The Commonwealth of Pennsylvania is re-joining the U.S. state privacy law race.
State Rep. Edward Neilson recently proposed H.B 78, which features all the normal trappings of a state privacy law with a very low applicability threshold and a shoutout to free speech.
Some key points:
Lots of things to do for entities that have not been in scope so far:
- Applies to a lot of Pennsylvania companies: Revenue thresholds of 10 million (which is lower than the other laws), 50,000 users or 50% of revenues from sale.
- Normal privacy notice and consumer rights requirements (including opt out of profiling and consent for sensitive data processing).
- DPIA requirement (likely in mid-2026) for sale of data, targeted advertising, certain profiling (including in connection with employment opportunities).
- Data minimization standard: (the “regular” kind) adequate, relevant and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer.
- Sensitive data specifically includes precise geolocation (1750 sq ft).
- Right to appeal (including spelled out process for appeal).
- Targeted advertising to people under 16’s, or selling their data, requires consent.
- Direct applicability to data processors (including detailed requirements for DPA).
Enforcement:
- Effective date would be one year from passage date (Potentially mid-2026)
- Enforcement by the Attorney General, with specific callout to violations being ‘unfair or deceptive practices’ and a 6-month mandatory cure.
- Right to promulgate regulations by the Attorney General.
Other points:
- Entity level carve outs for non profits, higher education, HIPAA entities or financial institutions.
- Standard carve outs, including entity exemption to financial institutions.
- Data minimization, purpose specification, information security obligations are included.
- Special protection for free speech: Nothing in this act shall be construed to impose an obligation on a controller or processor that adversely affects the rights or freedoms of an individual, including the freedom of speech or freedom of the press guaranteed in the First Amendment to the Constitution of the United States or section 7 of Article I of the Constitution of Pennsylvania.