Texas 2023 - 88th Regular

Texas Senate Bill SB704 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R228 YDB/JSC-D
2	2	By: Paxton S.B. No. 704
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to the capture and use of an individual's biometric
8	8	identifiers, specimen, or genetic information by a governmental
9	9	body or peace officer or by a person for commercial purposes;
10	10	authorizing civil penalties.
11	11	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
12	12	SECTION 1. The heading to Title 11, Business & Commerce
13	13	Code, is amended to read as follows:
14	14	TITLE 11. PERSONAL [IDENTITY] INFORMATION
15	15	SECTION 2. The heading to Subtitle A, Title 11, Business &
16	16	Commerce Code, is amended to read as follows:
17	17	SUBTITLE A. IDENTIFYING AND OTHER PERSONAL INFORMATION
18	18	SECTION 3. The heading to Chapter 503, Business & Commerce
19	19	Code, is amended to read as follows:
20	20	CHAPTER 503. BIOMETRIC IDENTIFIERS, GENETIC INFORMATION, AND
21	21	SPECIMEN COLLECTION
22	22	SECTION 4. Chapter 503, Business & Commerce Code, is
23	23	amended by adding Section 503.0005 to read as follows:
24	24	Sec. 503.0005. DEFINITIONS. In this chapter:
25	25	(1) "Deidentified data" means data not reasonably
26	26	linked to an identifiable individual.
27	27	(2) "Direct-to-individual genetic testing company"
28	28	means an entity that:
29	29	(A) offers genetic testing products or services
30	30	directly to individuals; or
31	31	(B) collects, uses, or analyzes genetic data that
32	32	an individual provides to the entity.
33	33	(3) "DNA" means deoxyribonucleic acid.
34	34	(4) "Express consent" means an individual's
35	35	affirmative response to a clear and meaningful notice regarding the
36	36	collection, use, or disclosure of genetic data for a specific
37	37	purpose.
38	38	(5) "Genetic data" means any data, regardless of
39	39	format, concerning an individual's genetic characteristics. The
40	40	term:
41	41	(A) includes:
42	42	(i) raw sequence data derived from
43	43	sequencing all or a portion of an individual's extracted DNA;
44	44	(ii) genotypic and phenotypic information
45	45	obtained from analyzing an individual's raw sequence data; and
46	46	(iii) health information regarding the
47	47	health conditions that an individual self-reports to a company and
48	48	that the company:
49	49	(a) uses for scientific research or
50	50	product development; and
51	51	(b) analyzes in connection with the
52	52	individual's raw sequence data; and
53	53	(B) does not include deidentified data.
54	54	(6) "Genetic testing" means:
55	55	(A) a laboratory test of an individual's complete
56	56	DNA, regions of DNA, chromosomes, genes, or gene products to
57	57	determine the presence of the individual's genetic
58	58	characteristics; or
59	59	(B) an interpretation of an individual's genetic
60	60	data.
61	61	(7) "Specimen" means a sample of an individual's
62	62	blood, urine, or other bodily fluid or tissue taken for scientific
63	63	analysis to detect or diagnose a disease.
64	64	SECTION 5. The heading to Section 503.001, Business &
65	65	Commerce Code, is amended to read as follows:
66	66	Sec. 503.001. CAPTURE OR USE OF BIOMETRIC IDENTIFIER;
67	67	COLLECTION OR USE OF SPECIMEN.
68	68	SECTION 6. Section 503.001, Business & Commerce Code, is
69	69	amended by amending Subsections (b) and (c) and adding Subsection
70	70	(c-3) to read as follows:
71	71	(b) A person may not capture a biometric identifier of or
72	72	collect a specimen from an individual for a commercial purpose
73	73	unless the person:
74	74	(1) informs the individual before capturing the
75	75	biometric identifier or collecting the specimen of the pending
76	76	capture or collection; [and]
77	77	(2) receives the individual's consent to capture the
78	78	biometric identifier or collect the specimen; and
79	79	(3) if capturing a biometric identifier, informs the
80	80	individual before capturing the biometric identifier of the
81	81	purposes for which the person will use the biometric identifier.
82	82	(c) A person who possesses a biometric identifier or
83	83	specimen of an individual that is captured or collected for a
84	84	commercial purpose:
85	85	(1) may not sell, lease, or otherwise disclose the
86	86	biometric identifier or specimen test results to another person
87	87	unless:
88	88	(A) the individual consents to the disclosure for
89	89	identification purposes in the event of the individual's
90	90	disappearance or death;
91	91	(B) the disclosure of a biometric identifier
92	92	completes a financial transaction that the individual requested or
93	93	authorized;
94	94	(C) the disclosure is required or permitted by a
95	95	federal statute or by a state statute other than Chapter 552,
96	96	Government Code; or
97	97	(D) the disclosure is made by or to a law
98	98	enforcement agency for a law enforcement purpose in response to a
99	99	warrant;
100	100	(2) shall store, transmit, and protect from disclosure
101	101	the biometric identifier or specimen test results using reasonable
102	102	care and in a manner that is the same as or more protective than the
103	103	manner in which the person stores, transmits, and protects any
104	104	other confidential information the person possesses; and
105	105	(3) shall destroy the biometric identifier or specimen
106	106	within a reasonable time, but not later than the first anniversary
107	107	of the date the purpose for capturing [collecting] the identifier
108	108	or collecting the specimen expires, except as provided by
109	109	Subsection (c-1).
110	110	(c-3) A person who captures a biometric identifier of or
111	111	collects a specimen from an individual for a commercial purpose
112	112	shall provide to the individual information on:
113	113	(1) the type of technology to be used on the identifier
114	114	or the scientific testing to be used on the specimen;
115	115	(2) the purpose of and method for capturing the
116	116	identifier or collecting the specimen; and
117	117	(3) the method for storing data related to the
118	118	captured identifier or collected specimen.
119	119	SECTION 7. Chapter 503, Business & Commerce Code, is
120	120	amended by adding Sections 503.002, 503.003, 503.004, and 503.005
121	121	to read as follows:
122	122	Sec. 503.002. REQUIREMENTS FOR CERTAIN USES OF DEIDENTIFIED
123	123	DATA. (a) Except as otherwise provided by this chapter or other
124	124	law, a direct-to-individual genetic testing company that possesses
125	125	an individual's deidentified data shall:
126	126	(1) implement administrative and technical measures
127	127	to ensure the data is not associated with a specific individual; and
128	128	(2) publicly commit to maintaining and using data in
129	129	deidentified form and refraining from making any attempt to
130	130	identify an individual using the individual's deidentified data.
131	131	(b) If a direct-to-individual genetic testing company
132	132	shares an individual's deidentified data with another person, the
133	133	company shall enter into a legally enforceable contractual
134	134	obligation prohibiting the person from attempting to identify an
135	135	individual using the individual's deidentified data.
136	136	Sec. 503.003. REQUIREMENTS FOR CERTAIN USES OF GENETIC DATA
137	137	AND SPECIMEN. (a) A direct-to-individual genetic testing company
138	138	shall develop, implement, and maintain:
139	139	(1) a comprehensive security program to protect an
140	140	individual's genetic data against unauthorized access, use, or
141	141	disclosure; and
142	142	(2) a prominent, publicly available privacy notice
143	143	that includes information about the company's data collection,
144	144	consent, use, access, disclosure, transfer, security, retention,
145	145	and deletion practices.
146	146	(b) Before collecting, using, or disclosing an individual's
147	147	genetic data, a direct-to-individual genetic testing company shall
148	148	provide to the individual:
149	149	(1) information about the company's collection, use,
150	150	and disclosure of genetic data the company collects through a
151	151	genetic testing product or service, including information that:
152	152	(A) clearly describes the company's use of the
153	153	genetic data;
154	154	(B) specifies the persons who have access to test
155	155	results; and
156	156	(C) specifies the manner in which the company may
157	157	share the genetic data; and
158	158	(2) the privacy notice required by Subsection (a)(2).
159	159	(c) A direct-to-individual genetic testing company shall
160	160	provide a process for an individual to:
161	161	(1) access the individual's genetic data;
162	162	(2) delete the individual's account and genetic data;
163	163	and
164	164	(3) destroy or require the destruction of the
165	165	individual's specimen.
166	166	Sec. 503.004. REQUIRED CONSENT. A direct-to-individual
167	167	genetic testing company engaging in any of the following activities
168	168	must obtain:
169	169	(1) an individual's separate express consent for:
170	170	(A) the transfer or disclosure of the
171	171	individual's genetic data to any person other than the company's
172	172	vendors and service providers;
173	173	(B) the use of genetic data for a purpose other
174	174	than the primary purpose of the company's genetic testing product
175	175	or service; or
176	176	(C) the retention of any specimen provided by the
177	177	individual following the company's completion of the initial
178	178	testing service requested by the individual;
179	179	(2) an individual's informed consent in accordance
180	180	with guidelines for the protection of human subjects issued under
181	181	45 C.F.R. Part 46, for transfer or disclosure of the individual's
182	182	genetic data to a third party for:
183	183	(A) research purposes; or
184	184	(B) research conducted under the control of the
185	185	company for the purpose of publication or generalizable knowledge;
186	186	and
187	187	(3) an individual's express consent for:
188	188	(A) marketing by the company to the individual
189	189	based on the individual's genetic data; or
190	190	(B) marketing by a third party to the individual
191	191	based on the individual's ordering or purchasing of a genetic
192	192	testing product or service.
193	193	Sec. 503.005. PROHIBITED DISCLOSURES. (a) A
194	194	direct-to-individual genetic testing company may not disclose an
195	195	individual's genetic data to a law enforcement entity or other
196	196	governmental body unless:
197	197	(1) the company first obtains the individual's express
198	198	written consent; or
199	199	(2) the entity or body obtains a warrant under Article
200	200	18.25, Code of Criminal Procedure, or complies with another valid
201	201	legal process required by the company.
202	202	(b) A direct-to-individual genetic testing company may not
203	203	disclose, without first obtaining an individual's written consent,
204	204	the individual's genetic data to:
205	205	(1) an entity that offers health insurance, life
206	206	insurance, or long-term care insurance; or
207	207	(2) an employer of the individual.
208	208	SECTION 8. Section 503.001(d), Business & Commerce Code, is
209	209	redesignated as Section 503.006, Business & Commerce Code, and
210	210	amended to read as follows:
211	211	Sec. 503.006. CIVIL PENALTY. [(d)] A person who violates
212	212	this chapter [section] is subject to a civil penalty of not more
213	213	than $25,000 for each violation. The attorney general may bring an
214	214	action to recover the civil penalty.
215	215	SECTION 9. Chapter 18, Code of Criminal Procedure, is
216	216	amended by adding Article 18.25 to read as follows:
217	217	Art. 18.25. WARRANTS FOR GENETIC INFORMATION FROM CERTAIN
218	218	BUSINESSES. (a) This article applies to a business that collects
219	219	and analyzes genetic information to provide information about an
220	220	individual's genetic traits or biological relationships.
221	221	(b) A peace officer may require a business described by
222	222	Subsection (a) to provide the genetic information of a customer of
223	223	the business by obtaining a warrant under this chapter or by
224	224	obtaining the consent of the customer.
225	225	(c) A court may issue a warrant for genetic information held
226	226	by a business described by Subsection (a) only if the applicant for
227	227	the warrant shows that reasonable investigative leads have been
228	228	pursued and have failed to identify the perpetrator of an alleged
229	229	criminal offense. For purposes of this subsection, reasonable
230	230	investigative leads are credible, case-specific facts,
231	231	information, or circumstances that would lead a reasonably cautious
232	232	investigator to believe that pursuit of the leads would have a fair
233	233	probability of identifying the perpetrator of the offense.
234	234	(d) A peace officer who obtains a warrant with respect to
235	235	genetic information held by a business described by Subsection (a)
236	236	may apply to the court issuing the warrant for an order commanding
237	237	the business to whom the warrant is directed not to disclose to any
238	238	person the existence of the warrant. The order is effective for the
239	239	period the court considers appropriate. The court shall enter the
240	240	order under this subsection if the court determines that there is
241	241	reason to believe that notification of the existence of the warrant
242	242	will lead to an adverse result, including:
243	243	(1) endangering the life or physical safety of an
244	244	individual;
245	245	(2) flight from prosecution;
246	246	(3) destruction of or tampering with evidence;
247	247	(4) intimidation of a potential witness; or
248	248	(5) otherwise seriously jeopardizing an investigation
249	249	or unduly delaying a trial.
250	250	(e) Unless an order is issued under Subsection (d), the
251	251	peace officer who executes a warrant for the genetic information of
252	252	a customer shall notify the customer of the existence of the
253	253	warrant.
254	254	SECTION 10. The heading to Chapter 560, Government Code, is
255	255	amended to read as follows:
256	256	CHAPTER 560. BIOMETRIC IDENTIFIER AND GENETIC INFORMATION
257	257	SECTION 11. Section 560.001, Government Code, is amended to
258	258	read as follows:
259	259	Sec. 560.001. DEFINITIONS. In this chapter:
260	260	(1) "Biometric identifier" means any measurement of
261	261	the human body or its movement that is used to attempt to uniquely
262	262	identify or authenticate the identity of an individual, including a
263	263	blood sample, hair sample, skin sample, body scan, retina or iris
264	264	scan, fingerprint, voiceprint, or record of hand or face geometry.
265	265	(2) "Genetic information" means information that is:
266	266	(A) obtained from or based on a scientific or
267	267	medical determination of the presence or absence in an individual
268	268	of a genetic characteristic; or
269	269	(B) derived from the results of a genetic test of
270	270	an individual's genes, gene products, or chromosomes.
271	271	(3) "Genetic test" has the meaning assigned by Section
272	272	546.001, Insurance Code.
273	273	(4) "Governmental body" has the meaning assigned by
274	274	Section 552.003, except that the term includes each entity within
275	275	or created by the judicial branch of state government.
276	276	SECTION 12. Chapter 560, Government Code, is amended by
277	277	adding Section 560.0015 to read as follows:
278	278	Sec. 560.0015. STATUTORY AUTHORITY REQUIRED. (a) A
279	279	governmental body may not capture or possess a biometric identifier
280	280	of an individual or require a biometric identifier as a
281	281	prerequisite for providing a governmental service to the individual
282	282	unless the governmental body:
283	283	(1) has specific, explicit statutory authority that:
284	284	(A) allows the governmental body to:
285	285	(i) capture or possess the individual's
286	286	biometric identifier; or
287	287	(ii) require the individual's biometric
288	288	identifier as a prerequisite for providing a governmental service
289	289	to the individual; or
290	290	(B) allows the governmental body to require and
291	291	obtain the written consent of the individual or the individual's
292	292	legal guardian before:
293	293	(i) capturing or possessing the
294	294	individual's biometric identifier; or
295	295	(ii) requiring the individual's biometric
296	296	identifier as a prerequisite for providing a governmental service
297	297	to the individual;
298	298	(2) obtains the voluntary, written consent of the
299	299	individual or the individual's legal guardian;
300	300	(3) is a health care provider or health care facility
301	301	that captures, possesses, or requires the individual's biometric
302	302	identifier in the provision of health care services to the
303	303	individual; or
304	304	(4) is a criminal justice agency, as defined by
305	305	Article 66.001, Code of Criminal Procedure, that captures,
306	306	possesses, or requires the individual's biometric identifier while
307	307	engaged in the administration of criminal justice, as defined by
308	308	that article.
309	309	(b) For purposes of Subsection (a), Subchapter B, Chapter
310	310	33, Health and Safety Code, is specific, explicit statutory
311	311	authority under Subsection (a)(1)(A)(i) to capture or possess an
312	312	individual's biometric identifier in the conduct of newborn
313	313	screening as provided by that subchapter.
314	314	SECTION 13. Chapter 560, Government Code, is amended by
315	315	adding Sections 560.004, 560.005, 560.006, and 560.007 to read as
316	316	follows:
317	317	Sec. 560.004. DESTRUCTION OF SAMPLE GENETIC MATERIAL;
318	318	EXCEPTIONS. A governmental body shall promptly destroy a sample of
319	319	genetic material obtained from an individual for a genetic test
320	320	after the purpose for which the sample was obtained is accomplished
321	321	unless:
322	322	(1) the sample is retained under a court order;
323	323	(2) the individual authorizes retention of the sample
324	324	for medical treatment or scientific research;
325	325	(3) the sample was obtained for research authorized by
326	326	an institutional review board and retention of the sample is:
327	327	(A) under a requirement the institutional review
328	328	board imposes on a specific research project; or
329	329	(B) authorized by the research participant with
330	330	institutional review board approval in accordance with federal law;
331	331	or
332	332	(4) the sample was obtained for a screening test
333	333	prescribed by the Department of State Health Services under Section
334	334	33.011, Health and Safety Code, and performed by that department or
335	335	a laboratory approved by that department.
336	336	Sec. 560.005. CONFIDENTIALITY OF GENETIC INFORMATION. (a)
337	337	Except as provided by Sections 560.006(a) and (b), genetic
338	338	information is confidential and privileged regardless of the source
339	339	of the information.
340	340	(b) A governmental body that holds an individual's genetic
341	341	information may not disclose or be compelled to disclose, by
342	342	subpoena or otherwise, that information unless the disclosure is
343	343	specifically authorized by the individual as provided by Section
344	344	560.007.
345	345	(c) This section applies to a redisclosure of genetic
346	346	information by a secondary recipient of the information after
347	347	disclosure of the information by an initial recipient. Except as
348	348	provided by Section 560.006(b), a governmental body may not
349	349	redisclose genetic information unless the redisclosure is
350	350	consistent with the disclosures authorized by the tested individual
351	351	under an authorization executed under Section 560.007.
352	352	Sec. 560.006. EXCEPTIONS TO CONFIDENTIALITY. (a) Subject
353	353	to Subchapter G, Chapter 411, genetic information may be disclosed
354	354	without an authorization under Section 560.007 if the disclosure
355	355	is:
356	356	(1) authorized under a state or federal criminal law
357	357	relating to:
358	358	(A) the identification of individuals; or
359	359	(B) a criminal or juvenile proceeding, an
360	360	inquest, or a child fatality review by a multidisciplinary
361	361	child-abuse team;
362	362	(2) required under a specific order of a state or
363	363	federal court;
364	364	(3) needed to establish paternity as authorized under
365	365	a state or federal law;
366	366	(4) needed to provide genetic information of a
367	367	decedent and the information is disclosed to the blood relatives of
368	368	the decedent for medical diagnosis; or
369	369	(5) needed to identify a decedent.
370	370	(b) A governmental body may redisclose genetic information
371	371	without an authorization under Section 560.007 for actuarial or
372	372	research studies if:
373	373	(1) a tested individual could not be identified in any
374	374	actuarial or research report; and
375	375	(2) any materials that identify a tested individual
376	376	are returned or destroyed as soon as reasonably practicable.
377	377	(c) A redisclosure authorized under Subsection (b) may
378	378	contain only genetic information reasonably necessary to
379	379	accomplish the purpose for which the information is disclosed.
380	380	Sec. 560.007. AUTHORIZED DISCLOSURE. An individual or an
381	381	individual's legal representative may authorize disclosure of the
382	382	individual's genetic information by submitting a statement that:
383	383	(1) is written in plain language and is signed by the
384	384	individual or legal representative;
385	385	(2) is dated;
386	386	(3) contains a specific description of the information
387	387	to be disclosed;
388	388	(4) identifies or describes each person authorized to
389	389	disclose the genetic information;
390	390	(5) identifies or describes the individuals or
391	391	entities to whom the genetic information may be disclosed or
392	392	subsequently redisclosed;
393	393	(6) describes the specific purpose of the disclosure;
394	394	and
395	395	(7) advises the individual or legal representative
396	396	that the individual's authorized representative is entitled to
397	397	receive a copy of the authorization.
398	398	SECTION 14. Section 33.012(a), Health and Safety Code, is
399	399	amended to read as follows:
400	400	(a) Screening tests may not be administered to a newborn
401	401	child whose parents, managing conservator, or guardian objects to
402	402	[on the ground that] the tests [conflict with the religious tenets
403	403	or practices of an organized church of which they are adherents].
404	404	SECTION 15. Subchapter C, Chapter 81, Health and Safety
405	405	Code, is amended by adding Section 81.0465 to read as follows:
406	406	Sec. 81.0465. EXPRESS CONSENT FOR SPECIMEN COLLECTION, USE,
407	407	AND DISCLOSURE; CONFIDENTIALITY; CIVIL PENALTY. (a) In this
408	408	section:
409	409	(1) "COVID-19" means the 2019 novel coronavirus
410	410	disease.
411	411	(2) "Express consent" means an individual's
412	412	affirmative response to a clear and meaningful notice regarding the
413	413	collection, use, or disclosure of a specimen for a specific
414	414	purpose.
415	415	(3) "Specimen" means a sample of an individual's
416	416	blood, urine, or other bodily fluid or tissue taken for scientific
417	417	analysis to detect or diagnose a disease.
418	418	(b) A person who collects a specimen from an individual to
419	419	test for a specific disease may not use or analyze the specimen for
420	420	a purpose unrelated to the test without the individual's express
421	421	consent to the use or analysis for another purpose.
422	422	(c) A person who possesses an individual's specimen that is
423	423	collected for a commercial purpose shall destroy the specimen
424	424	within a reasonable time, but not later than the first anniversary
425	425	of the date the purpose for collecting the specimen expires.
426	426	(d) A person who obtains an individual's specimen or other
427	427	personal information in relation to the collection of COVID-19 data
428	428	may not disclose that information without the express consent of
429	429	the individual.
430	430	(e) A person who violates this section is subject to a civil
431	431	penalty of not more than $1,000 for each violation. The attorney
432	432	general may bring an action to recover the civil penalty.
433	433	(f) This section does not apply to a specimen collected by a
434	434	direct-to-individual genetic testing company as defined by Section
435	435	503.0005, Business & Commerce Code.
436	436	SECTION 16. Article 18.25, Code of Criminal Procedure, as
437	437	added by this Act, applies only to a warrant issued on or after the
438	438	effective date of this Act.
439	439	SECTION 17. The changes in law made by this Act apply only
440	440	to a biometric identifier captured, a specimen collected, or
441	441	genetic information obtained or to a biometric identifier, a
442	442	specimen, or genetic information requested on or after the
443	443	effective date of this Act. A biometric identifier, a specimen, or
444	444	genetic information captured, collected, obtained, or requested
445	445	before that date is governed by the law in effect immediately before
446	446	the effective date of this Act, and that law is continued in effect
447	447	for that purpose.
448	448	SECTION 18. This Act takes effect September 1, 2023.