On May 28, 2023, the Texas legislature passed the Texas Data Privacy and Security Act, making it the sixth state to pass a comprehensive data privacy law this year. The Act shares many similarities with Virginia, although there are some distinctions. If signed into law, the Act would take effect on July 1, 2024. This blog post summarizes the Act’s key takeaways.
- Scope: The Act applies to a person that (1) conducts business in Texas or produces products or services consumed by Texas residents, and (2) processes or engages in the sale of personal data (“sale” means a disclosure of personal data to a third party for “monetary or other valuable consideration”). The second prong of this language is not found in other comprehensive state privacy laws and so does not have a well-settled interpretation. The scope of the Act also excludes a small business as defined by the United States Small Business Administration, except with respect to the provision that requires small businesses to obtain consumer consent prior to selling sensitive data.
- Consumer Rights: Consumers have rights to: (1) confirm whether a controller is processing their personal data and access such personal data; (2) correct inaccuracies in the consumer ’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of the consumer’s personal data and (5) opt-out of processing for purposes of (a) targeted advertising (defined as displaying advertisements that are selected based on the consumer’s activities over time and across nonaffiliated websites), (b) the sale of personal data; or (c) profiling (definition is limited to “solely automated processing”) in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. The Act also requires controllers to implement opt-out preference signals by January 1, 2025.
- Sensitive Data: Controllers must obtain consent before processing a consumer’s sensitive data. Sensitive data is defined as personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to identify individuals; personal data collected from a known child; and precise geolocation data (i.e., identifies a consumer within a radius of 1,750 ft.). If a controller sells sensitive data or biometric data, it must post a specific notice (i.e., “NOTICE: We may sell your [sensitive/biometric] personal data.”) in its privacy notice.
- Controller & Processor Contracts: The Act uses the terms “controller” and “processor.” Under the Act, processors must assist controllers in meeting their obligations, including responding to consumer requests and conducting data protection assessments. The Act would require certain contractual terms between controllers and processors, including those requiring the processor to maintain a duty of confidentiality.
- Data Protection Assessments: The Act requires controllers to conduct data protection assessments of processing activities that involve targeted advertising, the sale of personal data, profiling (in limited circumstances), sensitive data, or otherwise present a heightened risk of harm to consumers.
- Enforcement & Cure: The Texas Attorney General has the exclusive authority to enforce the Act. The Act provides controllers and processors with a 30-day cure period, which would not expire.