By: Nichols S.B. No. 821
(In the Senate - Filed February 9, 2023; March 1, 2023, read
first time and referred to Committee on Business & Commerce;
March 30, 2023, reported adversely, with favorable Committee
Substitute by the following vote: Yeas 11, Nays 0; March 30, 2023,
sent to printer.)
Click here to see the committee vote
COMMITTEE SUBSTITUTE FOR S.B. No. 821 By: Nichols
A BILL TO BE ENTITLED
AN ACT
relating to the review by the Sunset Advisory Commission of the sale
of personal data by state agencies.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Chapter 325, Government Code, is amended by
adding Section 325.0124 to read as follows:
Sec. 325.0124. REVIEW OF AGENCY'S SALE OF PERSONAL DATA.
(a) In this section, "personal data" means any information
relating to an identified or identifiable individual that directly
or indirectly identifies the individual by reference to:
(1) an identifier for the individual, including a
name, an identification number, location information, or an online
identifier; or
(2) one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural, or social
identity of the individual.
(b) As part of its review of a state agency, the commission
shall determine whether the state agency sells personal data the
agency possesses. If the state agency sells personal data, the
commission shall determine:
(1) to whom the personal data is sold;
(2) to the extent possible, the purpose for which the
personal data is sold;
(3) the amount the state agency receives for the sale
of the personal data; and
(4) the law that authorizes the state agency to sell
the personal data.
(c) The commission shall recommend prohibiting the sale of
personal data by a state agency, unless the commission identifies a
compelling state or public interest justifying the state agency's
authority to sell the personal data. If the commission recommends
continuing the state agency's authority to sell personal data, the
commission shall make any recommendations it considers necessary to
protect the personal data from improper use and dissemination.
SECTION 2. This Act takes effect September 1, 2023.
* * * * *