PENNSYLVANIA, October 18 - system to the Governor's Office of Administration within

three business days following the discovery of the breach.

Notification shall occur notwithstanding the existence of

procedures and policies under section 7.

(3) A STATE AGENCY THAT, ON THE EFFECTIVE DATE OF THIS

SECTION, HAS AN EXISTING CONTRACT WITH A STATE AGENCY

CONTRACTOR SHALL USE REASONABLE EFFORTS TO AMEND THE CONTRACT

TO INCLUDE PROVISIONS RELATING TO THE STATE AGENCY

CONTRACTOR'S COMPLIANCE WITH THIS ACT.

(4) A STATE AGENCY THAT, AFTER THE EFFECTIVE DATE OF

THIS SECTION, ENTERS INTO A CONTRACT WITH A STATE AGENCY

CONTRACTOR SHALL ENSURE THAT THE CONTRACT INCLUDES PROVISIONS

RELATING TO THE STATE AGENCY CONTRACTOR'S COMPLIANCE WITH

THIS ACT.

(a.2) Notification by county, school district or

municipality.--If a county, school district or municipality is

the subject of a breach of security of the system, the county,

school district or municipality shall provide notice of the

breach of security of the system required under subsection (a)

within seven days following discovery of the breach.

Notification shall be provided to the district attorney in the

county in which the breach occurred within three business days

following discovery of the breach. Notification shall occur

notwithstanding the existence of procedures and policies under

section 7.

(a.3) Electronic notification.--In the case of a breach of

the security of the system involving personal information

defined in section 2 for a user name or e-mail address in

combination with a password or security question and answer that

would permit access to an online account, the person or business

20210SB0696PN0793 - 4 -

<--

<--

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30