HB 2100 prohibits mental health chatbot suppliers from selling or sharing Pennsylvania users' personal health data or chat inputs with third parties. It directly affects companies providing AI therapy tools that simulate confidential conversations with users in Pennsylvania. The law requires suppliers to protect user data, with limited exceptions for user consent or sharing with health providers. This creates new data privacy rules for AI mental health tools used by therapists in the state.
HB 2104 establishes Pennsylvania's Office of Information Technology and an Information Technology Fund to centralize and streamline state IT management. It requires all state agencies to submit detailed business cases for major IT projects and sets five-year budget limits to control costs, reduce redundancy, and improve cybersecurity. The bill also creates a Joint Cybersecurity Oversight Committee, mandates improved data protection for personal information, and assigns oversight for the Pennsylvania Statewide Radio Network. These changes directly affect all state agencies by requiring standardized IT procurement, budgeting, and security protocols.
HB 997 updates Pennsylvania's data breach notification law, requiring businesses to notify affected individuals more clearly and promptly after a security breach involving personal information. It directly affects businesses that collect or store personal data, such as healthcare providers, retailers, and financial institutions. Key changes include modernizing definitions of personal information, clarifying when notification is required, adding new security protections, and repealing outdated civil relief provisions. The bill also removes certain exemptions that previously allowed businesses to delay or avoid notifying individuals about breaches.
This bill amends Pennsylvania's State Lottery Law to protect the privacy of large lottery winners. It requires that personal information (name, address, and other details) for winners of $100,000 or more in prizes remain confidential and not part of public records. However, the winner's city/township/borough, county of residence, and prize amount must still be publicly disclosed. Winners may voluntarily waive this confidentiality by following procedures set by the Department of Revenue, and the department can create implementing regulations.
HB 1219 establishes a new Office of Information Technology and an Information Technology Fund to consolidate Pennsylvania state government IT operations. The bill requires all state agencies to follow new procurement rules, including business case reviews and five-year budget limits for significant IT projects, to reduce costs and improve efficiency. It also creates a Joint Cybersecurity Oversight Committee to strengthen data protection and mandates better cybersecurity practices for all state IT systems. The bill directly affects all Pennsylvania state agencies responsible for managing information technology and cybersecurity.
HB 1530, the Genetic Information Privacy Act, requires direct-to-consumer genetic testing companies operating in Pennsylvania to protect residents' genetic data. Companies must obtain clear, separate consent for data collection, use, sharing, and retention; implement security measures; and provide consumers with access to or deletion of their data. The bill specifically prohibits sharing genetic data with insurers, employers, or third parties without explicit written consent. Violations could result in $2,500 civil penalties per incident, enforced by the Attorney General’s office. The law applies to Pennsylvania residents and covers genetic data like DNA test results, but excludes research data collected under federal health privacy rules.
HB 483 strengthens confidentiality protections for personal information provided during Pennsylvania firearm purchases. It makes all buyer details - including name - confidential, barring disclosure except when the buyer faces criminal prosecution related to the purchase. The bill imposes civil penalties of $1,000 per violation or three times actual damages (whichever is greater) on dealers, agencies, or individuals who illegally disclose this information. This directly affects firearm buyers, licensed dealers, and state/local agencies handling firearm transaction data. The law takes effect 60 days after enactment.
HB 957 amends Pennsylvania's invasion of privacy law to increase penalties for repeated violations and require convicted individuals to destroy related recordings. It upgrades the offense to a third-degree felony if there are multiple violations (previously a second-degree felony), while single violations remain a first-degree misdemeanor. The bill also adds a new requirement that anyone convicted under this law must delete or destroy all associated recordings (photos, videos, etc.) they possess; failing to do so becomes a separate third-degree felony. This directly affects individuals convicted of privacy violations involving recorded media, such as secretly filming or sharing intimate images without consent. The changes take effect 60 days after enactment.
HB 1822 would protect personal data (like home addresses and phone numbers) of Pennsylvania public servants - such as police officers, teachers, and government workers - from being sold or misused by data brokers. It requires data brokers to delete this information upon request and follow new rules when collecting or sharing it. The bill also creates a civil enforcement mechanism, allowing affected individuals to sue companies that violate these protections. Currently, the bill is stalled in the House after being amended and reported by the Judiciary Committee.
SB 378 establishes new student data privacy rules for Pennsylvania's K-12 schools (excluding colleges). It requires schools to collect only essential student data (like grades or medical records), protect all data with safeguards, and obtain written parental consent for sharing non-essential information. The law defines key terms like "biometric identifiers" (e.g., fingerprints) and prohibits collecting sensitive data such as political views or religious information without authorization. The Department of Education gains enforcement powers to ensure compliance and impose penalties for violations. This directly affects public schools, charter schools, and cyber schools operating under Pennsylvania's education statutes.
