Which of these pieces of information can be found in the Pennsylvania consumer notice?

Landscapers whose work is limited to services performed under Pennsylvania’s Plant Pest Act do not need to register.  However, landscapers who perform other work at private residences including, but not limited to: the placement of retaining walls, fountains or drainage systems, or the construction, replacement, installation or improvement of buildings, driveways, swimming pools, porches, garages, roofs, siding, insulation, solar energy systems, security systems, flooring, patios, non-decorative fences, doors, lighting systems, concrete walkways and windows must register and comply with the act.

Yes:  HICPA was amended on October 22, 2014, to allow contractors to offer time and materials contracts to Pennsylvania consumers, provided the contractor:

Informs the consumer in writing that the time and materials contract will not exceed 10% above an initial cost estimate agreed to by the homeowner; and

Informs the consumer in writing that any cost beyond the contract price (initial cost estimate plus 10%) must be agreed to by the homeowner in a written change order.

The amendment added a definition of time and materials:

“Time and materials.”  A construction practice where the contractor and owner agree that the contractor will perform the home improvement and the owner will pay the contractor under the home improvement contract based on the actual cost of labor at a specified hourly rate and the actual costs of materials and use of equipment, plus an agreed upon percentage of the total actual costs or a fixed amount, over and above the actual costs, to cover the contractor’s fee and overhead costs reasonably incurred in the performance of the home improvement.

The amendment also requires additional written disclosures about the cost of “time and materials” contracts in the form of a written initial cost estimate and within the actual home improvement contract.  Section 517.7(a)(8) requires the following elements in order for a “time and materials” contract to be valid and enforceable, along with all the other requirements set forth in Section 517.7(a):

(8) Includes . . . a time and materials provision wherein contractor and owner agree in writing to the performance of the home improvement by the contractor and payment for the home improvement by the owner, based on time and materials.  If the contract includes a time and materials provision:
(i) The contractor shall provide an initial cost estimate in writing to the owner before any performance of the home improvement commences.
(ii) The contract shall state:
(A) The dollar value of the initial cost estimate for the services to be performed under the time and materials provision.
(B) That the cost of the services to be performed under the time and materials provision may not exceed 10% above the dollar value indicated in the initial cost estimate.
(C) The total potential cost of the services to be performed under the time and materials provision, including the initial cost estimate and the 10% referenced in clause (B), expressed in actual dollars.
(D) A statement that the cost of the services to be performed under the time and materials provision shall not be increased over the initial cost estimate plus a 10% increase without a written change order signed by the owner and contractor.

April 22, 2021

Hinshaw Privacy & Cyber Bytes

A new data protection and privacy bill (HB 1126) was recently introduced in Pennsylvania. Although not as robust as the California Consumer Privacy Act (CCPA), the proposed Consumer Data Privacy Act (the Act) would similarly give consumers in Pennsylvania more control over their personal information. It would also impose a series of requirements on covered businesses and create a private right of action following a 30-day cure period. If approved, the Act would go into effect immediately. 

To whom would it apply?

The Act would apply to for-profit businesses that: 

• Do business in Pennsylvania;
• Collect, sell, or share consumers' personal information;
• Alone, or jointly with others, determine the purposes and means of processing consumers' personal information; and
• Meet at least one of the following thresholds:

1.  Have an annual gross revenue of at least $10 million;
2. Annually buys, sells, or shares, alone or in combination, the personal information of 50,000 consumers, households, or devices; or
3. Derives 50% of its annual revenues from the sale of consumers' personal information.

What types of information would it cover?

Under the Act, personal information would include: 

• Identifiers
  • Real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number, or passport number, or other similar identifiers
• Characteristics of protected classifications under state or federal law
• Commercial information
  • Personal property records, and products or services purchased, obtained, or considered
• Biometric information
• Internet activity
• Geolocation data
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information
• Certain education information
• Inferences drawn from other personal information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behaviors, attitudes, intelligence, abilities, and aptitudes 

The following publicly available information would not be considered personal information: 

• Information that is lawfully made available from Federal, State, or local government records, as restricted by any conditions associated with the information
• Biometric information collected by a business about a consumer without the consumer's knowledge or consumer information that is de-identified or aggregate consumer information

However, to maintain the "publicly available" meaning, the information could not be used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained.

What rights would it create?

The Act would create various consumer rights, including the right to: 

• Know what personal information is being collected about the consumer;
• Know whether the consumer's personal information is sold or disclosed and to whom;
• Request to delete personal information;
• Decline or opt-out of the sale of the consumer's personal information;
• Access the consumer's personal information that has been collected; and
• Equal service and price, even if a consumer exercises any of its rights.

What obligations would it impose?

Upon request from a consumer, the Act would require a business that collects personal information about a consumer to disclose the:

• Categories of personal information collected;

• Categories of sources from which the personal information is collected;
• Business or commercial purpose for collecting or selling personal information;
• Categories of third parties with whom the business shares personal information; and
• Specific pieces of personal information the business has collected about the consumer.

Upon request from a consumer, a business that sells or discloses the personal information of consumers will be required to disclose the:

• Categories of personal information collected;
• Categories of personal information sold and the categories of third parties to whom the information was sold; and
• Categories of personal information that the business disclosed about the consumer for business purposes.

A business that sells the personal information of consumers must notify them that their personal information may be sold and give them the option to opt-out of a sale. Relatedly, a third-party who purchases consumers' personal information may not sell that information unless consumers have been provided with notice that their personal information may be sold and have been given the option of opting out of a sale.

To comply with its notice obligations, a business that collects or sells the personal information of consumers must provide two or more methods for consumers to submit requests, including, at a minimum, a toll-free telephone number and website address if the business maintains a publicly accessible website. If the business maintains a website, it must provide:

• A "clear and conspicuous" link on the website, title "Do Not Sell My Personal Information," that enables a consumer to opt-out of the sale of the consumer's personal information; and
• A description of a consumer's rights.

A business that collects personal information must notify consumers of their right to request deletion. Upon request from a consumer, a business must delete the personal information of the consumer that it has collected.

In addition, a business must ensure that all employees who handle consumer inquiries about the business's privacy practices know how to direct a consumer to exercise their rights.

Like other similar legislation, the Act does not restrict a business's ability to:

• Comply with Federal, State, or local laws.

• Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by Federal, State, or local authorities.
• Cooperate with law enforcement agencies concerning conduct or activity that the business, service provider, or third party reasonably and in good faith believes may violate Federal, State, or local laws.
• Exercise or defend legal claims.
• Collect, use, retain, sell or disclose consumer information that is de-identified or in the aggregate consumer information.
• Collect or sell a consumer's personal information if every aspect of that commercial conduct takes place wholly outside of Pennsylvania.

How would it be enforced?

The Attorney General's Office would enforce the Act. A business violates the Act if it fails to cure an alleged violation within 30 days after being notified of the violation. A violation may result in a civil penalty of up to $7,500 per violation.

The Act also creates a private right of action for violations that result in unauthorized access and exfiltration, theft, or disclosure of a consumer's nonencrypted or nonredacted personal information. The consumer must provide a 30 day notice setting forth the specific provision(s) of the Act allegedly violated. If the business fails to cure, money damages—totaling no more than $750 or actual damages per consumer—may be recovered, injunctive relief, or any other relief the court deems appropriate.

Where does it stand?

The Act was introduced to the House on April 7, 2021. It was subsequently referred to the Committee on Consumer Affairs.

What is a consumer notice in PA?

What is the purpose of the Pennsylvania consumer Notice quizlet?

Which of the following do Pennsylvania licensees owe to all consumers regardless of agency relationships?

Which is considered a primary responsibility of a designated transaction broker?