropriate court of common pleas.
19    (b)   Time limits.--A civil action under this section must be
20 commenced within the following periods of limitation:
21(1)   two years from the date the violation occurred; or
22(2)   for a continuing violation, within two years from
23    the last date the violation occurred.
24    (c)   Proceedings.--Proceedings shall be in accordance with
25 the following:
26(1)   A party accessing a data broker's website or other
27    products or services for the purpose of determining whether
28    the covered person's protected information is disclosed shall
29    not, as a result of the access, be deemed to have agreed on
30    behalf of the covered person or the covered person's
20260SB1396PN1887  - 6 -
1    authorized agent or assignee to any website terms and
2    conditions with respect to the covered person, associated
3    person or the covered person's or associated person's
4    assignee's rights under this chapter.
5(2)   No prior verification of a covered person's status
6    shall be required for the notice under section 903 to be
7    effective. In a civil action, it shall be the covered person
8    or the covered person's authorized agent's burden to prove
9    status as a covered person by a preponderance of the
10    evidence.
11    (d)   Limitation.--A disclosure of protected information is
12 not a violation of this chapter if the disclosure is:
13(1)   made with the express authorization of the covered
14    person or the covered person's authorized agent, contingent
15    upon the authorization being provided subsequent to the
16    relevant nondisclosure request described in section 903; or
17(2)   for the sole purpose of facilitating a transaction
18    initiated by the covered person or the covered person's
19    authorized agent.
20    (e)   Relief.--In a civil action, for violations of section
21 903, the court shall award:
22(1)   the greater of actual damages for each violation of
23    section 903;
24(2)   punitive damages upon proof of willful or reckless
25    disregard of the law;
26(3)   reasonable attorney fees and other litigation costs
27    reasonably incurred; and
28(4)   any other preliminary and equitable relief as the
29    court determines to be appropriate.
30 § 905.   Construction.
20260SB1396PN1887  - 7 -
1    This chapter shall be liberally construed. Nothing in this
2 chapter shall preclude:
3(1)   a covered person from complying with all required
4    disclosure and filing requirements if the covered person is a
5    candidate for public office; or
6(2)   an individual from challenging the residency of a
7    covered person if the covered person is a candidate for
8    public office.
9    Section 2.   This act shall take effect immediately.
20260SB1396PN1887  - 8 -