Consumer data has become one of the most important topics of the 21st century. The rise of the digital world we know today has brought to light a whole new threat to the average consumer. Individual’s personal data is often at risk when we use various online platform. There have been a large number of data breaches in which personal information has been stolen, instances of large companies collecting our data and selling it to the highest bidder, and many cases of data such as credit card information and social security numbers being stolen. A number of laws at the state and federal level have been enacted to attempt to reduce the instances of these data breaches. Pennsylvania House Bill 1010 is another one of these bills. The proposed legislation would put in place a number of requirements that would force entities to do more to protect their customers personal data.
House Bill 1010 would take steps to ensure that entities are vigilant in reporting data breaches to those that may be affected by the breach and would provide a cause of action to those affected by a breach. The proposed legislation provides that “an entity that maintains, stores, or manages computerized data that includes personal information shall provide notice of a breach of the security of the system following discovery of the breach of the security of the system to a resident of this Commonwealth whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person.” There is a lot to unpack here. An “entity”, as defined by the definition section of this a government agency, a political subdivision, or an individual or a business doing business in the commonwealth. The bill would require an entity to report any actual or reasonably suspected breach of personal data that is held by the entity.
What is included in personal data? We will again look to the definition section. HB 1010 defines personal data as “an individual’s first name or first initial and last name in combination with and linked to any one or more of the following data elements when the data elements are not encrypted or redacted: 1) social security number; 2) driver’s license number or a state identification card; 3) financial account number, credit card number, or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial account; 4) passport number; 5) a username or email address, in combination with a password or security question and answer; 6) medical history…; 7) health insurance policy number…; 8) unique biometric data… 9) taxpayer identification number.” I personally know I have entered information that would fall under many of these categories into an online system before. It is scary to think that there isn’t already a protection system in place to ensure the integrity this data, and that is why we have seen some of these massive data breaches in the past.
It is difficult to know the effects that this proposed legislation may have on business in the commonwealth as it is really all speculation until and if it does become law. HB 1010 applies to unencrypted data, so it seems that one good measure to take would be to encrypt consumer data if you are collecting consumer data. This may be difficult and expensive for small businesses, however, and therefore may not be adhered to. Some entities will undoubtedly opt not to encrypt data and take their chances which could potentially expose their customers to data breaches, and would subsequently make these entities susceptible to civil litigation.
House Bill 1010 also provides a cause of action for consumers who’s personal data is affected by a data breach. The proposed legislation provides that “a resident of this Commonwealth who is adversely affected by a violation of this act… may bring an action to: 1) enjoin further violations of this act. 2) recover the greater of actual damages or $5,000 for each separate violation of this act.” The threat of civil litigation hopefully would force entities to be more vigilant in the protection of their customers data and would provide customers affected by a data breach at least some compensation for their stolen information. However, it is difficult to put a price on stolen information. The proposed legislation would provide for affected customers to recover up to $5,000, but the actual damage to an individual consumer could be far greater than that. Identity theft is an incredibly difficult situation to deal with and can have effects that follow an individual for years.
House Bill 1010 is merely proposed legislation so there is no actual way to measure how and if it will affect businesses in the commonwealth. However, data security is something that is extremely important and should be taken seriously by businesses in the commonwealth, whether it is required by legislation or not. Stay vigilant to protect your business and your customers by going to appropriate lengths to ensure that you are protecting consumer data. If your business collects large amounts of consumer data it should be encrypted and kept on secure servers. Stay up to date on current and proposed cybersecurity legislation that may affect your business, including House Bill 1010. The best way to protect your business and your customers is to stay proactive and take the appropriate measures to keep your data secure.
Sources:
https://www.legis.state.pa.us//cfdocs/Legis/CSM/showMemoPublic.cfm?chamber=H&SPick=20190&cosponId=27434
https://www.legis.state.pa.us/cfdocs/legis/PN/Public/btCheck.cfm?txtType=PDF&sessYr=2019&sessInd=0&billBody=H&billTyp=B&billNbr=1010&pn=1160
Photo Sources:
https://www.forbes.com/sites/bernardmarr/2020/01/10/the-5-biggest-cybersecurity-trends-in-2020-everyone-should-know-about/#1f5cc23b7ecc
PA.gov/guides/cybersecurity/
