| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | A BILL TO BE ENTITLED |
|---|
| 6 | 6 | | AN ACT |
|---|
| 7 | 7 | | relating to state agency procedures and policies to protect and |
|---|
| 8 | 8 | | properly destroy certain information that identifies an |
|---|
| 9 | 9 | | individual. |
|---|
| 10 | 10 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 11 | 11 | | SECTION 1. Subtitle B, Title 10, Government Code, is |
|---|
| 12 | 12 | | amended by adding Chapter 2064 to read as follows: |
|---|
| 13 | 13 | | CHAPTER 2064. INDIVIDUAL-IDENTIFYING INFORMATION |
|---|
| 14 | 14 | | Sec. 2064.001. DEFINITION. In this chapter, "state agency" |
|---|
| 15 | 15 | | means a department, commission, board, office, council, authority, |
|---|
| 16 | 16 | | or other agency in the executive, legislative, or judicial branch |
|---|
| 17 | 17 | | of state government, including a university system or institution |
|---|
| 18 | 18 | | of higher education as defined by Section 61.003, Education Code, |
|---|
| 19 | 19 | | that is created by the constitution or a statute of this state. |
|---|
| 20 | 20 | | Sec. 2064.002. SECURITY FOR INDIVIDUAL-IDENTIFYING |
|---|
| 21 | 21 | | INFORMATION. Each state agency shall develop policies and |
|---|
| 22 | 22 | | procedures to properly secure all information, including |
|---|
| 23 | 23 | | electronic information and any electronic backup of that |
|---|
| 24 | 24 | | information, that alone or in conjunction with other information |
|---|
| 25 | 25 | | identifies an individual. The agency shall implement electronic |
|---|
| 26 | 26 | | security strategies developed by the Department of Information |
|---|
| 27 | 27 | | Resources under Chapter 2054 as appropriate. |
|---|
| 28 | 28 | | Sec. 2064.003. SECURE DESTRUCTION OF INFORMATION. A state |
|---|
| 29 | 29 | | agency shall destroy or arrange for the destruction of information |
|---|
| 30 | 30 | | that alone or in conjunction with other information identifies an |
|---|
| 31 | 31 | | individual and that is not required to be retained under other law |
|---|
| 32 | 32 | | in a manner that properly protects the information from disclosure, |
|---|
| 33 | 33 | | including by: |
|---|
| 34 | 34 | | (1) shredding; |
|---|
| 35 | 35 | | (2) erasing; or |
|---|
| 36 | 36 | | (3) otherwise modifying the sensitive information in |
|---|
| 37 | 37 | | the records to make the information unreadable or indecipherable |
|---|
| 38 | 38 | | through any means. |
|---|
| 39 | 39 | | SECTION 2. This Act takes effect September 1, 2015. |
|---|