Texas Data Breach Notification
Tex. Bus. & Com. Code § 521.002, § 521.053, § 521.151, § 521.152
CITATION:
Texas Statutes
Business and Commerce Code
Title 11 - Personal Identity Information
Subtitle B - Identity Theft
Chapter 521 - Unauthorized Use of Identifying Information
Subchapter A. General Provisions
Section 521.002. Definitions
521.002 Definitions
521.053 Notification Required Following Breach of Security of Computerized Data
Subchapter D. Remedies
521.151 Civil Penalty; Injunction
521.152 Deceptive Trade Practice
Sec. 521.002 Definitions
(a) In this chapter:
(1) “Personal identifying information” means information that alone or in conjunction with other information identifies an individual, including an individual’s:
(A) name, social security number, date of birth, or government-issued identification number;
(B) mother’s maiden name;
(C) unique biometric data, including the individual’s fingerprint, voice print, and retina or iris image;
(D) unique electronic identification number, address, or routing code; and
(E) telecommunication access device as defined by Section 32.51 (Fraudulent Use or Possession of Identifying Information), Penal Code.
(2) “Sensitive personal information” means, subject to Subsection (b):
(A) an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:
(i) social security number;
(ii) driver’s license number or government-issued identification number; or
(iii) account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or
(B) information that identifies an individual and relates to:
(i) the physical or mental health or condition of the individual;
(ii) the provision of health care to the individual; or
(iii) payment for the provision of health care to the individual.
(3) “Victim” means a person whose identifying information is used by an unauthorized person.
(b) For purposes of this chapter, the term “sensitive personal information” does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 419 (H.B. 2004), Sec. 1, eff. September 1, 2009.
Sec. 521.053 Notification Required Following Breach of Security of Computerized Data
(a) In this section, “breach of system security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data. Good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.
(b) A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
(b-1) If the individual whose sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person is a resident of a state that requires a person described by Subsection (b) to provide notice of a breach of system security, the notice of the breach of system security required under Subsection (b) may be provided under that state’s law or under Subsection (b).
(c) Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(d) A person may delay providing notice as required by Subsection (b) or (c) at the request of a law enforcement agency that determines that the notification will impede a criminal investigation. The notification shall be made as soon as the law enforcement agency determines that the notification will not compromise the investigation.
(e) A person may give notice as required by Subsection (b) or (c) by providing:
(1) written notice at the last known address of the individual;
(2) electronic notice, if the notice is provided in accordance with 15 U.S.C. Section 7001; or
(3) notice as provided by Subsection (f).
(f) If the person required to give notice under Subsection (b) or (c) demonstrates that the cost of providing notice would exceed $250,000, the number of affected persons exceeds 500,000, or the person does not have sufficient contact information, the notice may be given by:
(1) electronic mail, if the person has electronic mail addresses for the affected persons;
(2) conspicuous posting of the notice on the person’s website; or
(3) notice published in or broadcast on major statewide media.
(g) Notwithstanding Subsection (e), a person who maintains the person’s own notification procedures as part of an information security policy for the treatment of sensitive personal information that complies with the timing requirements for notice under this section complies with this section if the person notifies affected persons in accordance with that policy.
(h) If a person is required by this section to notify at one time more than 10,000 persons of a breach of system security, the person shall also notify each consumer reporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices. The person shall provide the notice required by this subsection without unreasonable delay.
(i) A person who is required to disclose or provide notification of a breach of system security under this section shall notify the attorney general of that breach not later than the 60th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state. The notification under this subsection must include:
(1) a detailed description of the nature and circumstances of the breach or the use of sensitive personal information acquired as a result of the breach;
(2) the number of residents of this state affected by the breach at the time of notification;
(3) the measures taken by the person regarding the breach;
(4) any measures the person intends to take regarding the breach after the notification under this subsection; and
(5) information regarding whether law enforcement is engaged in investigating the breach.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 419 (H.B. 2004), Sec. 3, eff. September 1, 2009.
Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 14, eff. September 1, 2012.
Acts 2013, 83rd Leg., R.S., Ch. 1368 (S.B. 1610), Sec. 1, eff. June 14, 2013.
Acts 2019, 86th Leg., R.S., Ch. 1326 (H.B. 4390), Sec. 1, eff. January 1, 2020.
Sec. 521.151 Civil Penalty; Injunction
(a) A person who violates this chapter is liable to this state for a civil penalty of at least $2,000 but not more than $50,000 for each violation. The attorney general may bring an action to recover the civil penalty imposed under this subsection.
(a-1) In addition to penalties assessed under Subsection (a), a person who fails to take reasonable action to comply with Section 521.053 (Notification Required Following Breach of Security of Computerized Data)(b) is liable to this state for a civil penalty of not more than $100 for each individual to whom notification is due under that subsection for each consecutive day that the person fails to take reasonable action to comply with that subsection. Civil penalties under this section may not exceed $250,000 for all individuals to whom notification is due after a single breach. The attorney general may bring an action to recover the civil penalties imposed under this subsection.
(b) If it appears to the attorney general that a person is engaging in, has engaged in, or is about to engage in conduct that violates this chapter, the attorney general may bring an action in the name of the state against the person to restrain the violation by a temporary restraining order or by a permanent or temporary injunction.
(c) An action brought under Subsection (b) must be filed in a district court in Travis County or:
(1) in any county in which the violation occurred; or
(2)i n the county in which the victim resides, regardless of whether the alleged violator has resided, worked, or transacted business in the county in which the victim resides.
(d) The attorney general is not required to give a bond in an action under this section.
(e) In an action under this section, the court may grant any other equitable relief that the court considers appropriate to:
(1) prevent any additional harm to a victim of identity theft or a further violation of this chapter; or
(2) satisfy any judgment entered against the defendant, including issuing an order to appoint a receiver, sequester assets, correct a public or private record, or prevent the dissipation of a victim’s assets.
(f) The attorney general is entitled to recover reasonable expenses, including reasonable attorney’s fees, court costs, and investigatory costs, incurred in obtaining injunctive relief or civil penalties, or both, under this section. Amounts collected by the attorney general under this section shall be deposited in the general revenue fund and may be appropriated only for the investigation and prosecution of other cases under this chapter.
(g) The fees associated with an action under this section are the same as in a civil case, but the fees may be assessed only against the defendant.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 15, eff. September 1, 2012.
Sec. 521.152 Deceptive Trade Practice
A violation of Section 521.051 (Unauthorized Use or Possession of Personal Identifying Information) is a deceptive trade practice actionable under Subchapter E, Chapter 17 (Deceptive Trade Practices).
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
For more information, see here: https://texas.public.law/statutes/tex._bus._and_com._code_section_521.002
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.