Texas 2023 - 88th Regular

Texas House Bill HB4 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	H.B. No. 4
2	2
3	3
4	4	AN ACT
5	5	relating to the regulation of the collection, use, processing, and
6	6	treatment of consumers' personal data by certain business entities;
7	7	imposing a civil penalty.
8	8	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
9	9	SECTION 1. This Act may be cited as the Texas Data Privacy
10	10	and Security Act.
11	11	SECTION 2. Title 11, Business & Commerce Code, is amended by
12	12	adding Subtitle C to read as follows:
13	13	SUBTITLE C. CONSUMER DATA PROTECTION
14	14	CHAPTER 541. CONSUMER DATA PROTECTION
15	15	SUBCHAPTER A. GENERAL PROVISIONS
16	16	Sec. 541.001. DEFINITIONS. In this chapter, unless a
17	17	different meaning is required by the context:
18	18	(1) "Affiliate" means a legal entity that controls, is
19	19	controlled by, or is under common control with another legal entity
20	20	or shares common branding with another legal entity. For purposes
21	21	of this subdivision, "control" or "controlled" means:
22	22	(A) the ownership of, or power to vote, more than
23	23	50 percent of the outstanding shares of any class of voting security
24	24	of a company;
25	25	(B) the control in any manner over the election
26	26	of a majority of the directors or of individuals exercising similar
27	27	functions; or
28	28	(C) the power to exercise controlling influence
29	29	over the management of a company.
30	30	(2) "Authenticate" means to verify through reasonable
31	31	means that the consumer who is entitled to exercise the consumer's
32	32	rights under Subchapter B is the same consumer exercising those
33	33	consumer rights with respect to the personal data at issue.
34	34	(3) "Biometric data" means data generated by automatic
35	35	measurements of an individual's biological characteristics. The
36	36	term includes a fingerprint, voiceprint, eye retina or iris, or
37	37	other unique biological pattern or characteristic that is used to
38	38	identify a specific individual. The term does not include a
39	39	physical or digital photograph or data generated from a physical or
40	40	digital photograph, a video or audio recording or data generated
41	41	from a video or audio recording, or information collected, used, or
42	42	stored for health care treatment, payment, or operations under the
43	43	Health Insurance Portability and Accountability Act of 1996 (42
44	44	U.S.C. Section 1320d et seq.).
45	45	(4) "Business associate" has the meaning assigned to
46	46	the term by the Health Insurance Portability and Accountability Act
47	47	of 1996 (42 U.S.C. Section 1320d et seq.).
48	48	(5) "Child" means an individual younger than 13 years
49	49	of age.
50	50	(6) "Consent," when referring to a consumer, means a
51	51	clear affirmative act signifying a consumer's freely given,
52	52	specific, informed, and unambiguous agreement to process personal
53	53	data relating to the consumer. The term includes a written
54	54	statement, including a statement written by electronic means, or
55	55	any other unambiguous affirmative action. The term does not
56	56	include:
57	57	(A) acceptance of a general or broad terms of use
58	58	or similar document that contains descriptions of personal data
59	59	processing along with other, unrelated information;
60	60	(B) hovering over, muting, pausing, or closing a
61	61	given piece of content; or
62	62	(C) agreement obtained through the use of dark
63	63	patterns.
64	64	(7) "Consumer" means an individual who is a resident
65	65	of this state acting only in an individual or household context. The
66	66	term does not include an individual acting in a commercial or
67	67	employment context.
68	68	(8) "Controller" means an individual or other person
69	69	that, alone or jointly with others, determines the purpose and
70	70	means of processing personal data.
71	71	(9) "Covered entity" has the meaning assigned to the
72	72	term by the Health Insurance Portability and Accountability Act of
73	73	1996 (42 U.S.C. Section 1320d et seq.).
74	74	(10) "Dark pattern" means a user interface designed or
75	75	manipulated with the effect of substantially subverting or
76	76	impairing user autonomy, decision-making, or choice, and includes
77	77	any practice the Federal Trade Commission refers to as a dark
78	78	pattern.
79	79	(11) "Decision that produces a legal or similarly
80	80	significant effect concerning a consumer" means a decision made by
81	81	the controller that results in the provision or denial by the
82	82	controller of:
83	83	(A) financial and lending services;
84	84	(B) housing, insurance, or health care services;
85	85	(C) education enrollment;
86	86	(D) employment opportunities;
87	87	(E) criminal justice; or
88	88	(F) access to basic necessities, such as food and
89	89	water.
90	90	(12) "Deidentified data" means data that cannot
91	91	reasonably be linked to an identified or identifiable individual,
92	92	or a device linked to that individual.
93	93	(13) "Health care provider" has the meaning assigned
94	94	to the term by the Health Insurance Portability and Accountability
95	95	Act of 1996 (42 U.S.C. Section 1320d et seq.).
96	96	(14) "Health record" means any written, printed, or
97	97	electronically recorded material maintained by a health care
98	98	provider in the course of providing health care services to an
99	99	individual that concerns the individual and the services provided.
100	100	The term includes:
101	101	(A) the substance of any communication made by an
102	102	individual to a health care provider in confidence during or in
103	103	connection with the provision of health care services; or
104	104	(B) information otherwise acquired by the health
105	105	care provider about an individual in confidence and in connection
106	106	with health care services provided to the individual.
107	107	(15) "Identified or identifiable individual" means a
108	108	consumer who can be readily identified, directly or indirectly.
109	109	(16) "Institution of higher education" means:
110	110	(A) an institution of higher education as defined
111	111	by Section 61.003, Education Code; or
112	112	(B) a private or independent institution of
113	113	higher education as defined by Section 61.003, Education Code.
114	114	(17) "Known child" means a child under circumstances
115	115	where a controller has actual knowledge of, or wilfully disregards,
116	116	the child's age.
117	117	(18) "Nonprofit organization" means:
118	118	(A) a corporation organized under Chapters 20 and
119	119	22, Business Organizations Code, and the provisions of Title 1,
120	120	Business Organizations Code, to the extent applicable to nonprofit
121	121	corporations;
122	122	(B) an organization exempt from federal taxation
123	123	under Section 501(a), Internal Revenue Code of 1986, by being
124	124	listed as an exempt organization under Section 501(c)(3),
125	125	501(c)(6), 501(c)(12), or 501(c)(19) of that code;
126	126	(C) a political organization; or
127	127	(D) an organization that:
128	128	(i) is exempt from federal taxation under
129	129	Section 501(a), Internal Revenue Code of 1986, by being listed as an
130	130	exempt organization under Section 501(c)(4) of that code; and
131	131	(ii) is described by Section 701.052(a),
132	132	Insurance Code.
133	133	(19) "Personal data" means any information, including
134	134	sensitive data, that is linked or reasonably linkable to an
135	135	identified or identifiable individual. The term includes
136	136	pseudonymous data when the data is used by a controller or processor
137	137	in conjunction with additional information that reasonably links
138	138	the data to an identified or identifiable individual. The term does
139	139	not include deidentified data or publicly available information.
140	140	(20) "Political organization" means a party,
141	141	committee, association, fund, or other organization, regardless of
142	142	whether incorporated, that is organized and operated primarily for
143	143	the purpose of influencing or attempting to influence:
144	144	(A) the selection, nomination, election, or
145	145	appointment of an individual to a federal, state, or local public
146	146	office or an office in a political organization, regardless of
147	147	whether the individual is selected, nominated, elected, or
148	148	appointed; or
149	149	(B) the election of a
150	150	presidential/vice-presidential elector, regardless of whether the
151	151	elector is selected, nominated, elected, or appointed.
152	152	(21) "Precise geolocation data" means information
153	153	derived from technology, including global positioning system level
154	154	latitude and longitude coordinates or other mechanisms, that
155	155	directly identifies the specific location of an individual with
156	156	precision and accuracy within a radius of 1,750 feet. The term does
157	157	not include the content of communications or any data generated by
158	158	or connected to an advanced utility metering infrastructure system
159	159	or to equipment for use by a utility.
160	160	(22) "Process" or "processing" means an operation or
161	161	set of operations performed, whether by manual or automated means,
162	162	on personal data or on sets of personal data, such as the
163	163	collection, use, storage, disclosure, analysis, deletion, or
164	164	modification of personal data.
165	165	(23) "Processor" means a person that processes
166	166	personal data on behalf of a controller.
167	167	(24) "Profiling" means any form of solely automated
168	168	processing performed on personal data to evaluate, analyze, or
169	169	predict personal aspects related to an identified or identifiable
170	170	individual's economic situation, health, personal preferences,
171	171	interests, reliability, behavior, location, or movements.
172	172	(25) "Protected health information" has the meaning
173	173	assigned to the term by the Health Insurance Portability and
174	174	Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.).
175	175	(26) "Pseudonymous data" means any information that
176	176	cannot be attributed to a specific individual without the use of
177	177	additional information, provided that the additional information
178	178	is kept separately and is subject to appropriate technical and
179	179	organizational measures to ensure that the personal data is not
180	180	attributed to an identified or identifiable individual.
181	181	(27) "Publicly available information" means
182	182	information that is lawfully made available through government
183	183	records, or information that a business has a reasonable basis to
184	184	believe is lawfully made available to the general public through
185	185	widely distributed media, by a consumer, or by a person to whom a
186	186	consumer has disclosed the information, unless the consumer has
187	187	restricted the information to a specific audience.
188	188	(28) "Sale of personal data" means the sharing,
189	189	disclosing, or transferring of personal data for monetary or other
190	190	valuable consideration by the controller to a third party. The term
191	191	does not include:
192	192	(A) the disclosure of personal data to a
193	193	processor that processes the personal data on the controller's
194	194	behalf;
195	195	(B) the disclosure of personal data to a third
196	196	party for purposes of providing a product or service requested by
197	197	the consumer;
198	198	(C) the disclosure or transfer of personal data
199	199	to an affiliate of the controller;
200	200	(D) the disclosure of information that the
201	201	consumer:
202	202	(i) intentionally made available to the
203	203	general public through a mass media channel; and
204	204	(ii) did not restrict to a specific
205	205	audience; or
206	206	(E) the disclosure or transfer of personal data
207	207	to a third party as an asset that is part of a merger or acquisition.
208	208	(29) "Sensitive data" means a category of personal
209	209	data. The term includes:
210	210	(A) personal data revealing racial or ethnic
211	211	origin, religious beliefs, mental or physical health diagnosis,
212	212	sexuality, or citizenship or immigration status;
213	213	(B) genetic or biometric data that is processed
214	214	for the purpose of uniquely identifying an individual;
215	215	(C) personal data collected from a known child;
216	216	or
217	217	(D) precise geolocation data.
218	218	(30) "State agency" means a department, commission,
219	219	board, office, council, authority, or other agency in any branch of
220	220	state government that is created by the constitution or a statute of
221	221	this state, including a university system or institution of higher
222	222	education as defined by Section 61.003, Education Code.
223	223	(31) "Targeted advertising" means displaying to a
224	224	consumer an advertisement that is selected based on personal data
225	225	obtained from that consumer's activities over time and across
226	226	nonaffiliated websites or online applications to predict the
227	227	consumer's preferences or interests. The term does not include:
228	228	(A) an advertisement that:
229	229	(i) is based on activities within a
230	230	controller's own websites or online applications;
231	231	(ii) is based on the context of a consumer's
232	232	current search query, visit to a website, or online application; or
233	233	(iii) is directed to a consumer in response
234	234	to the consumer's request for information or feedback; or
235	235	(B) the processing of personal data solely for
236	236	measuring or reporting advertising performance, reach, or
237	237	frequency.
238	238	(32) "Third party" means a person, other than the
239	239	consumer, the controller, the processor, or an affiliate of the
240	240	controller or processor.
241	241	(33) "Trade secret" means all forms and types of
242	242	information, including business, scientific, technical, economic,
243	243	or engineering information, and any formula, design, prototype,
244	244	pattern, plan, compilation, program device, program, code, device,
245	245	method, technique, process, procedure, financial data, or list of
246	246	actual or potential customers or suppliers, whether tangible or
247	247	intangible and whether or how stored, compiled, or memorialized
248	248	physically, electronically, graphically, photographically, or in
249	249	writing if:
250	250	(A) the owner of the trade secret has taken
251	251	reasonable measures under the circumstances to keep the information
252	252	secret; and
253	253	(B) the information derives independent economic
254	254	value, actual or potential, from not being generally known to, and
255	255	not being readily ascertainable through proper means by, another
256	256	person who can obtain economic value from the disclosure or use of
257	257	the information.
258	258	Sec. 541.002. APPLICABILITY OF CHAPTER. (a) This chapter
259	259	applies only to a person that:
260	260	(1) conducts business in this state or produces a
261	261	product or service consumed by residents of this state;
262	262	(2) processes or engages in the sale of personal data;
263	263	and
264	264	(3) is not a small business as defined by the United
265	265	States Small Business Administration, except to the extent that
266	266	Section 541.107 applies to a person described by this subdivision.
267	267	(b) This chapter does not apply to:
268	268	(1) a state agency or a political subdivision of this
269	269	state;
270	270	(2) a financial institution or data subject to Title
271	271	V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.);
272	272	(3) a covered entity or business associate governed by
273	273	the privacy, security, and breach notification rules issued by the
274	274	United States Department of Health and Human Services, 45 C.F.R.
275	275	Parts 160 and 164, established under the Health Insurance
276	276	Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d
277	277	et seq.), and the Health Information Technology for Economic and
278	278	Clinical Health Act (Division A, Title XIII, and Division B, Title
279	279	IV, Pub. L. No. 111-5);
280	280	(4) a nonprofit organization;
281	281	(5) an institution of higher education; or
282	282	(6) an electric utility, a power generation company,
283	283	or a retail electric provider, as those terms are defined by Section
284	284	31.002, Utilities Code.
285	285	Sec. 541.003. CERTAIN INFORMATION EXEMPT FROM CHAPTER. The
286	286	following information is exempt from this chapter:
287	287	(1) protected health information under the Health
288	288	Insurance Portability and Accountability Act of 1996 (42 U.S.C.
289	289	Section 1320d et seq.);
290	290	(2) health records;
291	291	(3) patient identifying information for purposes of 42
292	292	U.S.C. Section 290dd-2;
293	293	(4) identifiable private information:
294	294	(A) for purposes of the federal policy for the
295	295	protection of human subjects under 45 C.F.R. Part 46;
296	296	(B) collected as part of human subjects research
297	297	under the good clinical practice guidelines issued by The
298	298	International Council for Harmonisation of Technical Requirements
299	299	for Pharmaceuticals for Human Use (ICH) or of the protection of
300	300	human subjects under 21 C.F.R. Parts 50 and 56; or
301	301	(C) that is personal data used or shared in
302	302	research conducted in accordance with the requirements set forth in
303	303	this chapter or other research conducted in accordance with
304	304	applicable law;
305	305	(5) information and documents created for purposes of
306	306	the Health Care Quality Improvement Act of 1986 (42 U.S.C. Section
307	307	11101 et seq.);
308	308	(6) patient safety work product for purposes of the
309	309	Patient Safety and Quality Improvement Act of 2005 (42 U.S.C.
310	310	Section 299b-21 et seq.);
311	311	(7) information derived from any of the health
312	312	care-related information listed in this section that is
313	313	deidentified in accordance with the requirements for
314	314	deidentification under the Health Insurance Portability and
315	315	Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
316	316	(8) information originating from, and intermingled to
317	317	be indistinguishable with, or information treated in the same
318	318	manner as, information exempt under this section that is maintained
319	319	by a covered entity or business associate as defined by the Health
320	320	Insurance Portability and Accountability Act of 1996 (42 U.S.C.
321	321	Section 1320d et seq.) or by a program or a qualified service
322	322	organization as defined by 42 U.S.C. Section 290dd-2;
323	323	(9) information that is included in a limited data set
324	324	as described by 45 C.F.R. Section 164.514(e), to the extent that the
325	325	information is used, disclosed, and maintained in the manner
326	326	specified by 45 C.F.R. Section 164.514(e);
327	327	(10) information collected or used only for public
328	328	health activities and purposes as authorized by the Health
329	329	Insurance Portability and Accountability Act of 1996 (42 U.S.C.
330	330	Section 1320d et seq.);
331	331	(11) the collection, maintenance, disclosure, sale,
332	332	communication, or use of any personal information bearing on a
333	333	consumer's creditworthiness, credit standing, credit capacity,
334	334	character, general reputation, personal characteristics, or mode
335	335	of living by a consumer reporting agency or furnisher that provides
336	336	information for use in a consumer report, and by a user of a
337	337	consumer report, but only to the extent that the activity is
338	338	regulated by and authorized under the Fair Credit Reporting Act (15
339	339	U.S.C. Section 1681 et seq.);
340	340	(12) personal data collected, processed, sold, or
341	341	disclosed in compliance with the Driver's Privacy Protection Act of
342	342	1994 (18 U.S.C. Section 2721 et seq.);
343	343	(13) personal data regulated by the Family Educational
344	344	Rights and Privacy Act of 1974 (20 U.S.C. Section 1232g);
345	345	(14) personal data collected, processed, sold, or
346	346	disclosed in compliance with the Farm Credit Act of 1971 (12 U.S.C.
347	347	Section 2001 et seq.);
348	348	(15) data processed or maintained in the course of an
349	349	individual applying to, being employed by, or acting as an agent or
350	350	independent contractor of a controller, processor, or third party,
351	351	to the extent that the data is collected and used within the context
352	352	of that role;
353	353	(16) data processed or maintained as the emergency
354	354	contact information of an individual under this chapter that is
355	355	used for emergency contact purposes; or
356	356	(17) data that is processed or maintained and is
357	357	necessary to retain to administer benefits for another individual
358	358	that relates to an individual described by Subdivision (15) and
359	359	used for the purposes of administering those benefits.
360	360	Sec. 541.004. INAPPLICABILITY OF CHAPTER. This chapter
361	361	does not apply to the processing of personal data by a person in the
362	362	course of a purely personal or household activity.
363	363	Sec. 541.005. EFFECT OF COMPLIANCE WITH PARENTAL CONSENT
364	364	REQUIREMENTS UNDER CERTAIN FEDERAL LAW. A controller or processor
365	365	that complies with the verifiable parental consent requirements of
366	366	the Children's Online Privacy Protection Act of 1998 (15 U.S.C.
367	367	Section 6501 et seq.) with respect to data collected online is
368	368	considered to be in compliance with any requirement to obtain
369	369	parental consent under this chapter.
370	370	SUBCHAPTER B. CONSUMER'S RIGHTS
371	371	Sec. 541.051. CONSUMER'S PERSONAL DATA RIGHTS; REQUEST TO
372	372	EXERCISE RIGHTS. (a) A consumer is entitled to exercise the
373	373	consumer rights authorized by this section at any time by
374	374	submitting a request to a controller specifying the consumer rights
375	375	the consumer wishes to exercise. With respect to the processing of
376	376	personal data belonging to a known child, a parent or legal guardian
377	377	of the child may exercise the consumer rights on behalf of the
378	378	child.
379	379	(b) A controller shall comply with an authenticated
380	380	consumer request to exercise the right to:
381	381	(1) confirm whether a controller is processing the
382	382	consumer's personal data and to access the personal data;
383	383	(2) correct inaccuracies in the consumer's personal
384	384	data, taking into account the nature of the personal data and the
385	385	purposes of the processing of the consumer's personal data;
386	386	(3) delete personal data provided by or obtained about
387	387	the consumer;
388	388	(4) if the data is available in a digital format,
389	389	obtain a copy of the consumer's personal data that the consumer
390	390	previously provided to the controller in a portable and, to the
391	391	extent technically feasible, readily usable format that allows the
392	392	consumer to transmit the data to another controller without
393	393	hindrance; or
394	394	(5) opt out of the processing of the personal data for
395	395	purposes of:
396	396	(A) targeted advertising;
397	397	(B) the sale of personal data; or
398	398	(C) profiling in furtherance of a decision that
399	399	produces a legal or similarly significant effect concerning the
400	400	consumer.
401	401	Sec. 541.052. CONTROLLER RESPONSE TO CONSUMER REQUEST. (a)
402	402	Except as otherwise provided by this chapter, a controller shall
403	403	comply with a request submitted by a consumer to exercise the
404	404	consumer's rights pursuant to Section 541.051 as provided by this
405	405	section.
406	406	(b) A controller shall respond to the consumer request
407	407	without undue delay, which may not be later than the 45th day after
408	408	the date of receipt of the request. The controller may extend the
409	409	response period once by an additional 45 days when reasonably
410	410	necessary, taking into account the complexity and number of the
411	411	consumer's requests, so long as the controller informs the consumer
412	412	of the extension within the initial 45-day response period,
413	413	together with the reason for the extension.
414	414	(c) If a controller declines to take action regarding the
415	415	consumer's request, the controller shall inform the consumer
416	416	without undue delay, which may not be later than the 45th day after
417	417	the date of receipt of the request, of the justification for
418	418	declining to take action and provide instructions on how to appeal
419	419	the decision in accordance with Section 541.053.
420	420	(d) A controller shall provide information in response to a
421	421	consumer request free of charge, at least twice annually per
422	422	consumer. If a request from a consumer is manifestly unfounded,
423	423	excessive, or repetitive, the controller may charge the consumer a
424	424	reasonable fee to cover the administrative costs of complying with
425	425	the request or may decline to act on the request. The controller
426	426	bears the burden of demonstrating for purposes of this subsection
427	427	that a request is manifestly unfounded, excessive, or repetitive.
428	428	(e) If a controller is unable to authenticate the request
429	429	using commercially reasonable efforts, the controller is not
430	430	required to comply with a consumer request submitted under Section
431	431	541.051 and may request that the consumer provide additional
432	432	information reasonably necessary to authenticate the consumer and
433	433	the consumer's request.
434	434	(f) A controller that has obtained personal data about a
435	435	consumer from a source other than the consumer is considered in
436	436	compliance with a consumer's request to delete that personal data
437	437	pursuant to Section 541.051(b)(3) by:
438	438	(1) retaining a record of the deletion request and the
439	439	minimum data necessary for the purpose of ensuring the consumer's
440	440	personal data remains deleted from the business's records and not
441	441	using the retained data for any other purpose under this chapter; or
442	442	(2) opting the consumer out of the processing of that
443	443	personal data for any purpose other than a purpose that is exempt
444	444	under the provisions of this chapter.
445	445	Sec. 541.053. APPEAL. (a) A controller shall establish a
446	446	process for a consumer to appeal the controller's refusal to take
447	447	action on a request within a reasonable period of time after the
448	448	consumer's receipt of the decision under Section 541.052(c).
449	449	(b) The appeal process must be conspicuously available and
450	450	similar to the process for initiating action to exercise consumer
451	451	rights by submitting a request under Section 541.051.
452	452	(c) A controller shall inform the consumer in writing of any
453	453	action taken or not taken in response to an appeal under this
454	454	section not later than the 60th day after the date of receipt of the
455	455	appeal, including a written explanation of the reason or reasons
456	456	for the decision.
457	457	(d) If the controller denies an appeal, the controller shall
458	458	provide the consumer with the online mechanism described by Section
459	459	541.152 through which the consumer may contact the attorney general
460	460	to submit a complaint.
461	461	Sec. 541.054. WAIVER OR LIMITATION OF CONSUMER RIGHTS
462	462	PROHIBITED. Any provision of a contract or agreement that waives or
463	463	limits in any way a consumer right described by Sections 541.051,
464	464	541.052, and 541.053 is contrary to public policy and is void and
465	465	unenforceable.
466	466	Sec. 541.055. METHODS FOR SUBMITTING CONSUMER REQUESTS.
467	467	(a) A controller shall establish two or more secure and reliable
468	468	methods to enable consumers to submit a request to exercise their
469	469	consumer rights under this chapter. The methods must take into
470	470	account:
471	471	(1) the ways in which consumers normally interact with
472	472	the controller;
473	473	(2) the necessity for secure and reliable
474	474	communications of those requests; and
475	475	(3) the ability of the controller to authenticate the
476	476	identity of the consumer making the request.
477	477	(b) A controller may not require a consumer to create a new
478	478	account to exercise the consumer's rights under this subchapter but
479	479	may require a consumer to use an existing account.
480	480	(c) Except as provided by Subsection (d), if the controller
481	481	maintains an Internet website, the controller must provide a
482	482	mechanism on the website for consumers to submit requests for
483	483	information required to be disclosed under this chapter.
484	484	(d) A controller that operates exclusively online and has a
485	485	direct relationship with a consumer from whom the controller
486	486	collects personal information is only required to provide an e-mail
487	487	address for the submission of requests described by Subsection (c).
488	488	(e) A consumer may designate another person to serve as the
489	489	consumer's authorized agent and act on the consumer's behalf to opt
490	490	out of the processing of the consumer's personal data under
491	491	Sections 541.051(b)(5)(A) and (B). A consumer may designate an
492	492	authorized agent using a technology, including a link to an
493	493	Internet website, an Internet browser setting or extension, or a
494	494	global setting on an electronic device, that allows the consumer to
495	495	indicate the consumer's intent to opt out of the processing. A
496	496	controller shall comply with an opt-out request received from an
497	497	authorized agent under this subsection if the controller is able to
498	498	verify, with commercially reasonable effort, the identity of the
499	499	consumer and the authorized agent's authority to act on the
500	500	consumer's behalf. A controller is not required to comply with an
501	501	opt-out request received from an authorized agent under this
502	502	subsection if:
503	503	(1) the authorized agent does not communicate the
504	504	request to the controller in a clear and unambiguous manner;
505	505	(2) the controller is not able to verify, with
506	506	commercially reasonable effort, that the consumer is a resident of
507	507	this state;
508	508	(3) the controller does not possess the ability to
509	509	process the request; or
510	510	(4) the controller does not process similar or
511	511	identical requests the controller receives from consumers for the
512	512	purpose of complying with similar or identical laws or regulations
513	513	of another state.
514	514	(f) A technology described by Subsection (e):
515	515	(1) may not unfairly disadvantage another controller;
516	516	(2) may not make use of a default setting, but must
517	517	require the consumer to make an affirmative, freely given, and
518	518	unambiguous choice to indicate the consumer's intent to opt out of
519	519	any processing of a consumer's personal data; and
520	520	(3) must be consumer-friendly and easy to use by the
521	521	average consumer.
522	522	SUBCHAPTER C. CONTROLLER AND PROCESSOR DATA-RELATED DUTIES AND
523	523	PROHIBITIONS
524	524	Sec. 541.101. CONTROLLER DUTIES; TRANSPARENCY. (a) A
525	525	controller:
526	526	(1) shall limit the collection of personal data to
527	527	what is adequate, relevant, and reasonably necessary in relation to
528	528	the purposes for which that personal data is processed, as
529	529	disclosed to the consumer; and
530	530	(2) for purposes of protecting the confidentiality,
531	531	integrity, and accessibility of personal data, shall establish,
532	532	implement, and maintain reasonable administrative, technical, and
533	533	physical data security practices that are appropriate to the volume
534	534	and nature of the personal data at issue.
535	535	(b) A controller may not:
536	536	(1) except as otherwise provided by this chapter,
537	537	process personal data for a purpose that is neither reasonably
538	538	necessary to nor compatible with the disclosed purpose for which
539	539	the personal data is processed, as disclosed to the consumer,
540	540	unless the controller obtains the consumer's consent;
541	541	(2) process personal data in violation of state and
542	542	federal laws that prohibit unlawful discrimination against
543	543	consumers;
544	544	(3) discriminate against a consumer for exercising any
545	545	of the consumer rights contained in this chapter, including by
546	546	denying goods or services, charging different prices or rates for
547	547	goods or services, or providing a different level of quality of
548	548	goods or services to the consumer; or
549	549	(4) process the sensitive data of a consumer without
550	550	obtaining the consumer's consent, or, in the case of processing the
551	551	sensitive data of a known child, without processing that data in
552	552	accordance with the Children's Online Privacy Protection Act of
553	553	1998 (15 U.S.C. Section 6501 et seq.).
554	554	(c) Subsection (b)(3) may not be construed to require a
555	555	controller to provide a product or service that requires the
556	556	personal data of a consumer that the controller does not collect or
557	557	maintain or to prohibit a controller from offering a different
558	558	price, rate, level, quality, or selection of goods or services to a
559	559	consumer, including offering goods or services for no fee, if the
560	560	consumer has exercised the consumer's right to opt out under
561	561	Section 541.051 or the offer is related to a consumer's voluntary
562	562	participation in a bona fide loyalty, rewards, premium features,
563	563	discounts, or club card program.
564	564	Sec. 541.102. PRIVACY NOTICE. (a) A controller shall
565	565	provide consumers with a reasonably accessible and clear privacy
566	566	notice that includes:
567	567	(1) the categories of personal data processed by the
568	568	controller, including, if applicable, any sensitive data processed
569	569	by the controller;
570	570	(2) the purpose for processing personal data;
571	571	(3) how consumers may exercise their consumer rights
572	572	under Subchapter B, including the process by which a consumer may
573	573	appeal a controller's decision with regard to the consumer's
574	574	request;
575	575	(4) if applicable, the categories of personal data
576	576	that the controller shares with third parties;
577	577	(5) if applicable, the categories of third parties
578	578	with whom the controller shares personal data; and
579	579	(6) a description of the methods required under
580	580	Section 541.055 through which consumers can submit requests to
581	581	exercise their consumer rights under this chapter.
582	582	(b) If a controller engages in the sale of personal data
583	583	that is sensitive data, the controller shall include the following
584	584	notice:
585	585	"NOTICE: We may sell your sensitive personal data." The
586	586	notice must be posted in the same location and in the same manner as
587	587	the privacy notice described by Subsection (a).
588	588	(c) If a controller engages in the sale of personal data
589	589	that is biometric data, the controller shall include the following
590	590	notice:
591	591	"NOTICE: We may sell your biometric personal data." The
592	592	notice must be posted in the same location and in the same manner as
593	593	the privacy notice described by Subsection (a).
594	594	Sec. 541.103. SALE OF DATA TO THIRD PARTIES AND PROCESSING
595	595	DATA FOR TARGETED ADVERTISING; DISCLOSURE. If a controller sells
596	596	personal data to third parties or processes personal data for
597	597	targeted advertising, the controller shall clearly and
598	598	conspicuously disclose that process and the manner in which a
599	599	consumer may exercise the right to opt out of that process.
600	600	Sec. 541.104. DUTIES OF PROCESSOR. (a) A processor shall
601	601	adhere to the instructions of a controller and shall assist the
602	602	controller in meeting or complying with the controller's duties or
603	603	requirements under this chapter, including:
604	604	(1) assisting the controller in responding to consumer
605	605	rights requests submitted under Section 541.051 by using
606	606	appropriate technical and organizational measures, as reasonably
607	607	practicable, taking into account the nature of processing and the
608	608	information available to the processor;
609	609	(2) assisting the controller with regard to complying
610	610	with the requirement relating to the security of processing
611	611	personal data and to the notification of a breach of security of the
612	612	processor's system under Chapter 521, taking into account the
613	613	nature of processing and the information available to the
614	614	processor; and
615	615	(3) providing necessary information to enable the
616	616	controller to conduct and document data protection assessments
617	617	under Section 541.105.
618	618	(b) A contract between a controller and a processor shall
619	619	govern the processor's data processing procedures with respect to
620	620	processing performed on behalf of the controller. The contract must
621	621	include:
622	622	(1) clear instructions for processing data;
623	623	(2) the nature and purpose of processing;
624	624	(3) the type of data subject to processing;
625	625	(4) the duration of processing;
626	626	(5) the rights and obligations of both parties; and
627	627	(6) a requirement that the processor shall:
628	628	(A) ensure that each person processing personal
629	629	data is subject to a duty of confidentiality with respect to the
630	630	data;
631	631	(B) at the controller's direction, delete or
632	632	return all personal data to the controller as requested after the
633	633	provision of the service is completed, unless retention of the
634	634	personal data is required by law;
635	635	(C) make available to the controller, on
636	636	reasonable request, all information in the processor's possession
637	637	necessary to demonstrate the processor's compliance with the
638	638	requirements of this chapter;
639	639	(D) allow, and cooperate with, reasonable
640	640	assessments by the controller or the controller's designated
641	641	assessor; and
642	642	(E) engage any subcontractor pursuant to a
643	643	written contract that requires the subcontractor to meet the
644	644	requirements of the processor with respect to the personal data.
645	645	(c) Notwithstanding the requirement described by Subsection
646	646	(b)(6)(D), a processor, in the alternative, may arrange for a
647	647	qualified and independent assessor to conduct an assessment of the
648	648	processor's policies and technical and organizational measures in
649	649	support of the requirements under this chapter using an appropriate
650	650	and accepted control standard or framework and assessment
651	651	procedure. The processor shall provide a report of the assessment
652	652	to the controller on request.
653	653	(d) This section may not be construed to relieve a
654	654	controller or a processor from the liabilities imposed on the
655	655	controller or processor by virtue of its role in the processing
656	656	relationship as described by this chapter.
657	657	(e) A determination of whether a person is acting as a
658	658	controller or processor with respect to a specific processing of
659	659	data is a fact-based determination that depends on the context in
660	660	which personal data is to be processed. A processor that continues
661	661	to adhere to a controller's instructions with respect to a specific
662	662	processing of personal data remains in the role of a processor.
663	663	Sec. 541.105. DATA PROTECTION ASSESSMENTS. (a) A
664	664	controller shall conduct and document a data protection assessment
665	665	of each of the following processing activities involving personal
666	666	data:
667	667	(1) the processing of personal data for purposes of
668	668	targeted advertising;
669	669	(2) the sale of personal data;
670	670	(3) the processing of personal data for purposes of
671	671	profiling, if the profiling presents a reasonably foreseeable risk
672	672	of:
673	673	(A) unfair or deceptive treatment of or unlawful
674	674	disparate impact on consumers;
675	675	(B) financial, physical, or reputational injury
676	676	to consumers;
677	677	(C) a physical or other intrusion on the solitude
678	678	or seclusion, or the private affairs or concerns, of consumers, if
679	679	the intrusion would be offensive to a reasonable person; or
680	680	(D) other substantial injury to consumers;
681	681	(4) the processing of sensitive data; and
682	682	(5) any processing activities involving personal data
683	683	that present a heightened risk of harm to consumers.
684	684	(b) A data protection assessment conducted under Subsection
685	685	(a) must:
686	686	(1) identify and weigh the direct or indirect benefits
687	687	that may flow from the processing to the controller, the consumer,
688	688	other stakeholders, and the public, against the potential risks to
689	689	the rights of the consumer associated with that processing, as
690	690	mitigated by safeguards that can be employed by the controller to
691	691	reduce the risks; and
692	692	(2) factor into the assessment:
693	693	(A) the use of deidentified data;
694	694	(B) the reasonable expectations of consumers;
695	695	(C) the context of the processing; and
696	696	(D) the relationship between the controller and
697	697	the consumer whose personal data will be processed.
698	698	(c) A controller shall make a data protection assessment
699	699	requested under Section 541.153(b) available to the attorney
700	700	general pursuant to a civil investigative demand under Section
701	701	541.153.
702	702	(d) A data protection assessment is confidential and exempt
703	703	from public inspection and copying under Chapter 552, Government
704	704	Code. Disclosure of a data protection assessment in compliance with
705	705	a request from the attorney general does not constitute a waiver of
706	706	attorney-client privilege or work product protection with respect
707	707	to the assessment and any information contained in the assessment.
708	708	(e) A single data protection assessment may address a
709	709	comparable set of processing operations that include similar
710	710	activities.
711	711	(f) A data protection assessment conducted by a controller
712	712	for the purpose of compliance with other laws or regulations may
713	713	constitute compliance with the requirements of this section if the
714	714	assessment has a reasonably comparable scope and effect.
715	715	Sec. 541.106. DEIDENTIFIED OR PSEUDONYMOUS DATA. (a) A
716	716	controller in possession of deidentified data shall:
717	717	(1) take reasonable measures to ensure that the data
718	718	cannot be associated with an individual;
719	719	(2) publicly commit to maintaining and using
720	720	deidentified data without attempting to reidentify the data; and
721	721	(3) contractually obligate any recipient of the
722	722	deidentified data to comply with the provisions of this chapter.
723	723	(b) This chapter may not be construed to require a
724	724	controller or processor to:
725	725	(1) reidentify deidentified data or pseudonymous
726	726	data;
727	727	(2) maintain data in identifiable form or obtain,
728	728	retain, or access any data or technology for the purpose of allowing
729	729	the controller or processor to associate a consumer request with
730	730	personal data; or
731	731	(3) comply with an authenticated consumer rights
732	732	request under Section 541.051, if the controller:
733	733	(A) is not reasonably capable of associating the
734	734	request with the personal data or it would be unreasonably
735	735	burdensome for the controller to associate the request with the
736	736	personal data;
737	737	(B) does not use the personal data to recognize
738	738	or respond to the specific consumer who is the subject of the
739	739	personal data or associate the personal data with other personal
740	740	data about the same specific consumer; and
741	741	(C) does not sell the personal data to any third
742	742	party or otherwise voluntarily disclose the personal data to any
743	743	third party other than a processor, except as otherwise permitted
744	744	by this section.
745	745	(c) The consumer rights under Sections 541.051(b)(1)-(4)
746	746	and controller duties under Section 541.101 do not apply to
747	747	pseudonymous data in cases in which the controller is able to
748	748	demonstrate any information necessary to identify the consumer is
749	749	kept separately and is subject to effective technical and
750	750	organizational controls that prevent the controller from accessing
751	751	the information.
752	752	(d) A controller that discloses pseudonymous data or
753	753	deidentified data shall exercise reasonable oversight to monitor
754	754	compliance with any contractual commitments to which the
755	755	pseudonymous data or deidentified data is subject and shall take
756	756	appropriate steps to address any breach of the contractual
757	757	commitments.
758	758	Sec. 541.107. REQUIREMENTS FOR SMALL BUSINESSES. (a) A
759	759	person described by Section 541.002(a)(3) may not engage in the
760	760	sale of personal data that is sensitive data without receiving
761	761	prior consent from the consumer.
762	762	(b) A person who violates this section is subject to the
763	763	penalty under Section 541.155.
764	764	SUBCHAPTER D. ENFORCEMENT
765	765	Sec. 541.151. ENFORCEMENT AUTHORITY EXCLUSIVE. The
766	766	attorney general has exclusive authority to enforce this chapter.
767	767	Sec. 541.152. INTERNET WEBSITE AND COMPLAINT MECHANISM.
768	768	The attorney general shall post on the attorney general's Internet
769	769	website:
770	770	(1) information relating to:
771	771	(A) the responsibilities of a controller under
772	772	Subchapters B and C;
773	773	(B) the responsibilities of a processor under
774	774	Subchapter C; and
775	775	(C) a consumer's rights under Subchapter B; and
776	776	(2) an online mechanism through which a consumer may
777	777	submit a complaint under this chapter to the attorney general.
778	778	Sec. 541.153. INVESTIGATIVE AUTHORITY. (a) If the
779	779	attorney general has reasonable cause to believe that a person has
780	780	engaged in or is engaging in a violation of this chapter, the
781	781	attorney general may issue a civil investigative demand. The
782	782	procedures established for the issuance of a civil investigative
783	783	demand under Section 15.10 apply to the same extent and manner to
784	784	the issuance of a civil investigative demand under this section.
785	785	(b) The attorney general may request, pursuant to a civil
786	786	investigative demand issued under Subsection (a), that a controller
787	787	disclose any data protection assessment that is relevant to an
788	788	investigation conducted by the attorney general. The attorney
789	789	general may evaluate the data protection assessment for compliance
790	790	with the requirements set forth in Sections 541.101, 541.102, and
791	791	541.103.
792	792	Sec. 541.154. NOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY
793	793	TO CURE. Before bringing an action under Section 541.155, the
794	794	attorney general shall notify a person in writing, not later than
795	795	the 30th day before bringing the action, identifying the specific
796	796	provisions of this chapter the attorney general alleges have been
797	797	or are being violated. The attorney general may not bring an action
798	798	against the person if:
799	799	(1) within the 30-day period, the person cures the
800	800	identified violation; and
801	801	(2) the person provides the attorney general a written
802	802	statement that the person:
803	803	(A) cured the alleged violation;
804	804	(B) notified the consumer that the consumer's
805	805	privacy violation was addressed, if the consumer's contact
806	806	information has been made available to the person;
807	807	(C) provided supportive documentation to show
808	808	how the privacy violation was cured; and
809	809	(D) made changes to internal policies, if
810	810	necessary, to ensure that no such further violations will occur.
811	811	Sec. 541.155. CIVIL PENALTY; INJUNCTION. (a) A person who
812	812	violates this chapter following the cure period described by
813	813	Section 541.154 or who breaches a written statement provided to the
814	814	attorney general under that section is liable for a civil penalty in
815	815	an amount not to exceed $7,500 for each violation.
816	816	(b) The attorney general may bring an action in the name of
817	817	this state to:
818	818	(1) recover a civil penalty under this section;
819	819	(2) restrain or enjoin the person from violating this
820	820	chapter; or
821	821	(3) recover the civil penalty and seek injunctive
822	822	relief.
823	823	(c) The attorney general may recover reasonable attorney's
824	824	fees and other reasonable expenses incurred in investigating and
825	825	bringing an action under this section.
826	826	(d) The attorney general shall deposit a civil penalty
827	827	collected under this section in accordance with Section 402.007,
828	828	Government Code.
829	829	Sec. 541.156. NO PRIVATE RIGHT OF ACTION. This chapter may
830	830	not be construed as providing a basis for, or being subject to, a
831	831	private right of action for a violation of this chapter or any other
832	832	law.
833	833	SUBCHAPTER E. CONSTRUCTION OF CHAPTER; EXEMPTIONS FOR CERTAIN USES
834	834	OF CONSUMER PERSONAL DATA
835	835	Sec. 541.201. CONSTRUCTION OF CHAPTER. (a) This chapter
836	836	may not be construed to restrict a controller's or processor's
837	837	ability to:
838	838	(1) comply with federal, state, or local laws, rules,
839	839	or regulations;
840	840	(2) comply with a civil, criminal, or regulatory
841	841	inquiry, investigation, subpoena, or summons by federal, state,
842	842	local, or other governmental authorities;
843	843	(3) investigate, establish, exercise, prepare for, or
844	844	defend legal claims;
845	845	(4) provide a product or service specifically
846	846	requested by a consumer or the parent or guardian of a child,
847	847	perform a contract to which the consumer is a party, including
848	848	fulfilling the terms of a written warranty, or take steps at the
849	849	request of the consumer before entering into a contract;
850	850	(5) take immediate steps to protect an interest that
851	851	is essential for the life or physical safety of the consumer or of
852	852	another individual and in which the processing cannot be manifestly
853	853	based on another legal basis;
854	854	(6) prevent, detect, protect against, or respond to
855	855	security incidents, identity theft, fraud, harassment, malicious
856	856	or deceptive activities, or any illegal activity;
857	857	(7) preserve the integrity or security of systems or
858	858	investigate, report, or prosecute those responsible for breaches of
859	859	system security;
860	860	(8) engage in public or peer-reviewed scientific or
861	861	statistical research in the public interest that adheres to all
862	862	other applicable ethics and privacy laws and is approved,
863	863	monitored, and governed by an institutional review board or similar
864	864	independent oversight entity that determines:
865	865	(A) if the deletion of the information is likely
866	866	to provide substantial benefits that do not exclusively accrue to
867	867	the controller;
868	868	(B) whether the expected benefits of the research
869	869	outweigh the privacy risks; and
870	870	(C) if the controller has implemented reasonable
871	871	safeguards to mitigate privacy risks associated with research,
872	872	including any risks associated with reidentification; or
873	873	(9) assist another controller, processor, or third
874	874	party with any of the requirements under this subsection.
875	875	(b) This chapter may not be construed to prevent a
876	876	controller or processor from providing personal data concerning a
877	877	consumer to a person covered by an evidentiary privilege under the
878	878	laws of this state as part of a privileged communication.
879	879	(c) This chapter may not be construed as imposing a
880	880	requirement on controllers and processors that adversely affects
881	881	the rights or freedoms of any person, including the right of free
882	882	speech.
883	883	(d) This chapter may not be construed as requiring a
884	884	controller, processor, third party, or consumer to disclose a trade
885	885	secret.
886	886	Sec. 541.202. COLLECTION, USE, OR RETENTION OF DATA FOR
887	887	CERTAIN PURPOSES. (a) The requirements imposed on controllers and
888	888	processors under this chapter may not restrict a controller's or
889	889	processor's ability to collect, use, or retain data to:
890	890	(1) conduct internal research to develop, improve, or
891	891	repair products, services, or technology;
892	892	(2) effect a product recall;
893	893	(3) identify and repair technical errors that impair
894	894	existing or intended functionality; or
895	895	(4) perform internal operations that:
896	896	(A) are reasonably aligned with the expectations
897	897	of the consumer;
898	898	(B) are reasonably anticipated based on the
899	899	consumer's existing relationship with the controller; or
900	900	(C) are otherwise compatible with processing
901	901	data in furtherance of the provision of a product or service
902	902	specifically requested by a consumer or the performance of a
903	903	contract to which the consumer is a party.
904	904	(b) A requirement imposed on a controller or processor under
905	905	this chapter does not apply if compliance with the requirement by
906	906	the controller or processor, as applicable, would violate an
907	907	evidentiary privilege under the laws of this state.
908	908	Sec. 541.203. DISCLOSURE OF PERSONAL DATA TO THIRD-PARTY
909	909	CONTROLLER OR PROCESSOR. (a) A controller or processor that
910	910	discloses personal data to a third-party controller or processor,
911	911	in compliance with the requirements of this chapter, does not
912	912	violate this chapter if the third-party controller or processor
913	913	that receives and processes that personal data is in violation of
914	914	this chapter, provided that, at the time of the data's disclosure,
915	915	the disclosing controller or processor did not have actual
916	916	knowledge that the recipient intended to commit a violation.
917	917	(b) A third-party controller or processor receiving
918	918	personal data from a controller or processor in compliance with the
919	919	requirements of this chapter does not violate this chapter for the
920	920	transgressions of the controller or processor from which the
921	921	third-party controller or processor receives the personal data.
922	922	Sec. 541.204. PROCESSING OF CERTAIN PERSONAL DATA BY
923	923	CONTROLLER OR OTHER PERSON. (a) Personal data processed by a
924	924	controller under this subchapter may not be processed for any
925	925	purpose other than a purpose listed in this subchapter unless
926	926	otherwise allowed by this chapter. Personal data processed by a
927	927	controller under this subchapter may be processed to the extent
928	928	that the processing of the data is:
929	929	(1) reasonably necessary and proportionate to the
930	930	purposes listed in this subchapter; and
931	931	(2) adequate, relevant, and limited to what is
932	932	necessary in relation to the specific purposes listed in this
933	933	subchapter.
934	934	(b) Personal data collected, used, or retained under
935	935	Section 541.202(a) must, where applicable, take into account the
936	936	nature and purpose of such collection, use, or retention. The
937	937	personal data described by this subsection is subject to reasonable
938	938	administrative, technical, and physical measures to protect the
939	939	confidentiality, integrity, and accessibility of the personal data
940	940	and to reduce reasonably foreseeable risks of harm to consumers
941	941	relating to the collection, use, or retention of personal data.
942	942	(c) A controller that processes personal data under an
943	943	exemption in this subchapter bears the burden of demonstrating that
944	944	the processing of the personal data qualifies for the exemption and
945	945	complies with the requirements of Subsections (a) and (b).
946	946	(d) The processing of personal data by an entity for the
947	947	purposes described by Section 541.201 does not solely make the
948	948	entity a controller with respect to the processing of the data.
949	949	Sec. 541.205. LOCAL PREEMPTION. This chapter supersedes
950	950	and preempts any ordinance, resolution, rule, or other regulation
951	951	adopted by a political subdivision regarding the processing of
952	952	personal data by a controller or processor.
953	953	SECTION 3. (a) The Department of Information Resources,
954	954	under the management of the chief privacy officer, shall review the
955	955	implementation of the requirements of Chapter 541, Business &
956	956	Commerce Code, as added by this Act.
957	957	(b) Not later than September 1, 2024, the Department of
958	958	Information Resources shall create an online portal available on
959	959	the department's Internet website for members of the public to
960	960	provide feedback and recommend changes to Chapter 541, Business &
961	961	Commerce Code, as added by this Act. The online portal must remain
962	962	open for receiving feedback from the public for at least 90 days.
963	963	(c) Not later than January 1, 2025, the Department of
964	964	Information Resources shall make available to the public a report
965	965	detailing the status of the implementation of the requirements of
966	966	Chapter 541, Business & Commerce Code, as added by this Act, and any
967	967	recommendations to the legislature regarding changes to that law.
968	968	(d) This section expires September 1, 2025.
969	969	SECTION 4. Data protection assessments required to be
970	970	conducted under Section 541.105, Business & Commerce Code, as added
971	971	by this Act, apply only to processing activities generated after
972	972	the effective date of this Act and are not retroactive.
973	973	SECTION 5. Not later than July 1, 2024, the attorney general
974	974	shall post the information and online mechanism required by Section
975	975	541.152, Business & Commerce Code, as added by this Act.
976	976	SECTION 6. The provisions of this Act are hereby declared
977	977	severable, and if any provision of this Act or the application of
978	978	such provision to any person or circumstance is declared invalid
979	979	for any reason, such declaration shall not affect the validity of
980	980	the remaining portions of this Act.
981	981	SECTION 7. (a) Except as provided by Subsection (b) of this
982	982	section, this Act takes effect July 1, 2024.
983	983	(b) Section 541.055(e), Business & Commerce Code, as added
984	984	by this Act, takes effect January 1, 2025.
985	985	______________________________ ______________________________
986	986	President of the Senate Speaker of the House
987	987	I certify that H.B. No. 4 was passed by the House on April 5,
988	988	2023, by the following vote: Yeas 146, Nays 0, 1 present, not
989	989	voting; that the House refused to concur in Senate amendments to
990	990	H.B. No. 4 on May 15, 2023, and requested the appointment of a
991	991	conference committee to consider the differences between the two
992	992	houses; and that the House adopted the conference committee report
993	993	on H.B. No. 4 on May 28, 2023, by the following vote: Yeas 144,
994	994	Nays 0, 1 present, not voting.
995	995	______________________________
996	996	Chief Clerk of the House
997	997	I certify that H.B. No. 4 was passed by the Senate, with
998	998	amendments, on May 10, 2023, by the following vote: Yeas 30, Nays
999	999	0; at the request of the House, the Senate appointed a conference
1000	1000	committee to consider the differences between the two houses; and
1001	1001	that the Senate adopted the conference committee report on H.B. No.
1002	1002	4 on May 27, 2023, by the following vote: Yeas 31, Nays 0.
1003	1003	______________________________
1004	1004	Secretary of the Senate
1005	1005	APPROVED: __________________
1006	1006	Date
1007	1007	__________________
1008	1008	Governor