House approves amended breach-notification bill after prolonged questioning over timing and liability protections

HARRISBURG, Pa. — The Pennsylvania House on Sept. 30 approved multiple amendments to House Bill 997, which updates the state’s Breach of Personal Information Notification Act, and then agreed to the bill as amended.

Lawmakers said the changes were intended to clarify when businesses must notify individuals about a data breach and to provide predictability for businesses while protecting consumers. The House adopted a technical cleanup, an amendment that narrows the circumstances that trigger notice, and a rebuttable presumption (safe harbor) for actors that meet specified duties. Each amendment passed on recorded votes before the chamber agreed to the bill.

The bill drew extended questioning and debate on the floor about the tension between rapid consumer notification and the time it can take for a forensic investigation to determine the scope of an intrusion. Representative Solomon, identified in the transcript as the majority chair of Veterans Affairs and Emergency Preparedness and a floor sponsor of amendments,…