Bill > SB112

This bill establishes comprehensive consumer data privacy protections for Pennsylvania residents, creating a framework that gives consumers significant rights regarding their personal data while imposing specific responsibilities on businesses (called "controllers") that collect and process such data. The bill gives consumers the right to confirm, correct, delete, and obtain copies of their personal data, as well as opt out of certain data processing activities like targeted advertising and data sales. Controllers must limit data collection to what is necessary, provide clear privacy notices, obtain consent for processing sensitive data, and establish secure mechanisms for consumers to exercise their rights. The bill applies to businesses that meet certain revenue or data processing thresholds and includes detailed definitions of terms like personal data, sensitive data, and targeted advertising. Notably, the Attorney General will have exclusive enforcement authority, with a phased approach that initially requires providing businesses an opportunity to cure violations before taking action. The bill does not allow private rights of action, and it exempts certain types of organizations and data, such as nonprofit organizations, financial institutions, and healthcare-related information. Violations are considered unfair trade practices, and the law will take effect six months after passage, with some provisions becoming operative on specific future dates.

Business and Industry

https://www.legis.state.pa.us/cfdocs/billinfo/bill_history.cfm?syear=2025&sind=0&body=S&type=B&bn=112