Pennsylvania House Bill HB997

Pennsylvania 2025-2026 Regular Session

• Introduced: 3/24/25
• Refer: 3/24/25
• Refer: 9/30/25
• Report Pass: 10/1/25
• Engrossed: 10/1/25
• Refer: 10/3/25

Caption

Further providing for definitions, for notification of the breach of the security of the system, for exceptions and for notice exemption; repealing provisions relating to civil relief; providing for protection of personal information, for civil relief, for information security and for applicability; and repealing provisions relating to applicability.

Impact

If enacted, HB 997 would strengthen existing state laws regarding data breaches by offering clearer definitions of key terms such as 'breach of the security of the system' and 'personal information'. The bill requires businesses to maintain reasonable procedures to protect personal information and outlines civil relief options for individuals adversely affected by violations. This means that individuals could bring legal actions against entities for damages resulting from breaches, adding considerable accountability for businesses in information security matters.

Summary

House Bill 997 relates to the protection of personal information in the Commonwealth of Pennsylvania. The bill aims to amend the Breach of Personal Information Notification Act by modifying definitions related to data breaches, enhancing notification requirements for breaches, and introducing more stringent guidelines for compliance by businesses that handle personal information. Specific provisions mandate that businesses must notify affected residents whenever there is a breach that compromises unencrypted personal information and establish exceptions for delays in notification in certain law enforcement circumstances.

Contention

While proponents of HB 997 argue that these changes are necessary to enhance consumer protection in the digital age, there are concerns regarding the compliance burden placed on businesses, particularly small businesses that may lack the resources to meet the new requirements. Additionally, the bill's provisions allowing for the Attorney General to pursue actions against violators may be seen as an increase in regulatory oversight, raising concerns among business advocacy groups about potential litigation and penalties in cases of inadvertent non-compliance.