Texas Legislature Passes Texas Data Privacy and Security Act

On
May
10,
2023,
the
Texas
Senate
passed

H.B.
4,
also
known
as
the
Texas
Data
Privacy
and
Security
Act
(“TDPSA”).
The
TDPSA
now
heads
to
Texas
Governor
Greg
Abbott
for
a
final
signature.
If
the
TDPSA
is
signed
into
law,
Texas
could
become
the
tenth
state
to
enact
comprehensive
privacy
legislation.

The
final
text
of
the
TDPSA
closely
follows

H.B.
1844,
which
we
previously
reported
on
when
it
was
introduced
in
the
Texas
House
in
February.
In
addition
to
the
provisions
of
H.B.
1844,
the
TDPSA:

• Revises
  the
  definition
  of
  personal
  data
  to
  include
  pseudonymous
  data
  only
  when
  the
  data
  is
  used
  by
  a
  controller
  or
  a
  processor
  in
  conjunction
  with
  additional
  information
  that
  reasonably
  links
  the
  data
  to
  an
  identified
  or
  an
  identifiable
  individual;
• Adds
  a
  requirement
  that
  if
  a
  controller
  sells
  sensitive
  or
  biometric
  data,
  the
  controller
  must
  disclose
  that
  fact
  in
  its
  privacy
  policy;
• Requires
  small
  businesses,
  as
  defined
  by
  the
  United
  States
  Small
  Business
  Administration,
  to
  receive
  consent
  from
  consumers
  before
  selling
  consumers’
  sensitive
  data;
• Directs
  the
  Texas
  Attorney
  General
  to
  provide
  (1)
  information
  outlining
  consumer
  rights
  and
  the
  responsibilities
  of
  controllers
  and
  processors
  under
  the
  TDPSA,
  and
  (2)
  an
  Internet
  mechanism
  for
  submitting
  consumer
  complaints;
  and
• Introduces
  prescriptive
  requirements
  for
  curing
  a
  violation.

If
enacted,
the
TDPSA
will
take
effect
on
March
1,
2024.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts