88R9015 JES-F
By: Holland H.B. No. 4917
A BILL TO BE ENTITLED
AN ACT
relating to the regulation of third-party data collection entities;
providing a civil penalty and authorizing a fee.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Subtitle A, Title 11, Business & Commerce Code,
is amended by adding Chapter 509 to read as follows:
CHAPTER 509. THIRD-PARTY DATA COLLECTION
Sec. 509.001. DEFINITIONS. In this chapter:
(1) "Biometric identifier" has the meaning assigned by
Section 503.001.
(2) "Child" means an individual younger than 18 years
of age.
(3) "Collect," in the context of data, means to
obtain, receive, access, or otherwise acquire the data by any
means, including by purchasing or renting the data.
(4) "Covered data" means personal identifying
information to which this chapter applies as provided by Section
509.002.
(5) "Deidentified data" means information that does
not identify and is not linked or cannot reasonably be linked to an
individual or to a device linked to that individual, regardless of
whether the information is aggregated.
(6) "Employee" includes an individual who is a
director, officer, staff member, trainee, volunteer, or intern of
an employer or an individual working as an independent contractor
for an employer, regardless of whether the individual is paid,
unpaid, or employed on a temporary basis. The term does not include
an individual contractor who is a service provider.
(7) "Employee data" means information collected,
processed, or transferred by an employer if the information:
(A) is related to:
(i) a job applicant and was collected
during the course of the hiring and application process;
(ii) an employee who is acting in a
professional capacity for the employer, including the employee's
business contact information such as the employee's name, position,
title, business telephone number, business address, or business
e-mail address;
(iii) an employee's emergency contact
information; or
(iv) an employee or the employee's spouse,
dependent, covered family member, or beneficiary; and
(B) was collected, processed, or transferred
solely for:
(i) a purpose relating to the status of a
person described by Paragraph (A)(i) as a current or former job
applicant of the employer;
(ii) a purpose relating to the professional
activities of an employee described by Paragraph (A)(ii) on behalf
of the employer;
(iii) the purpose of having an emergency
contact on file for an employee described by Paragraph (A)(iii) and
for transferring the information in case of an emergency; and
(iv) the purpose of administering benefits
to which an employee described by Paragraph (A)(iv) is entitled or
to which another person described by that paragraph is entitled on
the basis of the employee's position with the employer.
(8) "Genetic data" means any data, regardless of
format, concerning an individual's genetic characteristics. The
term includes:
(A) raw sequence data derived from sequencing all
or a portion of an individual's extracted DNA; and
(B) genotypic and phenotypic information
obtained from analyzing an individual's raw sequence data.
(9) "Personal identifying information" has the
meaning assigned by Section 521.002.
(10) "Precise geolocation data" means information
accessed on a device or technology that shows the past or present
physical location of an individual or the individual's device with
sufficient precision to identify street-level location information
of the individual or device in a range of not more than 1,850 feet.
The term does not include location information regarding an
individual or device identifiable or derived solely from the visual
content of a legally obtained image, including the location of a
device that captured the image.
(11) "Process," in the context of data, means to
conduct or direct any operation or set of operations performed on
the data, including using, storing, or otherwise handling the data.
(12) "Publicly available information" means
information:
(A) that a business entity or service provider
reasonably believes is lawfully available to the general public:
(i) from a governmental record, unless use
of the information by the business entity violates the governmental
entity's restriction or terms of use for that information;
(ii) from widely distributed media,
including information from:
(a) a telephone book or online
directory;
(b) a television, Internet, or radio
program;
(c) the news media; or
(d) a generally available Internet
website or online service on which the relevant information has not
been restricted to a specific audience;
(iii) from a disclosure as required by law;
or
(iv) by visual observation in a public
place, other than data collected by a device in the individual's
possession; and
(B) that is not:
(i) an obscene visual depiction under 18
U.S.C. Section 1460;
(ii) an inference:
(a) made exclusively from multiple
independent sources of publicly available information; and
(b) that does not disclose an
individual's sensitive information;
(iii) a biometric identifier;
(iv) combined with personal identifying
information;
(v) genetic information not disclosed by
the individual in a manner provided by Paragraph (A); or
(vi) a nonconsensual intimate image, if
known to be nonconsensual.
(13) "Sensitive covered data" means:
(A) a government-issued identifier not required
by law to be available publicly, including:
(i) a social security number;
(ii) a passport number; or
(iii) a driver's license number;
(B) information that describes or reveals an
individual's mental or physical health diagnosis, condition, or
treatment;
(C) an individual's financial information,
except the last four digits of a debit or credit card number,
including:
(i) a financial account number;
(ii) a credit or debit card number; or
(iii) information that describes or reveals
the income level or bank account balances of the individual;
(D) a biometric identifier;
(E) genetic data;
(F) precise geolocation data;
(G) an individual's private communication that:
(i) if made using a device, is not made
using a device provided by the individual's employer that provides
conspicuous notice to the individual that the employer may access
communication made using the device; and
(ii) includes, unless the third-party data
collection entity is the sender or an intended recipient of the
communication:
(a) the individual's voicemails,
e-mails, texts, direct messages, or mail;
(b) information that identifies the
parties involved in the communications; and
(c) information that relates to the
transmission of the communications, including telephone numbers
called, telephone numbers from which calls were placed, the time
calls were made, call duration, and location information of the
parties to the call;
(H) a log-in credential, security code, or access
code for an account or device;
(I) information identifying the sexual behavior
of the individual in a manner inconsistent with the individual's
reasonable expectation regarding the collection, processing, or
transfer of the information;
(J) calendar information, address book
information, phone or text logs, photos, audio recordings, or
videos:
(i) maintained for private use by an
individual and stored on the individual's device or in another
location; and
(ii) not communicated using a device
provided by the individual's employer unless the employee was
provided conspicuous notice that the employer may access
communication made using the device;
(K) a photograph, film, video recording, or other
similar medium that shows the individual or a part of the individual
nude or wearing undergarments;
(L) information revealing the video content
requested or selected by an individual that is not:
(i) collected by a provider of broadcast
television service, cable service, satellite service, streaming
media service, or other video programming, as that term is defined
by 47 U.S.C. Section 613(h)(2); or
(ii) used solely for transfers for
independent video measurement;
(M) information regarding a known child;
(N) information revealing an individual's racial
or ethnic origin, color, religious beliefs, or union membership;
(O) information identifying an individual's
online activities over time accessing multiple Internet websites or
online services; or
(P) information collected, processed, or
transferred for the purpose of identifying information described by
this subdivision.
(14) "Service provider" means a person that receives,
collects, processes, or transfers personal identifying information
on behalf of, and at the direction of, a business or governmental
entity, including a business or governmental entity that is another
service provider, in order for the person to perform a service or
function with or on behalf of the business or governmental entity.
(15) "Third-party data collection entity" means a
business entity that collects, processes, or transfers covered data
that the entity did not collect directly from the individual linked
or linkable to the data.
(16) "Transfer," in the context of data, means to
disclose, release, share, disseminate, make available, or license
the data by any means or medium.
Sec. 509.002. APPLICABILITY TO CERTAIN DATA. (a) Except as
provided by Subsection (b), this chapter applies to personal
identifying information from an individual who resides in this
state that is collected, transferred, or processed by a third-party
data collection entity.
(b) This chapter does not apply to the following data:
(1) deidentified data, if the third-party data
collection entity:
(A) takes reasonable technical measures to
ensure that the data is not able to be used to identify an
individual with whom the data is associated;
(B) publicly commits in a clear and conspicuous
manner:
(i) to process and transfer the data solely
in a deidentified form without any reasonable means for
reidentification; and
(ii) to not attempt to identify the
information to an individual with whom the data is associated; and
(C) contractually obligates a person that
receives the information from the provider:
(i) to comply with this subsection with
respect to the information; and
(ii) to require that those contractual
obligations be included in any subsequent transfer of the data to
another person;
(2) employee data;
(3) publicly available information; or
(4) inferences made exclusively from multiple
independent sources of publicly available information that do not
reveal sensitive covered data with respect to an individual.
Sec. 509.003. APPLICABILITY OF CHAPTER TO CERTAIN BUSINESS
ENTITIES. (a) Except as provided by Subsection (b), this chapter
applies to a third-party data collection entity, which is a
business entity that, in a 12-month period, derives:
(1) more than 50 percent of the entity's revenue from
processing or transferring covered data that the entity did not
collect directly from the individuals to whom the data pertains; or
(2) revenue from processing or transferring the
covered data of more than 50,000 individuals that the entity did not
collect directly from the individuals to whom the data pertains.
(b) This chapter does not apply to:
(1) a business entity that:
(A) is engaging in the business of processing
employee data for a third party for the sole purpose of providing
benefits to the third party's employees; or
(B) is collecting covered data from another
entity to which the entity is related by common ownership or
corporate control if a reasonable consumer would expect the
entities to share the relevant data;
(2) a business entity that is a service provider with
respect to the entity's use of covered data;
(3) a governmental entity or an entity that is
collecting, processing, or transferring covered data as a service
provider for a governmental entity; or
(4) an entity that serves as a congressionally
designated nonprofit, national resource center, or clearinghouse
to provide assistance to victims, families, child-serving
professionals, and the general public on missing and exploited
children issues.
Sec. 509.004. NOTICE ON WEBSITE OR MOBILE APPLICATION. A
third-party data collection entity that maintains an Internet
website or mobile application shall post a conspicuous notice on
the website or application that:
(1) states that the entity maintaining the website or
application is a third-party data collection entity;
(2) must be clear, not misleading, and be readily
accessible by the general public, including individuals with a
disability;
(3) contains language provided by rule of the
secretary of state for inclusion in the notice; and
(4) provides a link to the "do not collect" online
registry established under Section 509.006.
Sec. 509.005. REGISTRATION. (a) To conduct business in
this state, a third-party data collection entity to which this
chapter applies that collects, processes, or transfers the covered
date of individuals residing in this state shall register with the
secretary of state by filing a registration statement and paying a
registration fee of $300.
(b) The registration statement must include:
(1) the legal name of the third-party data collection
entity;
(2) a contact person and the primary physical address,
e-mail address, telephone number, and Internet website address for
the entity;
(3) a description of the categories of data the entity
processes and transfers;
(4) a statement of whether or not the entity
implements a purchaser credentialing process that includes taking
reasonable steps to confirm that:
(A) the actual identity of the entity's customer
and the customer's use of the data matches the identity and intended
use provided to the entity by the customer; and
(B) the entity's customers will not use the data
for a nefarious purpose;
(5) if the entity has actual knowledge that the entity
possesses personal identifying information of a child:
(A) a statement detailing the data collection
practices, databases, sales activities, and opt-out policies that
are applicable to the personal identifying information of a child;
and
(B) a statement on how the entity complies with
applicable federal and state law regarding the collection, use, or
disclosure of personal identifying information from and about a
child on the Internet;
(6) the number of security breaches the entity has
experienced during the year immediately preceding the year in which
the registration is filed, and if known, the total number of
consumers affected by each breach;
(7) any litigation or unresolved complaints related to
the operation of the entity; and
(8) any Internet website link the entity provides to
allow individuals to easily access the "do not collect" online
registry established under Section 509.006.
(c) A registration of a third-party data collection entity
may include any additional information or explanation the
third-party data collection entity chooses to provide to the
secretary of state concerning the entity's data collection
practices.
(d) A registration certificate expires on the first
anniversary of its date of issuance. A third-party data collection
entity may renew a registration certificate by filing a renewal
application, in the form prescribed by the secretary of state, and
paying a renewal fee in the amount of $300.
Sec. 509.006. REGISTRY OF THIRD-PARTY COLLECTING ENTITIES;
DO NOT COLLECT REQUESTS. (a) The secretary of state shall
establish and maintain, on its Internet website, a searchable,
central registry of third-party data collection entities
registered under Section 509.005.
(b) The registry must include:
(1) a search feature that allows a person searching
the registry to identify a specific third-party data collection
entity;
(2) for each third-party data collection entity, the
information filed under Section 509.005(b); and
(3) a link and mechanism by which individuals may
submit do not collect requests to third-party collection entities,
other than consumer reporting agencies, as provided by Subsection
(c).
(c) The secretary of state shall ensure that under the
mechanism described by Subsection (b) an individual has the
capability to easily submit a single request requiring all
registered third-party data collection entities to:
(1) delete, not later than the 30th day after
receiving the request, all covered data related to the requesting
individual that is in their possession and was not collected from
the individual directly; and
(2) cease collecting, processing, or transferring
covered data related to the requesting individual, unless the
entity receives the individual's affirmative express consent to
continue to collect, process, or transfer data, as applicable, in
accordance with Subsection (e).
(d) Notwithstanding Subsection (c), a third-party data
collection entity may decline to comply with a request under that
subsection if the entity:
(1) knows that the individual has been convicted of a
crime related to the abduction or sexual exploitation of a child,
and that the data the entity is collecting is necessary to
effectuate the purposes of a federal or state sex offender registry
or of an entity described by Section 509.003(b)(4); or
(2) is a consumer reporting agency governed by the
Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.).
(e) For purposes of Subsection (c)(2), an individual is
considered to have given the individual's affirmative express
consent if the individual, by an affirmative act, clearly
communicates the individual's specific and unambiguous
authorization for the act or practice in response to a specific
request by a third-party data collection entity that:
(1) is provided to the individual in a clear,
conspicuous, and separate disclosure presented through:
(A) the primary medium by which the entity offers
its products or services; or
(B) another medium regularly used in conjunction
with the entity's products or services;
(2) includes a description of the processing purpose
for which the individual's consent is sought, that:
(A) clearly states the specific categories of
personal identifying information the business will collect,
process, or transfer for that purpose;
(B) includes a prominent heading; and
(C) is written in easily understood language
intended to enable a reasonable individual to identify and
understand the processing purpose for which consent is sought;
(3) explains the individual's right to give and revoke
consent under this section;
(4) is made in a manner reasonably accessible to and
usable by an individual with a disability;
(5) is made available in each language in which the
business provides a product or service for which consent is sought;
(6) presents the option to refuse consent at least as
prominently as the option to accept; and
(7) ensures that refusing to consent takes not more
than the same amount of steps to complete as the option to accept
consent.
(f) If the processing purpose disclosed to an individual in
a request made under Subsection (e) changes, a third-party data
collection entity must request and receive a new consent that meets
the requirements of that subsection before the entity is able to
collect, transfer, or process any further information pursuant to
that consent.
(g) An individual's inaction or continued use of a service
or product provided by a third-party data collection entity does
not constitute an individual's affirmative express consent for
purposes of Subsection (e).
(h) A third-party data collection entity may not obtain or
attempt to obtain an individual's affirmative express consent under
Subsection (b) through:
(1) the use of a false, fraudulent, or materially
misleading statement or representation; or
(2) the design, modification, or manipulation of a
user interface to impair a reasonable individual's autonomy to
consent or to withhold certain personal identifying information.
Sec. 509.007. CIVIL PENALTY. (a) A third-party data
collection entity that violates Section 509.004, 509.005, or
509.006 is liable to this state for a civil penalty as prescribed by
this section.
(b) A civil penalty imposed against a third-party data
collection entity under this section:
(1) subject to Subdivision (2), may not be in an amount
less than the total of:
(A) $100 for each day the entity is in violation
of Section 509.004 or 509.005; and
(B) the amount of unpaid registration fees for
each year the entity failed to register in violation of Section
509.005; and
(2) may not exceed $10,000 assessed against the same
entity in a 12-month period.
(c) The attorney general may bring an action to recover a
civil penalty imposed under this section. The attorney general may
recover reasonable attorney's fees and court costs incurred in
bringing the action.
Sec. 509.008. DECEPTIVE TRADE PRACTICE. A violation of
this chapter constitutes a deceptive trade practice in addition to
the practices described by Subchapter E, Chapter 17, and is
actionable under that subchapter.
Sec. 509.009. RULES. The secretary of state shall adopt
rules as necessary to implement this chapter.
SECTION 2. Not later than December 1, 2023, the secretary of
state shall adopt rules necessary to facilitate registration by a
third-party data collection entity under Section 509.005, Business &
Commerce Code, as added by this Act.
SECTION 3. Chapter 509, Business & Commerce Code, as added
by this Act, applies only to the collection, processing, or
transfer of personal identifying information by a third-party data
collection entity on or after the effective date of this Act.
SECTION 4. This Act takes effect September 1, 2023.