The civic record

Read. Follow. Verify.

HB 997PENNSYLVANIASession 2025-2026State Billpassed chamber

Passed

Pennsylvania House Bill 997 Expands Data Breach Notification Requirements and Establishes Direct Civil Remedies for Residents

Original title: An Act amending the act of December 22, 2005 (P.L.474, No.94), known as the Breach of Personal Information Notification Act, further providing for definitions, for notification of the breach of the security of the system, for exceptions and for notice exemption; repealing provisions relating to civil relief; providing for protection of personal information, for civil relief, for information security and for applicability; and repealing provisions relating to applicability.

Last action · October 3, 2025: Referred to COMMUNICATIONS AND TECHNOLOGY, Oct. 3, 2025Sponsors: Jared Solomon and 24 others

Bill progressHistory & official text ↓

Introduced

Committee

Floor Vote

Passed

Law

Track this bill to get notified when it advances a stage. One tap to stop, anytime.

Public stanceCommunity reactions are separate from the official record and reporting.

What This Bill Would Do

House Bill 997 updates the Breach of Personal Information Notification Act by expanding the definition of personal information to include medical data, biometric characteristics, and passport numbers, while allowing residents to sue for actual damages or $5,000 per violation.

Why it matters

Residents gain the explicit right to take businesses to court for data security failures regardless of contract arbitration clauses, while companies face expanded definitions of sensitive information they must protect.

Background

The Breach of Personal Information Notification Act originally established security and notification rules for computerized data breaches in Pennsylvania. context

Who It Would Affect

Groups the bill's text would affect if enacted, as described in the record. Being affected is not a position for or against it.

Directly affected

Residents of this Commonwealth

Residents gain expanded categories of protected personal information and the right to directly sue businesses for data security violations.

Directly affected

Businesses that own, license, or maintain personal information

Businesses must implement reasonable security procedures, face new liability and civil penalties for data breaches, and are prohibited from enforcing certain mandatory arbitration clauses.

Directly affected

Office of Attorney General

The Attorney General is authorized to bring enforcement actions and recover civil penalties up to $10,000 per violation.

Key Facts

You don't have to trust us. Each fact below is taken straight from the official document - click any one to see the exact passage, highlighted in the original.

Frequently Asked Questions

Can businesses use contract arbitration clauses to block residents from suing over data breaches?

No. Contracts entered into on or after the effective date of the section cannot require arbitration or restrict a resident's right to access the courts.

What compensation can a resident recover if they are adversely affected by a data breach violation?

A resident may recover the greater of actual damages or $5,000 for each separate violation, plus reasonable attorney fees and costs.

What else do you want to know?

News Coverage

No news coverage found yet. Articles are indexed twice daily.

Follow the record

Votes, people, money & the original source

Where This Stands

Currently passed chamber. The next step in the legislative lifecycle is Law.

Procedural history

11 actions

Oct 3, 2025SenateCommittee
Referred to COMMUNICATIONS AND TECHNOLOGY, Oct. 3, 2025
Oct 3, 2025Senate
In the Senate
Oct 1, 2025HouseFloor
Third consideration and final passage, Oct. 1, 2025 (112-91)
Oct 1, 2025HouseCommittee
Re-reported as committed, Oct. 1, 2025
Sep 30, 2025House
Re-committed to APPROPRIATIONS, Sept. 30, 2025
Sep 30, 2025HouseFloor
Second consideration, with amendments, Sept. 30, 2025

Show 5 earlier actions

Jul 14, 2025House
Removed from table, July 14, 2025
May 6, 2025House
Laid on the table, May 6, 2025
May 6, 2025HouseIntroduced
First consideration, May 6, 2025
May 6, 2025House
Reported as amended, May 6, 2025
Mar 24, 2025HouseCommittee
Referred to COMMERCE, March 24, 2025

Version history & redline

3 versions on file

Comparing Printer's No. 1621 → Printer's No. 2381

removed addedOfficial text

PRIOR PRINTER'S NO. 1086 NOS. 1086, 1621 PRINTER'S NO. 1621 2381 THE GENERAL ASSEMBLY OF PENNSYLVANIA HOUSE BILL No. 997 Session of 2025 INTRODUCED BY SOLOMON, HILL-EVANS, CERRATO, HOWARD, FREEMAN, KAZEEM, GIRAL, GUENST, MERSKI, CEPEDA-FREYTIZ, PIELLI, SANCHEZ, D. WILLIAMS, CIRESI, STEELE, SHUSTERMAN, DEASY, GREEN, DALEY AND DALEY, GILLEN, RIVERA, WEBSTER AND MADSEN, MARCH 24, 2025 AS REPORTED FROM COMMITTEE AMENDED ON COMMERCE, SECOND CONSIDERATION, HOUSE OF REPRESENTATIVES, AS AMENDED, MAY 6, SEPTEMBER 30, 2025 AN ACT Amending the act of December 22, 2005 (P.L.474, No.94), entitled "An act providing for security of computerized data and for the […] security of the system, for exceptions and for notice exemption; repealing provisions relating to civil relief; providing for protection of personal information, for civil relief for financial institution's liability, for civil relief, for information security, for access devices and breach of security and for applicability; and repealing provisions relating to applicability. The General Assembly of the Commonwealth of Pennsylvania hereby enacts as follows: Section 1. […] Breach of Personal Information Notification Act, amended June 28, 2024 (P.L.427, No.33), are amended and the section is amended by adding definitions to read: <-- <-- <--

Redline computed from the official version text (record lane).View this version →

Lobbying Activity

No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.

Full breakdown

Who this bill affects and the strongest case for and against it, written only from the bill’s own text.

Related Legislation

State Bill

Pennsylvania bans algorithmic rent-setting software under consumer protection law

Pennsylvania House Bill 140 amends the Unfair Trade Practices and Consumer Protection Law to classify the use of algorithmic rent-setting software as

State Bill