Committee advances bill allowing civil suits after data breaches, trims language conflicting with Gramm‑Leach‑Bliley Act

A House Commerce Committee on an unspecified date voted to report House Bill 997, which would require entities that collect sensitive personal information to take “reasonable measures” to secure that data and would allow consumers and the attorney general to bring civil actions if the data are breached.

Sponsor Chairman Solomon told the committee his office and constituents were alarmed by a large retail data breach and framed the bill as a legislative response. “These data breaches are all too common,” Chairman Solomon said, describing a 2019 retail breach that affected customers’ credit cards and information. He said the bill would codify protections and a private right of action and cited the Pennsylvania Supreme Court’s Dittman decision as a model for legislative action.

The bill drew pushback on contractual and constitutional grounds. Chairman Lawrence said he opposed the measure, citing a provision beginning on page 11, line 26, that he said “basically nullifies arbitration provisions and existing contracts between an institution and a consumer” and could amount to a “dramatic and potentially unconstitutional retroactive change of existing long standing contracts.” He said he had concerns about the private‑right‑of‑action language as drafted.

Committee staff summarized an amendment, A00487, offered by Chairman Conklin. Derek, the committee staff member who summarized the amendment, said A00487 removed section 10 and section 13 because those sections “could conflict with the Gramm‑Leach‑Bliley Act exemption.” Committee members had no recorded negative votes on the amendment and it passed. On the final tally the committee reported the bill to the next stage with 14 ayes and 12 nays.

The record shows the discussion included examples of retail and large‑scale breaches and an explicit concern from at least one committee member about preserving the enforceability of existing arbitration clauses and contracts. The amendment removed the sections identified by staff as potentially in conflict with federal statute; the committee did not adopt any changes to the private‑right‑of‑action language on the floor that are reflected in the record provided.

The committee’s action was procedural: the bill was reported out of committee. The transcript does not record subsequent steps, effective dates, or implementation details for the statute if passed into law.