Texas 2021 - 87th Regular

Texas Senate Bill SB15 Compare Versions

OldNewDifferences
1-S.B. No. 15
1+87R25816 JXC-D
2+ By: Nichols, et al. S.B. No. 15
3+ (King of Parker)
4+ Substitute the following for S.B. No. 15: No.
25
36
7+ A BILL TO BE ENTITLED
48 AN ACT
59 relating to the Texas Consumer Privacy Act Phase I; creating
610 criminal offenses; increasing the punishment for an existing
711 criminal offense.
812 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
913 SECTION 1. This Act may be cited as the Texas Consumer
1014 Privacy Act Phase I.
1115 SECTION 2. Section 11.030, Parks and Wildlife Code, is
1216 amended by amending Subsections (a) and (c) and adding Subsections
1317 (e-1), (e-2), and (e-3) to read as follows:
1418 (a) The name and address and a telephone, social security,
1519 driver's license, bank account, credit card, or charge card number
1620 of a person who purchases customer products, licenses, or services
1721 from the department may not be disclosed, sold, rented, or traded
1822 except as authorized under this section or Section 12.0251.
1923 (c) The commission by rule shall adopt policies relating to:
2024 (1) the release of the customer information; and
2125 (2) the use of the customer information by the
2226 department[; and
2327 [(3) the sale of a mailing list consisting of the names
2428 and addresses of persons who purchase customer products, licenses,
2529 or services].
2630 (e-1) The department may disclose statistical data and
2731 compilations of customer information described by Subsection (a) if
2832 the information does not reveal information identifying a specific
2933 department customer or a department customer's address, telephone
3034 number, social security number, or driver's license number.
3135 (e-2) The department may disclose customer information
3236 described by Subsection (a) only:
3337 (1) to another governmental body, including a law
3438 enforcement entity, as needed to carry out a governmental purpose;
3539 (2) if the customer that is the subject of the
3640 information consents in writing to the specific disclosure; or
3741 (3) if the information is:
3842 (A) part of a record that is considered to be a
3943 public record under Section 31.039; or
4044 (B) authorized to be disclosed under Section
4145 31.0391.
4246 (e-3) This section does not authorize the department to
4347 disclose information the department is prohibited from disclosing
4448 by other law.
4549 SECTION 3. Section 204.011(a), Transportation Code, is
4650 amended to read as follows:
4751 (a) The [Except as provided by this section or a rule
4852 adopted by the commission under this section, the] department may
4953 not disclose to any person the name, address, telephone number,
5054 social security account number, driver's license number, bank
5155 account number, credit or debit card number, or charge account
5256 number of a person who:
5357 (1) is or has been a subscriber to "Texas Highways"; or
5458 (2) has purchased from the department a promotional
5559 item described by Section 204.009.
5660 SECTION 4. Section 548.601(a), Transportation Code, is
5761 amended to read as follows:
5862 (a) A person, including an inspector or an inspection
5963 station, commits an offense if the person:
6064 (1) submits information to the department's inspection
6165 database or issues a vehicle inspection report with knowledge that
6266 the submission or issuance is in violation of this chapter or rules
6367 adopted under this chapter;
6468 (2) falsely or fraudulently represents to the owner or
6569 operator of a vehicle that equipment inspected or required to be
6670 inspected must be repaired, adjusted, or replaced for the vehicle
6771 to pass an inspection;
6872 (3) misrepresents:
6973 (A) material information in an application in
7074 violation of Section 548.402 or 548.403; or
7175 (B) information filed with the department under
7276 this chapter or as required by department rule;
7377 (4) submits information to the department's inspection
7478 database or issues a vehicle inspection report:
7579 (A) without authorization to issue the report or
7680 submit the information; or
7781 (B) without inspecting the vehicle;
7882 (5) submits information to the department's inspection
7983 database indicating that a vehicle has passed the applicable
8084 inspections or issues a passing vehicle inspection report for a
8185 vehicle with knowledge that the vehicle has not been repaired,
8286 adjusted, or corrected after an inspection has shown a repair,
8387 adjustment, or correction to be necessary;
8488 (6) knowingly submits information to the department's
8589 inspection database or issues a vehicle inspection report:
8690 (A) for a vehicle without conducting an
8791 inspection of each item required to be inspected; or
8892 (B) for a vehicle that is missing an item
8993 required to be inspected or that has an item required to be
9094 inspected that is not in compliance with state law or department
9195 rules;
9296 (7) refuses to allow a vehicle's owner to have a
9397 qualified person of the owner's choice make a required repair,
9498 adjustment, or correction;
9599 (8) charges for an inspection an amount greater than
96100 the authorized fee;
97101 (9) discloses or sells information collected in
98102 relation to the vehicle inspection program under this chapter about
99103 a unique customer or a unique vehicle owner to a person other than
100104 the department or the person who is the subject of the information,
101105 including a customer or vehicle owner's name, address, or phone
102106 number; or
103107 (10) [(9)] performs an act prohibited by or fails to
104108 perform an act required by this chapter or a rule adopted under this
105109 chapter.
106110 SECTION 5. Section 730.003, Transportation Code, is amended
107111 by adding Subdivision (1-a) and amending Subdivision (6) to read as
108112 follows:
109113 (1-a) "Authorized recipient" means a person who is
110114 permitted to receive and use personal information from an agency in
111115 a manner authorized by this chapter.
112116 (6) "Personal information" means information that
113117 identifies a person, including an individual's photograph or
114118 computerized image, social security number, date of birth, driver
115119 identification number, name, address, but not the zip code, e-mail
116120 address, telephone number, and medical or disability information.
117121 The term does not include:
118122 (A) information on vehicle accidents, driving or
119123 equipment-related violations, or driver's license or registration
120124 status; or
121125 (B) information contained in an accident report
122126 prepared under:
123127 (i) Chapter 550; or
124128 (ii) former Section 601.004 before
125129 September 1, 2017.
126130 SECTION 6. Section 730.006, Transportation Code, is amended
127131 to read as follows:
128132 Sec. 730.006. REQUIRED DISCLOSURE WITH CONSENT. Personal
129133 information obtained by an agency in connection with a motor
130134 vehicle record shall be disclosed to a requestor who:
131135 (1) is the subject of the information; or
132136 (2) demonstrates, in such form and manner as the
133137 agency requires, that the requestor has obtained the written
134138 consent of the person who is the subject of the information.
135139 SECTION 7. The heading to Section 730.007, Transportation
136140 Code, is amended to read as follows:
137141 Sec. 730.007. PERMITTED DISCLOSURES OF CERTAIN PERSONAL
138142 INFORMATION.
139143 SECTION 8. Section 730.007, Transportation Code, is amended
140- by amending Subsection (a) and adding Subsections (a-1), (a-2), and
141- (g) to read as follows:
144+ by amending Subsection (a) and adding Subsections (a-1) and (g) to
145+ read as follows:
142146 (a) Personal information obtained by an agency in
143147 connection with a motor vehicle record may be disclosed to any
144148 requestor by an agency if the requestor:
145149 (1) provides the requestor's name and address and any
146150 proof of that information required by the agency; and
147151 (2) represents that the use of the personal
148152 information will be strictly limited to:
149153 (A) use by:
150154 (i) a government agency, including any
151155 court or law enforcement agency, in carrying out its functions; or
152156 (ii) a private person or entity acting on
153157 behalf of a government agency in carrying out the functions of the
154158 agency;
155159 (B) use in connection with a matter of:
156160 (i) motor vehicle or motor vehicle operator
157161 safety;
158162 (ii) motor vehicle theft;
159163 (iii) motor vehicle product alterations,
160164 recalls, or advisories;
161165 (iv) performance monitoring of motor
162166 vehicles, motor vehicle parts, or motor vehicle dealers; or
163167 (v) [motor vehicle market research
164168 activities, including survey research; or
165169 [(vi)] removal of nonowner records from the
166170 original owner records of motor vehicle manufacturers;
167171 (C) use in the normal course of business by a
168172 legitimate business or an authorized agent of the business, but
169173 only:
170174 (i) to verify the accuracy of personal
171175 information submitted by the individual to the business or the
172176 agent of the business; and
173177 (ii) if the information is not correct, to
174178 obtain the correct information, for the sole purpose of preventing
175179 fraud by, pursuing a legal remedy against, or recovering on a debt
176180 or security interest against the individual;
177181 (D) use in conjunction with a civil, criminal,
178182 administrative, or arbitral proceeding in any court or government
179183 agency or before any self-regulatory body, including service of
180184 process, investigation in anticipation of litigation, execution or
181185 enforcement of a judgment or order, or under an order of any court;
182186 (E) use in research or in producing statistical
183187 reports, but only if the personal information is not published,
184188 redisclosed, or used to contact any individual;
185189 (F) use by an insurer, [or] insurance support
186190 organization, or [by a] self-insured entity, or an authorized agent
187191 of an insurer, insurance support organization, or self-insured
188192 entity [the entity], in connection with claims processing or
189193 investigation activities, antifraud activities, rating, or
190194 underwriting;
191195 (G) use in providing notice to an owner of a
192196 vehicle that was towed or impounded and is in the possession of a
193197 vehicle storage facility;
194198 (H) use by a licensed private investigator agency
195199 or licensed security service for a purpose permitted under this
196200 section;
197201 (I) use by an employer or an agent or insurer of
198202 the employer to obtain or verify information relating to a holder of
199203 a commercial driver's license that is required under 49 U.S.C.
200204 Chapter 313;
201205 (J) use in connection with the operation of a
202206 [private] toll transportation facility or another type of
203207 transportation project described by Section 370.003;
204208 (K) use by a consumer reporting agency, as
205209 defined by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et
206210 seq.), for a purpose permitted under that Act;
207211 (L) use by a motor vehicle manufacturer,
208212 dealership, or distributor, or an agent of or provider of services
209213 to a motor vehicle manufacturer, dealership, or distributor, for
210214 motor vehicle market research activities, including survey
211215 research;
212216 (M) use in the ordinary course of business by a
213217 person or authorized agent of a person who:
214218 (i) holds a salvage vehicle dealer license
215219 issued under Chapter 2302, Occupations Code;
216220 (ii) holds an independent motor vehicle
217221 dealer or wholesale motor vehicle auction general distinguishing
218222 number issued under Chapter 503 of this code;
219223 (iii) holds a used automotive parts
220224 recycler license issued under Chapter 2309, Occupations Code; or
221225 (iv) is licensed by, registered with, or
222226 subject to regulatory oversight by the Texas Department of Motor
223227 Vehicles, the Texas Department of Banking, the Department of
224228 Savings and Mortgage Lending, the Credit Union Department, the
225229 Office of Consumer Credit Commissioner, the Texas Department of
226230 Insurance, the Board of Governors of the Federal Reserve System,
227231 the Office of the Comptroller of the Currency, the Federal Deposit
228232 Insurance Corporation, the Consumer Financial Protection Bureau,
229233 or the National Credit Union Administration; or
230234 (N) use by an employer, principal, general
231235 contractor, nonprofit organization, charitable organization, or
232236 religious institution to obtain or verify information relating to a
233237 person who holds a driver's license or the driving history of a
234238 person who holds a driver's license if the person is employed by,
235239 works under a contract with, or volunteers for the employer,
236240 principal, contractor, organization, or institution [(L) use for
237241 any other purpose specifically authorized by law that relates to
238242 the operation of a motor vehicle or to public safety].
239243 (a-1) Personal information obtained by the Texas Department
240244 of Motor Vehicles in connection with a motor vehicle record may be
241245 disclosed:
242246 (1) when referring potential violations to the Texas
243247 Office of Consumer Credit Commissioner, the Department of Public
244- Safety, law enforcement agencies, or the comptroller, if the
245- personal information is necessary for carrying out regulatory
246- functions;
248+ Safety, or the comptroller, if the personal information is
249+ necessary for carrying out regulatory functions; or
247250 (2) to the attorney general as part of a response by
248251 the Texas Department of Motor Vehicles to a subpoena or a discovery
249252 request, if the personal information is necessary for litigation
250- purposes; or
251- (3) to a county assessor-collector if the personal
252- information is related to a finding from an audit or investigation
253- conducted under Section 520.010.
254- (a-2) Subsection (a)(2)(C) does not authorize the
255- disclosure of personal information to a natural person who is not a
256- business licensed by, registered with, or subject to regulatory
257- oversight by a government agency.
253+ purposes.
258254 (g) An agency may request that an authorized recipient or
259255 other person in possession of personal information disclosed for a
260256 use authorized by this section provide to the agency information
261257 sufficient for the agency to determine whether the authorized
262258 recipient or person has complied with this chapter, agency rules,
263259 or other law that applies to the disclosed personal information.
264260 The authorized recipient or person shall provide the requested
265261 information not later than the fifth business day after the date the
266262 agency submits the request unless the agency extends the deadline
267263 to provide a reasonable period to produce the requested
268264 information.
269265 SECTION 9. Chapter 730, Transportation Code, is amended by
270- adding Sections 730.0121, 730.0122, and 730.0123 to read as
271- follows:
266+ adding Sections 730.0121 and 730.0122 to read as follows:
272267 Sec. 730.0121. DELETION OF INFORMATION REQUIRED IF NOT
273268 AUTHORIZED RECIPIENT. An agency by rule shall require a requestor
274269 to delete from the requestor's records personal information
275270 received from the agency under this chapter if the requestor
276271 becomes aware that the requestor is not an authorized recipient of
277272 that information.
278- Sec. 730.0122. SALE PROHIBITED. (a) A person may not sell
279- to a person who is not an authorized recipient personal information
280- obtained by an agency in connection with a motor vehicle record.
281- (b) A person commits an offense if the person violates
282- Subsection (a). An offense under this subsection is a misdemeanor
283- punishable by a fine not to exceed $100,000.
284- Sec. 730.0123. CIVIL SUIT. (a) A person who sells to a
285- person who is not an authorized recipient personal information
286- obtained by an agency in connection with a motor vehicle record is
287- liable to the person who is the subject of the information for:
273+ Sec. 730.0122. CIVIL SUIT. (a) A person who discloses for
274+ compensation to a person who is not an authorized recipient
275+ personal information obtained by an agency in connection with a
276+ motor vehicle record is liable to the person who is the subject of
277+ the information for:
288278 (1) actual damages;
289279 (2) if the actual damages to the person are less than
290280 $2,500, an additional amount so that the total amount of damages
291281 equals $2,500; and
292282 (3) court costs incurred by the person who is the
293283 subject of the information in bringing the action.
294284 (b) A person whose personal information has been disclosed
295285 for compensation to a person who is not an authorized recipient may
296286 sue for:
297287 (1) the damages, costs, and fees authorized under
298288 Subsection (a);
299289 (2) injunctive relief; and
300290 (3) any other equitable remedy determined to be
301291 appropriate by the court.
302292 (c) A district court has exclusive original jurisdiction
303293 over a cause of action brought under this section.
304294 SECTION 10. Section 730.013, Transportation Code, is
305295 amended to read as follows:
306296 Sec. 730.013. [RESALE OR] REDISCLOSURE; OFFENSE. (a) An
307297 authorized recipient of personal information may not [resell or]
308298 redisclose the personal information in the identical or a
309299 substantially identical format the personal information was
310300 disclosed to the recipient by the applicable agency.
311301 (b) An authorized recipient of personal information may
312302 [resell or] redisclose the information, including redisclosure for
313303 compensation, only for a use permitted under Section 730.007.
314304 (c) An [Any] authorized recipient who [resells or]
315305 rediscloses personal information obtained from an agency shall be
316306 required by that agency to:
317307 (1) maintain for a period of not less than five years
318308 records as to any person or entity receiving that information and
319309 the permitted use for which it was obtained; and
320310 (2) provide copies of those records to the agency on
321311 request.
322312 (c-1) A person who receives personal information under
323313 Subsection (b) may not redisclose the personal information,
324314 including redisclosure for compensation, to a person who is not an
325315 authorized recipient.
326316 (c-2) An authorized recipient shall notify each person who
327317 receives personal information from the authorized recipient that
328318 the person may not redisclose the personal information to a person
329319 who is not an authorized recipient.
330320 (d) A person commits an offense if the person violates this
331321 section. An offense under this subsection is a misdemeanor
332322 punishable by a fine not to exceed $100,000 [$25,000].
333323 SECTION 11. The heading to Section 730.014, Transportation
334324 Code, is amended to read as follows:
335325 Sec. 730.014. AGENCY RULES,[; ORGANIZATION OF] RECORDS, AND
336326 CONTRACTS.
337327 SECTION 12. Section 730.014, Transportation Code, is
338- amended by adding Subsections (c), (d), (e), (f), and (g) to read as
328+ amended by adding Subsections (c), (d), (e), and (f) to read as
339329 follows:
340330 (c) An agency that provides a requestor access to personal
341331 information in motor vehicle records in bulk under a contract under
342332 Section 730.007 shall include in the contract:
343333 (1) a requirement that the requestor post a
344334 performance bond in an amount of not more than $1 million;
345335 (2) a prohibition on the sale or redisclosure of the
346336 personal information for the purpose of marketing extended vehicle
347337 warranties by telephone;
348338 (3) a requirement that the requestor provide proof of
349339 general liability and cyber-threat insurance coverage in an amount
350340 specified by the contracting agency that is:
351341 (A) at least $3 million; and
352342 (B) reasonably related to the risks associated
353343 with unauthorized access and use of the records;
354344 (4) a requirement that if a requestor experiences a
355345 breach of system security, as defined by Section 521.053, Business &
356346 Commerce Code, that includes data obtained under Section 730.007,
357347 the requestor must notify the agency of the breach not later than 48
358348 hours after the discovery of the breach;
359349 (5) a requirement that the requestor include in each
360350 contract with a third party that receives the personal information
361351 from the requestor that the third party must comply with federal and
362352 state laws regarding the records;
363353 (6) a requirement that the requestor and any third
364354 party receiving the personal information from the requestor protect
365355 the personal information with appropriate and accepted industry
366356 standard security measures for the type of information and the
367357 known risks from unauthorized access and use of the information;
368358 and
369359 (7) a requirement that the requestor annually provide
370360 to the agency a report of all third parties to which the personal
371361 information was disclosed under this section and the purpose of the
372362 disclosure.
373- (d) The bond and insurance requirements in Subsections
374- (c)(1) and (3) do not apply to a contract under Section 730.007
375- between a government agency and another government agency,
376- including a court or law enforcement agency.
377- (e) An agency that discloses any motor vehicle records in
363+ (d) An agency that discloses any motor vehicle records in
378364 bulk under Section 730.007 shall include in the records at least two
379365 records that are created solely for the purpose of monitoring
380366 compliance with this chapter and detecting, by receipt of certain
381367 forms of communications or actions directed at the subjects of the
382368 created records, potential violations of this chapter or contract
383369 terms required by this section.
384- (f) An agency that discloses motor vehicle records shall
370+ (e) An agency that discloses motor vehicle records shall
385371 designate an employee to be responsible for:
386372 (1) monitoring compliance with this chapter and
387373 contract terms required by this section;
388374 (2) referring potential violations of this chapter to
389375 law enforcement agencies; and
390376 (3) making recommendations to the administrative head
391377 of the agency or the designee of the administrative head of the
392378 agency on the eligibility of a person under Section 730.016 to
393379 receive personal information.
394- (g) This subsection does not affect any rights or remedies
395- available under a contract or any other law. If an agency
396- determines that a person has violated a term of a contract with the
397- agency for the disclosure under this chapter of personal
398- information obtained by the agency in connection with a motor
399- vehicle record, the agency may:
380+ (f) This subsection does not affect any rights or remedies
381+ available under a contract or any other law. If an agency determines
382+ that a person has violated a term of a contract with the agency for
383+ the disclosure under this chapter of personal information obtained
384+ by the agency in connection with a motor vehicle record, the agency
385+ may:
400386 (1) cease disclosing personal information to that
401387 person; and
402388 (2) allow the person to remedy the violation and
403389 resume receiving personal information.
404390 SECTION 13. The heading to Section 730.016, Transportation
405391 Code, is amended to read as follows:
406392 Sec. 730.016. INELIGIBILITY OF CERTAIN PERSONS TO RECEIVE,
407393 RETAIN, OR REDISCLOSE PERSONAL INFORMATION; OFFENSE.
408394 SECTION 14. Section 730.016, Transportation Code, is
409395 amended by amending Subsection (a) and adding Subsection (c) to
410396 read as follows:
411397 (a) A person who is convicted of an offense under this
412- chapter, or who violates a rule adopted by an agency relating to the
413- terms or conditions for a release of personal information,
398+ chapter, or who is determined in a civil action to be in violation
399+ of this chapter or [violates] a rule adopted by an agency relating
400+ to the terms or conditions for a release of personal information,
414401 including a rule adopted under Section 730.0121:
415402 (1) [to the person,] is ineligible to receive personal
416403 information under Section 730.007;
417404 (2) not later than one year after the date of
418405 conviction or the court's final determination under this
419406 subsection, shall delete from the person's records all personal
420407 information received under this chapter; and
421408 (3) may not redisclose personal information received
422409 under this chapter.
423410 (c) A person commits an offense if the person violates this
424411 section. An offense under this subsection is a misdemeanor
425412 punishable by a fine not to exceed $100,000.
426413 SECTION 15. The following provisions are repealed:
427414 (1) Section 11.030(d), Parks and Wildlife Code; and
428415 (2) Sections 204.011(c) and (d), Transportation Code.
429416 SECTION 16. The changes in law made by this Act apply only
430417 to an offense committed on or after the effective date of this Act.
431418 An offense committed before the effective date of this Act is
432419 governed by the law in effect on the date the offense was committed,
433420 and the former law is continued in effect for that purpose. For
434421 purposes of this section, an offense was committed before the
435422 effective date of this Act if any element of the offense occurred
436423 before that date.
437424 SECTION 17. (a) Section 730.0121, Transportation Code, as
438425 added by this Act, applies to a person who received personal
439426 information under Chapter 730, Transportation Code, before the
440427 effective date of this Act, and is not an authorized recipient, as
441428 defined by Section 730.003(1-a), Transportation Code, as added by
442429 this Act, of that personal information under Chapter 730,
443430 Transportation Code, as amended by this Act.
444431 (b) Notwithstanding Subsection (a) of this section, an
445432 agency to which Section 730.0121, Transportation Code, as added by
446433 this Act, applies may not require a person who received personal
447434 information from the agency before the effective date of this Act
448435 and is not an authorized recipient, as defined by Section
449436 730.003(1-a), Transportation Code, as added by this Act, of that
450437 information to delete the information before the first anniversary
451438 of the effective date of this Act.
452439 SECTION 18. This Act takes effect immediately if it
453440 receives a vote of two-thirds of all the members elected to each
454441 house, as provided by Section 39, Article III, Texas Constitution.
455442 If this Act does not receive the vote necessary for immediate
456443 effect, this Act takes effect September 1, 2021.
457- ______________________________ ______________________________
458- President of the Senate Speaker of the House
459- I hereby certify that S.B. No. 15 passed the Senate on
460- April 14, 2021, by the following vote: Yeas 31, Nays 0;
461- May 27, 2021, Senate refused to concur in House amendments and
462- requested appointment of Conference Committee; May 28, 2021, House
463- granted request of the Senate; May 30, 2021, Senate adopted
464- Conference Committee Report by the following vote: Yeas 31,
465- Nays 0.
466- ______________________________
467- Secretary of the Senate
468- I hereby certify that S.B. No. 15 passed the House, with
469- amendments, on May 25, 2021, by the following vote: Yeas 146,
470- Nays 0, one present not voting; May 28, 2021, House granted request
471- of the Senate for appointment of Conference Committee;
472- May 30, 2021, House adopted Conference Committee Report by the
473- following vote: Yeas 140, Nays 0, two present not voting.
474- ______________________________
475- Chief Clerk of the House
476- Approved:
477- ______________________________
478- Date
479- ______________________________
480- Governor