The Pennsylvania House on Wednesday unanimously moved to broaden a consumer data privacy bill that would allow Pennsylvanians to opt out of certain data collection practices by companies and require businesses that collect data to remove consumers’ information on request. No such protections exist at the federal level, leaving states to set data privacy standards.
State Rep. Stephenie Scialabba, R-Butler, offered the amendment to expand the bill’s definition of sensitive information and bring it in line with other state regulations. The bill’s prime sponsor, Rep. Ed Neilson, D-Philadelphia, supported the change.
“ We currently protect certain types of information as being sensitive, and in so doing, we will provide notice to an individual where, for instance, their Social Security number, driver’s license number, or financial account information has been compromised in the event of a data breach,” Scialabba said.
The bill, HB78, now expands protections for those types of financial and identifying data by classifying them in the “sensitive data” category, along with personal information like race, sexuality, mental or physical health history, immigration status and data on a known child. The definition also includes geolocation data, which is collected by a wide swath of apps and websites.
In the previous legislative session, the House passed a similar bill. In the Senate, Tracy Pennycuick, R-Berks, moved it out of the Communications and Technology Committee, but the bill stalled on the Senate floor during budget debates.
“As Chair of the Senate Communications and Technology Committee, I’m a supporter of ensuring data protection,” Pennycuick said. “My staff and I look forward to fully reviewing the House bill once it comes over to my committee.”
This year, Scialabba said she hopes the bill will get a vote in both chambers. Before the legislation can be put to a final vote in the House, it’s being sent to the Appropriations Committee, which will provide a fiscal note reflecting its cost to taxpayers if enacted. Pennycuick said in January that data privacy will again be a priority in the 2025-26 session.
The state Attorney General’s office would be responsible for enforcing the new protections provided under this bill. The bill does not allow for a right of private action, meaning consumers would not be able to directly sue companies for violations.
“Data privacy is a critical component of our office’s mission to protect consumers,” said Brett Hambright, spokesperson for the attorney general’s office. He added that Attorney General Dave Sunday is eager to work with the legislature to expand data protections for Pennsylvanians.
The bill is not yet scheduled for third consideration in the House, where it will be up for debate and a vote on final passage.
Read more from our partners, WITF.
