Texas Senate Bill SB768

Texas 2023 - 88th Regular

• Filed: 2/7/23
• Out of Senate Committee: 3/27/23
• Voted on by Senate: 4/3/23
• Out of House Committee: 5/5/23
• Voted on by House: 5/12/23
• Governor Action: 5/27/23

Caption

Relating to the process for notifying the attorney general of a breach of security of computerized data by persons doing business in this state.

Impact

The bill modifies Sections 521.053(i) and (j) of the Business and Commerce Code, establishing a structured and expedient notification process for businesses when they experience data breaches. This change is designed to provide the attorney general with timely information about breaches, enhancing the state's ability to monitor and respond to potential threats to cybersecurity. As a result, this legislative action reinforces the state’s commitment to data protection and consumer rights.

Summary

Senate Bill 768 (SB768) focuses on the process for notifying the attorney general regarding breaches of security involving computerized data by entities conducting business in Texas. The bill mandates that organizations must inform the attorney general of any such breaches involving at least 250 state residents within 30 days of determining a breach has occurred. This requirement is aimed at enhancing the accountability and response frameworks for data security incidents affecting Texan residents.

Sentiment

The sentiment surrounding SB768 appears to be generally positive, as it aims to strengthen legal protocols regarding data security. Legislators unanimously supported the bill during committee discussions and votes, reflecting a strong bipartisan agreement on the necessity of improved notification processes for data breaches. The sentiment underscores a consensus on the importance of protecting consumer data and ensuring that affected individuals receive timely notifications about possible risks.

Contention

While the bill successfully passed with overwhelming support, there may be underlying concerns regarding its implementation. Critics have sometimes questioned whether the stipulated time frame for notifications is too short for businesses, particularly for smaller entities that may lack robust cybersecurity measures. Additionally, the requirement for the attorney general's office to publish notifications raises questions about privacy for affected individuals, balancing public transparency with individual data protection.