FOR IMMEDIATE RELEASE
June 12, 2008
CONTACT: Erik Arneson
earneson@pasen.gov
717-787-4712
Back

Adjust Text Size

Sen. Pileggi's Bill Requiring Prompt Notification of Personal Information Data Breaches Advances 

Legislation to require state agencies to report data breaches involving personal information within one week, sponsored by Senate Majority Leader Dominic Pileggi (R-9), was approved unanimously by the Senate Communications and Technology Committee yesterday.

Senate Bill 1266, Senator Pileggi's legislation, was introduced after three thefts of state-owned computers containing personal information were reported in the latter part of 2007. The stolen computers contained the personal information of nearly 400,000 individuals, including at least 17,800 Social Security numbers.

"The public was not notified of these thefts until two or three weeks had passed," said Senator Pileggi. "That is unacceptable. If a government-owned computer is breached, the government has a duty to notify potentially affected residents promptly so that they can take steps to protect themselves from identity theft."

The reported computer thefts took place August 22, November 13, and December 5, 2007. In the first two incidents, computers were stolen from Department of Public Welfare offices in Harrisburg and Philadelphia. In the third incident, a laptop computer issued to a Department of Aging employee was stolen from a private residence.

Act 94 of 2005 requires that the public be notified of such breaches "without unreasonable delay." Senate Bill 1266 would amend that law to specify a one-week notification period for any breaches involving state or local government.

Senator Pileggi's legislation, developed with the Attorney General's office, would require that government agencies report data breaches to the Attorney General within three business days. It would also authorize the Attorney General to investigate those breaches.

More information about state issues can be found on Sen. Pileggi's web site, www.senatorpileggi.com.