Texas 2009 - 81st Regular

Texas Senate Bill SB327 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	81R2683 CLG-D
2	2	By: Van de Putte S.B. No. 327
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to a business's duty to protect sensitive personal
8	8	information contained in its customer records.
9	9	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
10	10	SECTION 1. Section 521.052, Business & Commerce Code, as
11	11	effective April 1, 2009, is amended to read as follows:
12	12	Sec. 521.052. BUSINESS DUTY TO PROTECT SENSITIVE PERSONAL
13	13	INFORMATION. (a) In this section:
14	14	(1) "Access device" means a card or device issued by a
15	15	financial institution that contains a magnetic stripe,
16	16	microprocessor chip, or other means for storing information. The
17	17	term includes a credit card, debit card, or stored value card.
18	18	(2) "Breach of system security" has the meaning
19	19	assigned by Section 521.053.
20	20	(3) "Financial institution" has the meaning assigned
21	21	by 15 U.S.C. Section 6809.
22	22	(b) A business shall implement and maintain reasonable
23	23	procedures, including taking any appropriate corrective action, to
24	24	protect from unlawful use or disclosure any sensitive personal
25	25	information collected or maintained by the business in the regular
26	26	course of business.
27	27	(c) A business that, in the regular course of business and
28	28	in connection with an access device, collects sensitive personal
29	29	information or stores or maintains sensitive personal information
30	30	in a structured database or unstructured files must comply with
31	31	payment card industry data security standards.
32	32	(d) [(b)] A business shall destroy or arrange for the
33	33	destruction of customer records containing sensitive personal
34	34	information within the business's custody or control that are not
35	35	to be retained by the business by:
36	36	(1) shredding;
37	37	(2) erasing; or
38	38	(3) otherwise modifying the sensitive personal
39	39	information in the records to make the information unreadable or
40	40	indecipherable through any means.
41	41	(e) A financial institution may bring an action against a
42	42	business that is subject to a breach of system security if, at the
43	43	time of the breach, the business is in violation of Subsection (c).
44	44	A court may not certify an action brought under this subsection as a
45	45	class action.
46	46	(f) Before filing an action under Subsection (e), a
47	47	financial institution must provide to the business written notice
48	48	requesting that the business provide certification or an assessment
49	49	of the business's compliance with payment card industry data
50	50	security standards. The certification or assessment must be issued
51	51	by a payment card industry-approved auditor or another person
52	52	authorized to issue that certification or assessment under payment
53	53	card industry data security standards. The court shall, on a
54	54	motion, dismiss an action brought under Subsection (e) with
55	55	prejudice to the refiling of the action if the business provides to
56	56	the financial institution the certification or assessment of
57	57	compliance required under this subsection not later than the 30th
58	58	day after receiving the notice.
59	59	(g) A presumption that a business has complied with
60	60	Subsection (c) exists if:
61	61	(1) the business contracts for or otherwise uses the
62	62	services of a third party to collect, maintain, or store sensitive
63	63	personal information in connection with an access device;
64	64	(2) the business requires that the third party attest
65	65	to or offer proof of compliance with payment card industry data
66	66	security standards; and
67	67	(3) the business contractually requires the third
68	68	party's continued compliance with payment card industry data
69	69	security standards.
70	70	(h) A financial institution that brings an action under
71	71	Subsection (e) may obtain actual damages arising from the
72	72	violation. Actual damages include any cost incurred by the
73	73	financial institution in connection with:
74	74	(1) the cancellation or reissuance of an access device
75	75	affected by the breach;
76	76	(2) the closing of a deposit, transaction, share
77	77	draft, or other account affected by the breach and any action to
78	78	stop payment or block a transaction with respect to the account;
79	79	(3) the opening or reopening of a deposit,
80	80	transaction, share draft, or other account affected by the breach;
81	81	(4) a refund or credit made to an account holder to
82	82	cover the cost of any unauthorized transaction related to the
83	83	breach; and
84	84	(5) the notification of account holders affected by
85	85	the breach.
86	86	(i) In an action brought under Subsection (e), the court
87	87	shall award the prevailing party reasonable attorney's fees and
88	88	costs, except that a business may not be awarded reasonable
89	89	attorney's fees and costs unless the court is presented proof that
90	90	the business provided the certification or assessment of compliance
91	91	with security standards to the financial institution within the
92	92	period prescribed by Subsection (f).
93	93	(j) [(c)] This section does not apply to a financial
94	94	institution, except that a financial institution that is injured
95	95	following a breach of system security of a business's computerized
96	96	data may bring an action under Subsection (e) and may be held liable
97	97	for attorney's fees and costs for an action brought under that
98	98	subsection as provided by Subsection (i) [as defined by 15 U.S.C.
99	99	Section 6809].
100	100	SECTION 2. This Act takes effect January 1, 2011.