| 1 | 1 | | 88R7881 MCK-D |
|---|
| 2 | 2 | | By: Bell of Kaufman H.B. No. 3180 |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | A BILL TO BE ENTITLED |
|---|
| 6 | 6 | | AN ACT |
|---|
| 7 | 7 | | relating to the review by the Sunset Advisory Commission of the sale |
|---|
| 8 | 8 | | of personal data by state agencies. |
|---|
| 9 | 9 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 10 | 10 | | SECTION 1. Chapter 325, Government Code, is amended by |
|---|
| 11 | 11 | | adding Section 325.0124 to read as follows: |
|---|
| 12 | 12 | | Sec. 325.0124. REVIEW OF AGENCY'S SALE OF PERSONAL DATA. |
|---|
| 13 | 13 | | (a) In this section, "personal data" means any information |
|---|
| 14 | 14 | | relating to an identified or identifiable individual that directly |
|---|
| 15 | 15 | | or indirectly identifies the individual by reference to: |
|---|
| 16 | 16 | | (1) an identifier for the individual, including a |
|---|
| 17 | 17 | | name, an identification number, location information, or an online |
|---|
| 18 | 18 | | identifier; or |
|---|
| 19 | 19 | | (2) one or more factors specific to the physical, |
|---|
| 20 | 20 | | physiological, genetic, mental, economic, cultural, or social |
|---|
| 21 | 21 | | identity of the individual. |
|---|
| 22 | 22 | | (b) As part of its review of a state agency, the commission |
|---|
| 23 | 23 | | shall determine whether the state agency sells personal data the |
|---|
| 24 | 24 | | agency possesses. If the state agency sells personal data, the |
|---|
| 25 | 25 | | commission shall determine: |
|---|
| 26 | 26 | | (1) to whom the personal data is sold; |
|---|
| 27 | 27 | | (2) to the extent possible, the purpose for which the |
|---|
| 28 | 28 | | personal data is sold; |
|---|
| 29 | 29 | | (3) the amount the state agency receives for the sale |
|---|
| 30 | 30 | | of the personal data; and |
|---|
| 31 | 31 | | (4) the law that authorizes the state agency to sell |
|---|
| 32 | 32 | | the personal data. |
|---|
| 33 | 33 | | (c) The commission shall recommend prohibiting the sale of |
|---|
| 34 | 34 | | personal data by a state agency, unless the commission identifies a |
|---|
| 35 | 35 | | compelling state interest justifying the state agency's authority |
|---|
| 36 | 36 | | to sell the personal data. If the commission recommends continuing |
|---|
| 37 | 37 | | the state agency's authority to sell personal data, the commission |
|---|
| 38 | 38 | | shall make any recommendations it considers necessary to protect |
|---|
| 39 | 39 | | the personal data from improper use and dissemination. |
|---|
| 40 | 40 | | SECTION 2. This Act takes effect September 1, 2023. |
|---|