Governor Wolf Signs Act 151 Addressing Data Breaches Within Local Entities

On Thursday, November 3, 2022, Governor Tom Wolf signed PA Senate Bill 696, also known as Act 151 of 2022 or the Breach of Personal Information Notification Act.  Act 151 amends Pennsylvania’s existing Breach of Personal Information Notification Act, strengthening protections for consumers, and imposing stricter requirements for state agencies, state agency contractors, political subdivisions, and certain individuals or businesses doing business in the Commonwealth.  Act 151 expands the definition of “personal information,” and requires Commonwealth entities to implement specific notification procedures in the event that a Commonwealth resident’s unencrypted and unredacted personal information has been, or is reasonably believed to have been, accessed and acquired by an unauthorized person.  The requirements for state-level and local entities differ slightly; this Alert will address the impact of Act 151 on local entities.  While this law does not take effect until May 22, 2023, it is critical that all entities impacted by this law be aware of these changes.

For the purposes of Act 151, the term “local entities” includes municipalities, counties, and public schools.  The term “public school” encompasses all school districts, charter schools, intermediate units, cyber charter schools, and area career and technical schools.  Act 151 requires that, in the event of a security breach of the system used by a local entity to maintain, store, or manage computerized data that includes personal information, the local entity must notify affected individuals within seven business days of the determination of the breach.  In addition, local entities must notify the local district attorney of the breach within three business days.

The definition of “personal information” has been updated, and includes a combination of (1) an individual’s first name or first initial and last name, and (2) one or more of the following items, if unencrypted and unredacted:

  • Social Security number;
  • Driver’s license number;
  • Financial account numbers or credit or debit card numbers, combined with any required security code or password;
  • Medical information;
  • Health insurance information; or
  • A username or password in combination with a password or security question and answer.

The last three items were added by this amendment.  Additionally, the new language provides that “personal information” does not include information that is made publicly available from government records or widely distributed media.

Act 151 defines previously undefined terms, drawing a distinction between “determination” and “discovery” of a breach, and setting forth different obligations relating to each.  “Determination,” under the act, is defined as, “a verification or reasonable certainty that a breach of the security of the system has occurred.”  “Discovery” is defined as, “the knowledge of or reasonable suspicion that a breach of the security of the system has occurred.”  This distinction affords entities the ability to investigate a potential breach before the more onerous notification requirements are triggered.  A local entity’s obligation to notify Commonwealth residents is triggered when the entity has reached a determination that a breach has occurred.  Further, any vendor that maintains, stores, or manages computerized data on behalf of a local entity is responsible for notifying the local entity upon discovery of a breach, but the local entity is ultimately responsible for making the determinations and discharging any remaining duties under Act 151.

Another significant update afforded by Act 151 is the addition of an electronic notification procedure.  Previously, notice could be given: (1) by written letter mailed to the last known home address of the individual; (2) telephonically, if certain requirements are met; (3) by email if a prior business relationship exists and the entity has a valid email address; or (4) by substitute notice if the cost of providing notice would exceed $100,000, the affected class of individuals to be notified exceeds 175,000, or the entity does not have sufficient contact information.  Now, in addition to the email option, entities can provide an electronic notice that directs the individual whose personal information may have been materially compromised to promptly change their password and security question or answer, or to take any other appropriate steps to protect their information.

Act 151 also provides that all entities that maintain, store, or manage computerized personal information on behalf of the Commonwealth must utilize encryption –  this provision originally applied only to employees and contractors of Commonwealth agencies, but was broadened in Act 151.  Further, the act provides that all entities that maintain, store, or manage computerized personal information on behalf of the Commonwealth must maintain policies relating to the transmission and storage of personal information – such policies were previously developed by the Governor’s Office of Administration.

Finally, under Act 151, any entity that is subject to and in compliance with certain healthcare and federal privacy laws is deemed to be in compliance with Act 151.  For example, an entity that is subject to and in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is deemed compliant with Act 151.

Although Act 151 is an amendment to prior legislation, the updates create potential exposure for local entities and the vendors that serve them.  For local municipalities, schools, and counties, compliance will require a proactive approach – local entities will have to familiarize themselves with the new requirements, be mindful of the personal information they hold, and ensure that their vendors are aware of their obligations.  Further, local entities will be required to implement encryption protocols, and prepare and maintain storage and transmission policies.

Originally Published by Babst Calland November 29, 2022. Article By Michael T. Korns and Ember K. Holmes of Babst, Calland, Clements & Zomnir, P.C.

Click here to read more legislative news on the National Law Review website.

© Copyright Babst, Calland, Clements and Zomnir, P.C.

More Places, Less Spaces: California is Driving Down Development Costs

In an effort to decrease the skyrocketing development costs and reduce greenhouse gas emissions, Assembly Bill 2097 (AB 2097) aims to eliminate a key obstacle for new developments: parking. More specifically, starting on January 1, 2023, this law prohibits public agencies from imposing minimum automobile parking requirements for residential, commercial and other development projects if the project is located within a 1/2-mile of a “High-Quality Transit Corridor”[1] or a “Major Transit Stop.”[2]

Prior to the enactment of AB 2097, cities and counties retained the authority to impose a minimum number of parking spaces required for new developments. This condition is typically the result of a calculation found in the city or county’s zoning code, and is usually determined based on the use or type of project being developed, regardless of project specifics. Oftentimes, the use of a universal calculation results in excess parking. For example, a new restaurant may be required to provide 4 parking spaces for every 100 square feet of use even if the restaurant concept does not necessitate a large number of parking spaces or if the restaurant is in a pedestrian- or transit-friendly location. While California remains in the throes of a housing crisis, some areas within the state boast an oversupply of parking spaces. For example, Los Angeles County has 18.6 million parking spaces, which equates to almost 2 parking spaces for every 1 resident.[3] This statistic is similar in the Bay Area where there are 1.9 parking spaces for every 1 resident.[4]

Moreover, not only can a static calculation result in unnecessary parking (and blacktop), it can add untenable costs to new developments. For example, new residential developments are typically required to provide 1 to 2 parking spaces per unit. The requirement results in an additional cost of approximately $36,000 per unit.[5] As the cost to develop residential projects is at an all-time high,[6] builders are welcoming all efforts to reduce the cost and eliminate unnecessary development “standards.”

To avoid a complete free-for-all, under AB 2097, public agencies will still retain the ability to impose a minimum parking requirement, if, within 30 days of the receipt of a completed application, the public agency makes a written finding that not imposing a minimum automobile parking requirement would have a substantial negative impact. However, there are a number of exceptions to this caveat that wholly restrict public agencies from imposing a minimum parking condition. These exceptions include certain affordable housing projects or small residential housing projects.

For parking spaces that are voluntarily included in proposed project designs, public agencies may still require: (i) spaces for car share vehicles; (ii) parking spaces to be shared with the public; or (iii) for the project to charge for parking. Nothing in AB 2097 shall reduce or eliminate the requirement that new developments provide for the installation of electric vehicle supply equipment (i.e., EV-charging stations) or to provide parking spaces accessible to persons with disabilities.

AB 2097 is intended to give developers more flexibility and lower the costs associated with development, which will – hopefully – result in an influx of housing and the redevelopment of vacant buildings where it may not have been previously feasible to provide parking in a quantity necessary to meet a jurisdiction’s minimum requirements. By reducing the oversupply of parking, there is the expectation that the use of mass transit will increase, thereby reducing traffic, greenhouse emissions and air pollution.

Critics of AB 2097 are concerned that the elimination of parking requirements could actually weaken local efforts to provide more affordable housing as many public agencies offer reductions in parking requirements to incentivize developers to add on-site affordable housing units to the project.[7] There is also concern that, despite the decrease in availability, many residents will continue to own vehicles, which – ironically – will lead to increase parking demand and congestion.

Although there is a lot of speculation of AB 2097, many are hopeful that it is a step in the right direction when it comes to addressing California’s housing crisis. As Governor Gavin Newsom stated when he signed the bill: “Reducing housing costs for everyday Californians and eliminating emissions from cars: That’s what we call a win-win.”

FOOTNOTES

[1] “High-Quality Transit Corridor” means a corridor with a fixed-route bus service with service intervals no longer than fifteen minutes during peak commute hours.

[2] “Major Transit Stop” means a site containing an existing rail or bus rapid transit station, a ferry terminal served by bus or rail, or the intersection of two or more major bus routes with a frequency of fifteen minutes or less during peak commute periods.

[3] Aguiar-Curry, Cecilia. Assembly Committee on Local Government – AB 2097 (Friedman) – As Introduced February 14, 2022. (April 20, 2022. )

[4] Inventorying San Francisco Bay Area Parking Spaces: Technical Report Describing Objectives, Methods, and Results. Mineta Transportation Institute – San Jose State University. (February 2022.)

[5] Some estimates place the aveage cost of one residential unit at $1,000,000 in development costs. (The Costs of Affordable Housing Production: Insights from California’s 9% Low-Income Housing Tax Credit Program. Terner Center for Housing Innovation – UC Berkley. A Terner Center Report [March 2020].)

[6] Dillon, Liam and Posten, Ben. Affordable Housing in California Now Routinely Tops $1 Million per Apartment to Build. Los Angeles Times. (June 2, 2022.)

[7] California Daily News.

Copyright © 2022, Sheppard Mullin Richter & Hampton LLP.

2022 Midterm Election Guide

The 2022 midterm elections produced modest, but perhaps still significant, changes to Congress. Democrats outperformed in many parts of the country, significantly stemming the tide of the “red wave” many analysts were expecting.

The results for partisan control of Congress remain in doubt.

The power balance in the U.S. Senate may not be known until next month, but the Democrats are seemingly poised to retain control. The Pennsylvania Senate seat flipped to the Democrats while Nevada could flip Republican with the Democratic incumbent currently behind. Three other Senate contests remain uncalled, with the incumbent party narrowly positioned to win all three. That would leave the Senate tied, waiting for the results of a Georgia run-off in December to determine which party controls the Senate.

The House of Representatives appears likely to shift to Republican control, but by the slimmest of margins. The final outcome and margins in the House will not be known until more votes are counted and several very close races are called. If Republicans win control of the House, as seems likely, it is unclear if their razor-thin majority—which could be between two and twelve seats—will allow their leaders to govern effectively.

To help assess the 2022 midterm election, we have prepared a comprehensive guide that summarizes the results and their impact on the 118th Congress, which convenes in January. The Election Guide lists all new members elected to Congress, updates the congressional delegations for each state, and provides a starting point for analyzing the coming changes to House and Senate committees, including potential new chairs and ranking members.

Our committee analysis assumes that the Democrats retain control in the Senate, but Republicans flip the House and chair committees.

Please click here to download the most up-to-date version of this Election Guide, which will be updated on an ongoing basis as more of the close races are called and committees are finalized.

Copyright 2022 K & L Gates

California PFAS Legislation Will Dramatically Impact Businesses

We previously reported on three significant pieces of California PFAS legislation that were before California’s Governor Newsom for ratification. Two of the bills were passed, which means that several categories of products will have applicable PFAS bans. The third bill was not signed by the Governor, which would have required companies to report certain data to the state for goods  sold in or otherwise brought into California that contain PFAS.

With increasing attention being given to PFAS in consumer goods in the media, scientific community, and in state legislatures, the California PFAS bills underscore the importance of companies anywhere in the manufacturing or supply chain for consumer goods to immediately assess the impact of the proposed PFAS legislation on corporate practices, and make decisions regarding continued use of PFAS in products, as opposed to substituting for other substances.  At the same time, companies impacted by the PFAS legislation must be aware that the new laws pose risks to the companies involvement in PFAS litigation in both the short and long term.

California PFAS Bills

One of our prior reports was on the first significant PFAS bill that Governor Newsom was expected to sign into law – AB 2771 – and which was indeed passed into law. The bill prohibits the manufacture, sale, delivery, hold, or offer for sale any cosmetics product that contains any intentionally added PFAS. The law would go into effect on January 1, 2025. The bill defines a cosmetics products as “an article for retail sale or professional use intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body for cleansing, beautifying, promoting attractiveness, or altering the appearance.”

The second bill signed into law by the Governor is AB 1817, which bans the use of PFAS in textiles manufactured and sold in California. More specifically, the bill prohibits, beginning January 1, 2025, any person from “manufacturing, distributing, selling, or offering for sale in the state any new, not previously owned, textile articles that contain regulated PFAS” and requires a manufacturer to use the least toxic alternative when removing PFAS in textile articles to comply with these provisions. The bill requires a manufacturer of a textile article to provide persons that offer the product for sale or distribution in the state with a certificate of compliance stating that the textile article is in compliance with these provisions and does not contain any regulated PFAS. The bill specifically regulates three categories of textiles:

(1) “Textile articles” means textile goods of a type customarily and ordinarily used in households and businesses, and include, but are not limited to, apparel, accessories, handbags, backpacks, draperies, shower curtains, furnishings, upholstery, beddings, towels, napkins, and tablecloths;

(2) “Outdoor apparel” means clothing items intended primarily for outdoor activities, including, but not limited to, hiking, camping, skiing, climbing, bicycling, and fishing; and

(3) “Apparel”, defined as “clothing items intended for regular wear or formal occasions, including, but not limited to, undergarments, shirts, pants, skirts, dresses, overalls, bodysuits, costumes, vests, dancewear, suits, saris, scarves, tops, leggings, school uniforms, leisurewear, athletic wear, sports uniforms, everyday swimwear, formal wear, onesies, bibs, diapers, footwear, and everyday uniforms for workwear…outdoor apparel and outdoor apparel for severe wet conditions.

The bill that California’s Governor vetoed was AB 2247, which would have established reporting requirements for companies that utilize products or substances that contain PFAS and which are used in California in the stream of commerce. “The bill would [have] require[d], on or before July 1, 2026, and annually thereafter, a manufacturer, as defined, of PFAS or a product or a product component containing intentionally added PFAS that, during the prior calendar year, is sold, offered for sale, distributed, or offered for promotional purposes in, or imported into, the state to register the PFAS or the product or product component containing intentionally added PFAS, and specified other information, on the publicly accessible data collection interface.”

Impact of California PFAS Legislation On Businesses

California PFAS legislation places some of the most significant and widely used consumer products in the crosshairs with respect to PFAS. While other states have banned or otherwise regulated PFAS in certain specific consumer goods, California’s bills are noteworthy given the economic impact that it will have, considering that California is the fifth largest economy in the world.

It is of the utmost importance for businesses along the whole cosmetics supply chain to evaluate their PFAS risk. Public health and environmental groups urge legislators to regulate these compounds. One major point of contention among members of various industries is whether to regulate PFAS as a class or as individual compounds.  While each PFAS compound has a unique chemical makeup and impacts the environment and the human body in different ways, some groups argue PFAS should be regulated together as a class because they interact with each other in the body, thereby resulting in a collective impact. Other groups argue that the individual compounds are too diverse and that regulating them as a class would be over restrictive for some chemicals and not restrictive enough for others.

Companies should remain informed so they do not get caught off guard. States are increasingly passing PFAS product bills that differ in scope. For any manufacturers, especially those who sell goods interstate, it is important to understand how those various standards will impact them, whether PFAS is regulated as individual compounds or as a class. Conducting regular self-audits for possible exposure to PFAS risk and potential regulatory violations can result in long term savings for companies and should be commonplace in their own risk assessment.

©2022 CMBG3 Law, LLC. All rights reserved.

Proposed Senate Bill Would Deny Deductions for NIL Contributions

On September 28, 2022, U.S. Senators Ben Cardin (D-Md.), a member of the Senate Finance Subcommittee on Taxation and Internal Revenue Service (IRS) Oversight, and John Thune (R-S.D.), ranking member of the Subcommittee on Taxation and IRS Oversight, introduced the Athlete Opportunity and Taxpayer Integrity Act, which seeks to deny charitable deductions for any contribution used by the donee to compensate college athletes for the use of their name, image, or likeness (“NIL”) by reason of their status as athletes.

One entity type that is impacted by the Athlete Opportunity and Taxpayer Integrity Act are “NIL collectives” that have been established as 501(c)(3) organizations.  These types of NIL collectives have been used to allow donors to make tax deductible contributions that are then used to fund NIL opportunities for college athletes, for example, by having a college athlete provide services to a separate charity in exchange for payment from the NIL collective.  A press release from Senator Cardin noted that “[s]uch activity is inconsistent with the intended purpose of the charitable tax deduction, and it forces taxpayers to subsidize the potential recruitment of – or payment to – college athletes based on their NIL status.”

Notably, the Opportunity and Taxpayer Integrity Act would only apply to charitable deductions.  A person engaged in a trade or business would still be able to deduct payments to college athletes for the use of their name, image, or likeness if such payments qualify as ordinary and necessary business expenses.

Although it is not clear at this time whether the Opportunity and Taxpayer Integrity Act will pass, it does indicate increased scrutiny over nonprofit NIL collectives and possibly other NIL arrangements.

© 2022 Varnum LLP

Why ‘Don’t Say Gay’ Bills are Antithetical to an Equitable and Inclusive Education

According to2019 GLSEN national survey of LGBTQ+ students, nearly 60% of surveyed students reported they felt unsafe at school because of their sexual orientation and 43% because of their gender expression. Within the same survey, nearly all (98.8%) LGBTQ+ students reported hearing “gay” used in a negative way at school, 95% heard other homophobic remarks, and 87% heard transphobic remarks.

When I was an educator, it was essential to my practice that all my students felt safe. If I were to hear any negative remarks about a student or become aware one of my students felt unsafe due to their identity, it would be my ethical, and moral, obligation to do something to create a safer and more inclusive learning environment; a core part of my role as an educator was to teach empathy and compassion in my students. This could be as simple as having a classroom discussion about the choices of language and how using words such as “gay” with a negative connotation can be hurtful to their classmates. This could also mean sharing my own identity as a queer man so my LGBTQ+ students knew they had someone they could turn to for support, and to normalize queer identities for all my students and their families. Either of these actions would require I discuss the importance of accepting all sexual orientations and gender identities.

In other words, I would have to say “gay.” But in six states — as of now — I would not have been able to do this.

The state of Florida attracted national attention earlier this year with the adoption of H.B. 1557, the “Parental Rights in Education” bill, more commonly known as the “Don’t Say Gay” bill. The bill, which has since been signed into law, dictates classroom instruction by “school staff” on “sexual orientation or gender identity may not occur in kindergarten through grade 3 or in a manner that is not age-appropriate or developmentally appropriate for students.” Five other states, according to the Movement Advancement Project, have similar laws enacted and several more have bills pending in their state legislatures. Some proponents of these bills argue the legislation is necessary to ensure parents have greater say when, if, and how LGBTQ+ issues are discussed with their children.

Yet these laws are designed to ensure only some parents have greater say, as the parents of LGBTQ+ children are certainly not reflected in these efforts.

At a time when youth mental health is reaching a crisis, state legislatures are advancing bills that would perpetuate, and arguably exacerbate, harmful school-based experiences for LGBTQ+ youth and worsen their well-being. A 2022 survey by the Trevor Project found 45% of LGBTQ+ youth seriously considered attempting suicide in the past year, and over half of transgender and nonbinary youth considered suicide. The 2019 GLSEN survey also found LGBTQ+ students who experienced forms of victimization based on their sexual orientation or gender identity (e.g., being bullied, hearing homophobic or transphobic remarks, etc.) had lower levels of self-esteem, higher levels of depression, and were less likely to say they belonged in school.

Some may argue “Don’t Say Gay” bills would not preclude educators from addressing instances of homophobia or transphobia in their classrooms and try to suggest that prohibitions on such actions are not the intent of the bills. However, regardless of intent, these bills often have the insidious impact to “chill” educators’ actions out of fear they may run afoul of the law and open themselves to reprimands, including being terminated.

All students deserve to have a safe, supportive, and affirming learning environment. All educators should be empowered to protect their students, and not feel afraid to step in when they notice a student being bullied because of their identity. And every parent should have the resources to be a partner in their child’s education. Unfortunately, state laws such as the “Don’t Say Gay” bills will only stand in way of these notions from becoming realities.

It is impossible to support all students when LGBTQ+ children continue to be targeted merely because of their identities.

Copyright ©2022 Nelson Mullins Riley & Scarborough LLP