Texas privacy law, breach-reporting deadline change add compliance duties for businesses
Texas adopted the Texas Data Privacy and Security Act in June 2023 and changed its breach notice rules to require faster reporting to the state attorney general.
Texas enacted a new consumer privacy law in June 2023 and shortened the deadline for reporting data breaches to the state attorney general, adding new compliance duties for covered businesses.
The Texas Data Privacy and Security Act is set to take effect July 1, 2024. A separate breach-reporting amendment takes effect Sept. 1, 2023.
Governor Greg Abbott signed H.B. 4 on June 18, 2023, creating the Texas Data Privacy and Security Act, according to the source. The source describes the law as a close cousin of Virginia’s privacy statute, but says Texas uses different applicability thresholds and is stricter on high-risk processing and consent for sensitive data.
The statute applies to certain businesses that conduct business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not small businesses under U.S. Small Business Administration rules. The source says Texas did not use revenue or volume thresholds. It also lists exemptions for Texas state agencies, political subdivisions, nonprofits, higher educational institutions, financial institutions, and some entities covered by GLBA or HIPAA, along with other sector-specific data governed by federal law.
The law defines personal data broadly to include information linked or reasonably linkable to an identified or identifiable person, including pseudonymous and sensitive data. It defines the sale of personal data to include sharing, disclosing or transferring data for monetary or other valuable consideration. Sensitive data includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, data from a known child under 18, and precise geolocation data, the source says.
The statute also gives data processors direct obligations. According to the source, processors must follow controller instructions and help with consumer rights requests, data protection assessments and breach notifications. Controller-processor contracts must include specified terms.
Texas also changed its breach notification law shortly before the privacy law was signed. Covered entities must report breaches to the Texas attorney general within 30 days of discovery, down from 60 days, and use an electronic form on the AG’s website, the source says. The amendment applies to Tex. Bus. & Com. Code Ann. §§ 521.002 and 521.053.
Enforcement under the Texas Data Privacy and Security Act rests exclusively with the Texas attorney general. The source says there is no private right of action. It also says the law includes a 30-day cure period, and uncured violations can lead to civil penalties of up to $7,500 per violation and/or injunctive relief, plus the attorney general’s reasonable fees and other expenses.
“The compliance patchwork continues,” the source quotes, reflecting the growing number of state privacy laws that businesses must track.
The breach-reporting amendment begins Sept. 1, 2023, and the Texas Data Privacy and Security Act begins July 1, 2024.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()