PRINTER'S NO. 1174
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No. 1126
Session of
2021
INTRODUCED BY NEILSON, KINSEY, SCHLOSSBERG, SANCHEZ, GALLOWAY,
McNEILL, PARKER, FREEMAN, CIRESI, DELLOSO, WARREN, THOMAS,
SCHLEGEL CULVER, PISCIOTTANO, KINKEAD AND ROZZI,
APRIL 7, 2021
REFERRED TO COMMITTEE ON CONSUMER AFFAIRS, APRIL 7, 2021
AN ACT
1 Providing for consumer data privacy, for rights of consumers and
2 duties of businesses relating to the collection of personal
3 information and for duties of the Attorney General.
4 The General Assembly of the Commonwealth of Pennsylvania
5 hereby enacts as follows:
6 Section 1. Short title.
7 This act shall be known and may be cited as the Consumer Data
8 Privacy Act.
9 Section 2. Legislative findings.
10 The General Assembly finds and declares as follows:
11 (1) It is an important and substantial State interest to
12 protect the private, personal data in this Commonwealth.
13 (2) With the increasing use of technology and data in
14 everyday life, there is an increasing amount of private,
15 personal data being shared by consumers with businesses as a
16 part of everyday transactions and online and other
17 activities.
 1 (3) The increasing collection, storage, use and sale of
2 personal data creates increased risks of identity theft,
3 financial loss and other misuse of private personal data.
4 (4) Many consumers do not know, understand or have
5 appropriate authority over the distribution, use, sale or
6 disclosure of their personal data.
7 Section 3. Definitions.
8 The following words and phrases when used in this act shall
9 have the meanings given to them in this section unless the
10 context clearly indicates otherwise:
11 "Business." As follows:
12 (1) A sole proprietorship, partnership, limited
13 liability company, corporation, association or other legal
14 entity:
15 (i) That is organized or operated for the profit or
16 financial benefit of its shareholders or other owners.
17 (ii) That collects consumers' personal information,
18 or on behalf of which consumers' personal information is
19 collected and that alone, or jointly with others,
20 determines the purposes and means of the processing of
21 consumers' personal information.
22 (iii) That does business in this Commonwealth.
23 (iv) That satisfies one or more of the following
24 thresholds:
25 (A) Has annual gross revenues in excess of
26 $10,000,000.
27 (B) Alone or in combination, annually buys,
28 receives for the business' commercial purposes, sells
29 or shares for commercial purposes, alone or in
30 combination, the personal information of 50,000 or
20210HB1126PN1174 - 2 -
 1 more consumers, households or devices.
2 (C) Derives 50% or more of annual revenues from
3 selling consumers' personal information.
4 (2) An entity that controls a business under paragraph
5 (1) and shares common branding with the business.
6 "Common branding." A shared name, servicemark or trademark.
7 "Control." Any of the following:
8 (1) Ownership of or the power to vote on more than 50%
9 of the outstanding shares of any class of voting security of
10 a business.
11 (2) Control in any manner over the election of a
12 majority of the directors or of individuals exercising
13 similar functions.
14 (3) The power to exercise a controlling influence over
15 the management of a company.
16 "Personal information." As follows:
17 (1) Information that identifies, relates to, describes,
18 is capable of being associated with or could reasonably be
19 linked, directly or indirectly, with a particular consumer or
20 household, including:
21 (i) Identifiers such as a real name, alias, postal
22 address, unique personal identifier, online identifier,
23 including an Internet website protocol address, e-mail
24 address, account name, Social Security number, driver's
25 license number, passport number or other similar
26 identifiers.
27 (ii) Characteristics of protected classifications
28 under Federal or State law.
29 (iii) Commercial information, including records of
30 personal property, products or services purchased,
20210HB1126PN1174 - 3 -
 1 obtained or considered or other purchasing or consuming
2 histories or tendencies.
3 (iv) Biometric information.
4 (v) Internet or other electronic network activity
5 information, including browser history, search history
6 and information regarding a consumer's interaction with
7 an Internet website, application or advertisement.
8 (vi) Geolocation data.
9 (vii) Audio, electronic, visual, thermal, olfactory
10 or similar information.
11 (viii) Professional or employment-related
12 information.
13 (ix) Education information, defined as information
14 that is not publicly available personally identifiable
15 information under the Family Educational Rights and
16 Privacy Act of 1974 (Public Law 90-247, 20 U.S.C. §
17 1232g).
18 (x) Inferences drawn from any of the information
19 identified under this definition to create a profile
20 about a consumer reflecting the consumer's preferences,
21 characteristics, psychological trends, predispositions,
22 behaviors, attitudes, intelligence, abilities and
23 aptitudes.
24 (2) The term does not include publicly available
25 information.
26 "Publicly available." As follows:
27 (1) Information that is lawfully made available from
28 Federal, State or local government records, as restricted by
29 any conditions associated with the information.
30 (2) The term does not include biometric information
20210HB1126PN1174 - 4 -
 1 collected by a business about a consumer without the
2 consumer's knowledge or consumer information that is
3 deidentified or aggregate consumer information.
4 (3) Information is not publicly available if the data is
5 used for a purpose that is not compatible with the purpose
6 for which the data is maintained and made available in the
7 government records or for which it is publicly maintained.
8 Section 4. Consumer data privacy.
9 (a) General rights.--A consumer shall have the right to:
10 (1) Know what personal information is being collected
11 about the consumer.
12 (2) Know whether the consumer's personal information is
13 sold or disclosed and to whom.
14 (3) Decline or opt out of the sale of the consumer's
15 personal information.
16 (4) Access the consumer's personal information that has
17 been collected.
18 (5) Equal service and price, even if a consumer
19 exercises rights under this subsection.
20 (b) Disclosure by businesses.--A consumer shall have the
21 right to request that a business that collects personal
22 information about the consumer disclose to the consumer the
23 following:
24 (1) The categories of personal information the business
25 has collected about the consumer.
26 (2) The categories of sources from which the personal
27 information is collected.
28 (3) The business or commercial purpose for collecting or
29 selling personal information.
30 (4) The categories of third parties with whom the
20210HB1126PN1174 - 5 -
 1 business shares personal information.
2 (5) The specific pieces of personal information the
3 business has collected about the consumer.
4 (c) Request from consumer.--A business that collects
5 personal information about a consumer shall disclose to the
6 consumer the information specified under subsection (b) upon
7 receipt of a verifiable request from a consumer. This subsection
8 does not require a business to:
9 (1) retain any personal information about a consumer
10 collected for a single one-time transaction if, in the
11 ordinary course of business, that information about the
12 consumer is not retained; or
13 (2) reidentify or otherwise link any data that, in the
14 ordinary course of business, is not maintained in a manner
15 that would be considered personal information.
16 (d) Request for information sold or used for business
17 purposes.--A consumer shall have the right to request that a
18 business that sells the consumer's personal information, or that
19 discloses it for a business purpose, disclose to the consumer:
20 (1) The categories of personal information that the
21 business collected about the consumer.
22 (2) The categories of personal information that the
23 business sold about the consumer and the categories of third
24 parties to whom the personal information was sold, by
25 category or categories of personal information for each third
26 party to whom the personal information was sold.
27 (3) The categories of personal information that the
28 business disclosed about the consumer for a business purpose.
29 (e) Request to delete personal information.--A consumer
30 shall have the right to request that a business delete any
20210HB1126PN1174 - 6 -
 1 personal information about the consumer that the business has
2 collected from the consumer. The following apply:
3 (1) A business that collects personal information about
4 consumers shall disclose under subsection (l) the consumer's
5 rights to request the deletion of the consumer's personal
6 information.
7 (2) A business that receives a verifiable request from a
8 consumer to delete the consumer's personal information shall
9 delete the consumer's personal information from its records
10 and direct service providers to delete the consumer's
11 personal information from the service provider's records.
12 (3) A business or a service provider shall not be
13 required to comply with a consumer's request to delete the
14 consumer's personal information if it is necessary for the
15 business or service provider to maintain the consumer's
16 personal information to:
17 (i) Complete the transaction for which the personal
18 information was collected, provide a good or service
19 requested by the consumer or reasonably anticipated
20 within the context of a business's ongoing business
21 relationship with the consumer or otherwise perform a
22 contract between the business and the consumer.
23 (ii) Detect security incidents, protect against
24 malicious, deceptive, fraudulent or illegal activity or
25 prosecute those responsible for that activity.
26 (iii) Debug to identify and repair errors that
27 impair existing intended functionality.
28 (iv) Exercise free speech, ensure the right of
29 another consumer to exercise the consumer's right of free
30 speech or exercise another right provided under Federal
20210HB1126PN1174 - 7 -
 1 or State law.
2 (v) Engage in public or peer-reviewed scientific,
3 historical or statistical research in the public interest
4 that adheres to all other applicable Federal and State
5 ethics and privacy laws, when the business's deletion of
6 the information is likely to render impossible or
7 seriously impair the achievement of the research, if the
8 consumer has provided informed consent.
9 (vi) Enable solely internal uses that are reasonably
10 aligned with the expectations of the consumer based on
11 the consumer's relationship with the business.
12 (vii) Comply with a legal obligation.
13 (f) Compliance with request.--A business that sells personal
14 information about a consumer, or that discloses a consumer's
15 personal information for a business purpose, shall disclose the
16 information specified under subsection (d) to the consumer upon
17 receipt of a verifiable request from the consumer.
18 (g) Third parties.--A third party may not sell personal
19 information about a consumer that has been sold to the third
20 party by a business unless the consumer has received explicit
21 notice and is provided an opportunity to exercise the right to
22 opt out.
23 (h) Notice.--A business that sells consumers' personal
24 information to third parties shall provide notice to consumers
25 that this information may be sold and that a consumer has the
26 right to opt out of the sale of their personal information at
27 any time.
28 (i) Prohibition on sale of personal information.--A business
29 that has received direction from a consumer not to sell the
30 consumer's personal information or, in the case of a minor
20210HB1126PN1174 - 8 -
 1 consumer's personal information has not received consent to sell
2 the minor consumer's personal information, shall be prohibited
3 from selling the consumer's personal information after receipt
4 of the consumer's direction, unless the consumer subsequently
5 provides express authorization for the sale of the consumer's
6 personal information.
7 (j) Consumers of young age.--Notwithstanding subsection (i),
8 a business may not sell the personal information of a consumer
9 if the business has actual knowledge that the consumer is less
10 than 16 years of age, unless the consumer, in the case of a
11 consumer who is between 13 and 16 years of age, or the
12 consumer's parent or guardian, in the case of a consumer who is
13 less than 13 years of age, has affirmatively authorized the sale
14 of the consumer's personal information. A business that
15 willfully disregards the consumer's age shall be deemed to have
16 had actual knowledge of the consumer's age.
17 (k) Discrimination prohibited.--
18 (1) A business may not discriminate against a consumer
19 because the consumer exercised any of the consumer's rights
20 under this section, including by:
21 (i) Denying goods or services to the consumer.
22 (ii) Charging different prices or rates for goods or
23 services, including through the use of discounts or other
24 benefits or imposing penalties.
25 (iii) Providing a different level or quality of
26 goods or services to the consumer.
27 (iv) Suggesting that the consumer will receive a
28 different price or rate for goods or services or a
29 different level or quality of goods or services.
30 (2) Nothing in this subsection shall prohibit a business
20210HB1126PN1174 - 9 -
 1 from charging a consumer a different price or rate, or from
2 providing a different level or quality of goods or services
3 to the consumer, if that difference is reasonably related to
4 the value provided to the consumer by the consumer's data.
5 (l) Compliance with notice requirements.--To comply with the
6 notice requirements under this section, a business shall:
7 (1) In a form that is reasonably accessible to
8 consumers, make available to consumers two or more designated
9 methods for submitting requests for information required to
10 be disclosed, including, at a minimum, a toll-free telephone
11 number, and if the business maintains a publicly accessible
12 Internet website, the website address.
13 (2) In a form that is reasonably accessible to
14 consumers, disclose and deliver the required information to a
15 consumer free of charge within 45 days of receiving a
16 verifiable request from the consumer. The time period to
17 provide the required information may be extended once by an
18 additional 45 days when reasonably necessary, if the consumer
19 is provided notice of the extension within the first 45-day
20 period.
21 (3) In a form that is reasonably accessible to
22 consumers, provide a clear and conspicuous link on the
23 business's publicly accessible Internet website, titled "Do
24 Not Sell My Personal Information," to a publicly accessible
25 Internet website that enables a consumer, or a person
26 authorized by the consumer, to opt out of the sale of the
27 consumer's personal information. A business may not require a
28 consumer to create an account to direct the business not to
29 sell the consumer's personal information.
30 (4) Include a description of a consumer's rights along
20210HB1