Texas Reidentification of Deidentified Information
TX Bus & Com Code § 506.001, et seq.
Texas Statutes
Business and Commerce Code
Title 11 - Personal Identity Information
Subtitle A - Identifying Information
Chapter 506 - Reidentification of Deidentified Information
Section 506.001. Definitions
Section 506.002. Required Notices
Section 506.003. Prohibited Acts
Section 506.004. Offense
Section 506.005. Private Cause of Action
Section 506.006. Civil Penalty
Sec. 506.001 Definitions
In this chapter:
(1) “Covered information” means deidentified information released by a board, commission, department, or other agency of this state, including an institution of higher education as defined by Section 61.003 (Definitions), Education Code, or a hospital that is maintained or operated by the state.
(2) “Deidentified information” means information with respect to which the holder of the information has made a good faith effort to remove all personal identifying information or other information that may be used by itself or in combination with other information to identify the subject of the information. The term includes aggregate statistics, redacted information, information for which random or fictitious alternatives have been substituted for personal identifying information, and information for which personal identifying information has been encrypted and for which the encryption key is maintained by a person otherwise authorized to have access to the information in an identifiable format.
(3) “Personal identifying information” has the meaning assigned by Section 521.002 (Definitions)(a)(1).
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
Sec. 506.002 Required Notices
(a) An agency of this state shall provide written notice to a person to whom the agency releases deidentified information that the information is deidentified information.
(b) A person who sells covered information or otherwise receives compensation for the transfer or disclosure of covered information shall provide written notice to the person to whom the information is sold, transferred, or disclosed that the information is deidentified information obtained from an agency of this state.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
Sec. 506.003 Prohibited Acts
(a) A person may not:
(1) reidentify or attempt to reidentify personal identifying information about an individual who is the subject of covered information; or
(2) knowingly disclose or release covered information that was reidentified in violation of this section.
(b) It is a defense to a civil action or prosecution for a violation of this section that:
(1) the person:
(A) was reidentifying the covered information for the purpose of a study or other scholarly research, including performing an evaluation or test of software intended to deidentify information; and
(B) did not release or publish the names or other information identifying any subjects of the reidentified covered information; or
(2) the person obtained informed, written consent from the individual who is the subject of the covered information that specifically referenced the information to be reidentified, disclosed, or released, and authorized the reidentification, disclosure, or release of that information.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
Sec. 506.004 Offense
(a) A person who violates Section 506.003 (Prohibited Acts) commits an offense.
(b) An offense under this section is a Class A misdemeanor.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
Sec. 506.005 Private Cause of Action
A person who violates Section 506.003 (Prohibited Acts) is liable to the individual who is the subject of the covered information for statutory damages in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
Sec. 506.006 Civil Penalty
(a) In addition to other penalties and remedies assessed or recovered under this chapter, a person who violates Section 506.003 (Prohibited Acts) is liable to this state for a civil penalty in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
(b) The attorney general may bring an action to recover a civil penalty under this section.
(c) The attorney general is entitled to recover reasonable expenses incurred in bringing an action under this section, including reasonable attorney’s fees, court costs, and investigatory costs.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
For more information, see here: https://texas.public.law/statutes/tex._bus._and_com._code_title_11_subtitle_a_chapter_506
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.