H.B.ANo.A4

1

AN ACT2

relating to the regulation of the collection, use, processing, and3treatment of consumers ’ personal data by certain business entities;4

imposing a civil penalty.

5

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

6SECTIONA1.AAThis Act may be cited as the Texas Data Privacy

789and Security Act.
SECTIONA2.AATitle 11, Business & Commerce Code, is amended byadding Subtitle C to read as follows:

10

SUBTITLE C. CONSUMER DATA PROTECTION

11

CHAPTER 541. CONSUMER DATA PROTECTION

12SUBCHAPTER A. GENERAL PROVISIONS

13
14Sec.A541.001.AADEFINITIONS.

In

this

chapter,

unlessadifferent meaning is required by the context:

15(1)AA"Affiliate" means a legal entity that controls, is

16

controlled by, or is under common control with another legal entity

17

or shares common branding with another legal entity. For purposes

18of this subdivision, "control" or "controlled" means:

19(A)AAthe ownership of, or power to vote, more than20

50 percent of the outstanding shares of any class of voting security

21

of a company;

22(B)AAthe control in any manner over the election

23of a majority of the directors or of individuals exercising similar

24functions; or1

H.B.ANo.A4(C)AAthe power to exercise controlling influence

1
2

over the management of a company.

3(2)AA"Authenticate" means to verify through reasonable

4means that the consumer who is entitled to exercise the consumer ’s

5rights under Subchapter B is the same consumer exercising those6

consumer rights with respect to the personal data at issue.
(3)AA"Biometric data" means data generated by automatic

7
8

measurements of an individual ’s biological characteristics.

9

term includes a fingerprint, voiceprint, eye retina or iris, or10other unique biological pattern or characteristic that is used to11

identify

12

physical or digital photograph or data generated from a physical or

13

digital photograph, a video or audio recording or data generated

14

from a video or audio recording, or information collected, used, or

15

stored for health care treatment, payment, or operations under the16

Health Insurance Portability and Accountability Act of 1996 (4217

U.S.C. Section 1320d et seq.).

aspecific

individual.

The

term

does

not

The

includea18(4)AA"Business associate" has the meaning assigned to19

the term by the Health Insurance Portability and Accountability Act20

of 1996 (42 U.S.C. Section 1320d et seq.).
(5)AA"Child" means an individual younger than 13 years

21
22

of age.

23(6)AA"Consent," when referring to a consumer, means a
consumer ’s

24

clear

25

specific, informed, and unambiguous agreement to process personal

26

data

27

statement, including a statement written by electronic means, oraffirmative

relating

to

act

the

signifying

consumer.

2

a

The

term

freelyincludesagiven,

written

H.B.ANo.A4
1

any

other

2

include:unambiguous

affirmative

action.

The

term

does

not

3

(A)AAacceptance of a general or broad terms of use

4

or similar document that contains descriptions of personal data

5

processing along with other, unrelated information;(B)AAhovering over, muting, pausing, or closing a6
7given piece of content; or(C)AAagreement obtained through the use of dark

89patterns.

10(7)AA"Consumer" means an individual who is a resident

11of this state acting only in an individual or household context. The

12

term

13

employment context.

does

not

includeanindividual

actinginacommercial

or14(8)AA"Controller" means an individual or other person

15

that, alone or jointly with others, determines the purpose and16means of processing personal data.

17(9)AA"Covered entity" has the meaning assigned to the18term by the Health Insurance Portability and Accountability Act of

191996 (42 U.S.C. Section 1320d et seq.).
(10)AA"Dark pattern" means a user interface designed or

20
21

manipulated

with

22

impairing user autonomy, decision-making, or choice, and includes

23

any

24

pattern.

practicethetheeffectFederal(11)AA"Decision

25

ofsubstantially

Trade

Commission

thatproducesasubvertingaorrefers

to

as

dark

legal

or

similarly

26

significant effect concerning a consumer" means a decision made by

27

the

controller

that

results

in

the

3

provisionor

denialbytheH.B.ANo.A4
1

controller of:

2(A)AAfinancial and lending services;3(B)AAhousing, insurance, or health care services;

4(C)AAeducation enrollment;

5(D)AAemployment opportunities;

6(E)AAcriminal justice; or

7(F)AAaccess to basic necessities, such as food and89water.
(12)AA"Deidentified

data"

means

data

that

cannot10

reasonably be linked to an identified or identifiable individual,

11

or a device linked to that individual.

12(13)AA"Health care provider" has the meaning assigned

13

to the term by the Health Insurance Portability and Accountability

14

Act of 1996 (42 U.S.C. Section 1320d et seq.).

15(14)AA"Health record" means any written, printed, or

16electronicallyrecordedmaterial

maintainedbyahealthcare

17provider in the course of providing health care services to an

18

individual that concerns the individual and the services provided.

19

The term includes:

20(A)AAthe substance of any communication made by an

21

individual to a health care provider in confidence during or in

22connection with the provision of health care services; or

23(B)AAinformation otherwise acquired by the health24

care provider about an individual in confidence and in connection

25

with health care services provided to the individual.

2627(15)AA"Identified or identifiable individual" means a
consumer who can be readily identified, directly or indirectly.

4

H.B.ANo.A4(16)AA"Institution of higher education" means:

1(A)AAan institution of higher education as defined2
3

by Section 61.003, Education Code; or(B)AAa4
5

privateorindependent

institutionofhigher education as defined by Section 61.003, Education Code.

6(17)AA"Known child" means a child under circumstances7

where a controller has actual knowledge of, or wilfully disregards,

8

the child ’s age.
(18)AA"Nonprofit organization" means:

910(A)AAa corporation organized under Chapters 20 and

1122, Business Organizations Code, and the provisions of Title 1,

12

Business Organizations Code, to the extent applicable to nonprofit

13

corporations;(B)AAan organization exempt from federal taxation

14
15

under

Section

501(a),

16

listedas

exempt17

501(c)(6), 501(c)(12), or 501(c)(19) of that code;

18(C)AAa political organization; or

19(D)AAan organization that:anInternal

Revenueorganization

Code

under

of

1986,

Sectionbybeing

501(c)(3),20(i)AAis exempt from federal taxation under21

Section 501(a), Internal Revenue Code of 1986, by being listed as an

22

exempt organization under Section 501(c)(4) of that code; and(ii)AAis

23
24

described

bySection701.052(a),Insurance Code.

25(19)AA"Personal data" means any information, including

26

sensitive

data,

27

identified

or

that

is

linkedidentifiableorreasonably

individual.

5The

linkable
term

to

an

includesH.B.ANo.A4
1

pseudonymous data when the data is used by a controller or processor2

in conjunction with additional information that reasonably links

3

the data to an identified or identifiable individual.

4

not include deidentified data or publicly available information.
(20)AA"Political5organization"

The term does

means

a

party,

6

committee, association, fund, or other organization, regardless of

7

whether incorporated, that is organized and operated primarily for8

the purpose of influencing or attempting to influence:(A)AAthe9selection,

nomination,

election,or10

appointment of an individual to a federal, state, or local public

11

office or an office in a political organization, regardless of

12whether

13

appointed; ortheindividualisselected,(B)AAthe14nominated,

election

elected,

of

or

a

15

presidential/vice-presidential elector, regardless of whether the

16elector is selected, nominated, elected, or appointed.
(21)AA"Precise

17

geolocation

data"

means

information

18

derived from technology, including global positioning system level

19

latitude20

directly identifies the specific location of an individual with21

precision and accuracy within a radius of 1,750 feet.

22

not include the content of communications or any data generated by23

or connected to an advanced utility metering infrastructure system

24

or to equipment for use by a utility.

andlongitude

coordinates

or

other

mechanisms,

that

The term does

25(22)AA"Process" or "processing" means an operation or26

set of operations performed, whether by manual or automated means,27

onpersonal

data

or

on

sets

of

6

personal

data,

such

as

the

H.B.ANo.A4
1

collection,use,

storage,disclosure,2

modification of personal data.

3(23)AA"Processor"

4

personal data on behalf of a controller.

means

a

analysis,

persondeletion,

that

or

processes

5(24)AA"Profiling" means any form of solely automated6

processing performed on personal data to evaluate, analyze, or7

predict personal aspects related to an identified or identifiable

8

individual ’s

9interests, reliability, behavior, location, or movements.

economicsituation,

health,personal

preferences,(25)AA"Protected health information" has the meaning

10
11

assigned

to

the

term

by

the

HealthInsurance

Portability

12

Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.).

and

13

(26)AA"Pseudonymous data" means any information that14

cannot be attributed to a specific individual without the use of15

additional information, provided that the additional information

16

is kept separately and is subject to appropriate technical and17organizational measures to ensure that the personal data is not

18

attributed to an identified or identifiable individual.
(27)AA"Publicly

19

lawfully

21

records, or information that a business has a reasonable basis to22

believe is lawfully made available to the general public through23

widely distributed media, by a consumer, or by a person to whom a24

consumer has disclosed the information, unless the consumer has

25

restricted the information to a specific audience.
(28)AA"Sale

of

made

available

personal

data"

throughmeans

information27

isinformation"

20

26

that

availablemeans

government

thesharing,

disclosing, or transferring of personal data for monetary or other7

H.B.ANo.A4
1

valuable consideration by the controller to a third party.

2

does not include:(A)AAthe3

Adisclosureofpersonal

The term

data

to

a

4

processor that processes the personal data on the controller ’s

5behalf;

6(B)AAthe Adisclosure of personal data to a third

7

party for purposes of providing a product or service requested by8

the consumer;(C)AAthe disclosure or transfer of personal data

910

to an affiliate of the controller;(D)AAthe1112(i)AAintentionallyinformation

that

the

made

available

tothegeneral public through a mass media channel; and(ii)AAdid

15
16

of

consumer:

13
14

disclosurenotrestricttoaspecificaudience; or

17(E)AAtheAdisclosure or transfer of personal data18

to a third party as an asset that is part of a merger or acquisition.
(29)AA"Sensitive

19
20

data"

means

a

categoryofpersonal

data. The term includes:(A)AApersonal

21

data

revealing

racialor

ethnic22

origin, religious beliefs, mental or physical health diagnosis,

23

sexuality, or citizenship or immigration status;(B)AAgenetic or biometric data that is processed24
25

for the purpose of uniquely identifying an individual;(C)AApersonal data collected from a known child;

26
27

or

8

H.B.ANo.A4(D)AAprecise geolocation data.

12(30)AA"State agency" means a department, commission,3

board, office, council, authority, or other agency in any branch of

4state government that is created by the constitution or a statute of5

this state, including a university system or institution of higher

6

education as defined by Section 61.003, Education Code.
(31)AA"Targeted7

advertising"means

displaying

to

a

8

consumer an advertisement that is selected based on personal data

9

obtained

from

that

consumer ’soronlineoverandacrosstopredict

nonaffiliated11

consumer ’s preferences or interests. The term does not include:

12(A)AAan advertisement that:(i)AAis13

applications

time

10

14

websites

activities

based

on

activities

withintheacontroller ’s own websites or online applications;

15(ii)AAis based on the context of a consumer ’s

16current search query, visit to a website, or online application; or17(iii)AAis directed to a consumer in response18

to the consumer ’s request for information or feedback; or(B)AAthe processing of personal data solely for

19
20

measuring21

frequency.

22orreporting(32)AA"Third

advertising

party"

means

performance,aperson,reach,

other

than

or

the

23

consumer, the controller, the processor, or an affiliate of the24

controller or processor.

25(33)AA"Tradesecret"

means

all

forms

and

types

of

26

information, including business, scientific, technical, economic,27

or engineering information, and any formula, design, prototype,9

H.B.ANo.A4
1

pattern, plan, compilation, program device, program, code, device,2

method, technique, process, procedure, financial data, or list of3

actual or potential customers or suppliers, whether tangible or4

intangible and whether or how stored, compiled, or memorialized

5

physically, electronically, graphically, photographically, or in6

writing if:(A)AAthe

7

owner

of

the

trade

secret

has

taken

8

reasonable measures under the circumstances to keep the information

9

secret; and

10(B)AAthe information derives independent economic

11

value, actual or potential, from not being generally known to, and12

not being readily ascertainable through proper means by, another13

person who can obtain economic value from the disclosure or use of14

the information.
Sec.A541.002.AAAPPLICABILITY OF CHAPTER.

1516(1)AAconducts

business

in

this

state

or

producesa

product or service consumed by residents of this state;(2)AAprocesses or engages in the sale of personal data;

19
20This chapter

applies only to a person that:

17
18

(a)

and

21

(3)AAis not a small business as defined by the United

22

States Small Business Administration, except to the extent that

23

Section 541.107 applies to a person described by this subdivision.
(b)AAThis chapter does not apply to:24(1)AAa state agency or a political subdivision of this

25
26
27

state;(2)AAa financial institution or data subject to Title

10

H.B.ANo.A4
1

V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.);2(3)AAa covered entity or business associate governed by3

the privacy, security, and breach notification rules issued by the4

United States Department of Health and Human Services, 45 C.F.R.

5

Parts

6

Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d

7

et seq.), and the Health Information Technology for Economic and8

Clinical Health Act (Division A, Title XIII, and Division B, Title

9

IV, Pub. L. No.A111-5);

160

and

164,

established

under

the

HealthInsurance

10(4)AAa nonprofit organization;

11(5)AAan institution of higher education; or12(6)AAan electric utility, a power generation company,

13

or a retail electric provider, as those terms are defined by Section

14

31.002, Utilities Code.
Sec.A541.003.AACERTAIN INFORMATION EXEMPT FROM CHAPTER.

15
16

The

following information is exempt from this chapter:(1)AAprotected17

healthinformation

under

the

Health18

Insurance Portability and Accountability Act of 1996 (42 U.S.C.

19

Section 1320d et seq.);20(2)AAhealth records;

21(3)AApatient identifying information for purposes of 42

22

U.S.C. Section 290dd-2;(4)AAidentifiable private information:

23(A)AAfor purposes of the federal policy for the24
25

protection of human subjects under 45 C.F.R. Part 46;(B)AAcollected as part of human subjects research

26
27

under

the

good

clinicalpractice11

guidelines

issuedbyThe

H.B.ANo.A4
1

International Council for Harmonisation of Technical Requirements

2

for Pharmaceuticals for Human Use (ICH) or of the protection of3

human subjects under 21 C.F.R. Parts 50 and 56; or(C)AAthat

4ispersonal

data

used

or

sharedin5

research conducted in accordance with the requirements set forth in

6

this

7

applicable law;

chapteror

otherresearch

conducted

inaccordance

with

8

(5)AAinformation and documents created for purposes of9

the Health Care Quality Improvement Act of 1986 (42 U.S.C. Section

1011101 et seq.);(6)AApatient safety work product for purposes of the

11
12

Patient

Safetyand

Quality

13

Section 299b-21 et seq.);

Improvement(7)AAinformation

14

derivedlisted

Act

from

2005

(42

U.S.C.

any

of

the

health15care-related

information

16

deidentified

in17

deidentification

18

Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);

accordance
under

the

in

of

with

Healththis

sectiontherequirements

Insurance

that

Portability

is
for
and

(8)AAinformation originating from, and intermingled to

19
20

be

indistinguishable

with,

or

information

treated

in

the

same

21

manner as, information exempt under this section that is maintained

22

by a covered entity or business associate as defined by the Health23

Insurance Portability and Accountability Act of 1996 (42 U.S.C.

24

Section 1320d et seq.) or by a program or a qualified service

25

organization as defined by 42 U.S.C. Section 290dd-2;

26(9)AAinformation that is included in a limited data set

27

as described by 45 C.F.R. Section 164.514(e), to the extent that the12

H.B.ANo.A4
1

information

is

used,

2

specified by 45 C.F.R. Section 164.514(e);3(10)AAinformation
activities

disclosed,

and

and

maintained

in

the

manner

used

only

for

publicauthorized

by

the

Healthcollected

purposes

as

or

4

health5

Insurance Portability and Accountability Act of 1996 (42 U.S.C.

6

Section 1320d et seq.);7(11)AAthe collection, maintenance, disclosure, sale,8

communication, or use of any personal information bearing on a9

consumer ’screditworthiness,creditstanding,

creditcapacity,

10

character, general reputation, personal characteristics, or mode

11of living by a consumer reporting agency or furnisher that provides

12

information

13

consumer

14

regulated by and authorized under the Fair Credit Reporting Act (1515

U.S.C. Section 1681 et seq.);

16

for

report,

use
but

in

a

consumer

report,toextentonly(12)AApersonal

data

the

collected,

and

by

a

that

the

activity

processed,

user

of

sold,

a
is

or

17

disclosed in compliance with the Driver ’s Privacy Protection Act of18

1994 (18 U.S.C. Section 2721 et seq.);

19
20
21

(13)AApersonal data regulated by the Family Educational
Rights and Privacy Act of 1974 (20 U.S.C. Section 1232g);(14)AApersonal

datacollected,

processed,

sold,

or

22

disclosed in compliance with the Farm Credit Act of 1971 (12 U.S.C.

23

Section 2001 et seq.);24(15)AAdata processed or maintained in the course of an25

individual applying to, being employed by, or acting as an agent or

26

independent contractor of a controller, processor, or third party,

27

to the extent that the data is collected and used within the context

13

H.B.ANo.A4
1of that role;2(16)AAdata processed or maintained Aas the emergency

3

contact information of an individual under this chapter that is

4

used for emergency contact purposes; or(17)AAdata

5

that

is

processedormaintained

and

is

6

necessary to retain to administer benefits for another individual

7

that relates to an individual described by Subdivision (15) and8

used for the purposes of administering those benefits.
Sec.A541.004.AAINAPPLICABILITY

9

OF

CHAPTER.

This

chapter10

does not apply to the processing of personal data by a person in the11course of a purely personal or household activity.
Sec.A541.005.AAEFFECT OF COMPLIANCE WITH PARENTAL CONSENT

1213REQUIREMENTS UNDER CERTAIN FEDERAL LAW.

14

that complies with the verifiable parental consent requirements of15

the Children ’s Online Privacy Protection Act of 1998 (15 U.S.C.

16

Section 6501 et seq.) with respect to data collected online is17

considered18

parental consent under this chapter.

to

be

in

compliance

SUBCHAPTER B.

19

with

A controller or processoranyrequirementtoobtain

CONSUMER ’S RIGHTS

Sec.A541.051.AACONSUMER ’S PERSONAL DATA RIGHTS; REQUEST TO

20
21

EXERCISE RIGHTS.

22

consumer

23

submitting a request to a controller specifying the consumer rights24

the consumer wishes to exercise.

25

personal data belonging to a known child, a parent or legal guardian

26of the child may exercise the consumer rights on behalf of the27

child.

rights(a)

A consumer is entitled to exercise theauthorized

by

this

section

at

any

time

by

With respect to the processing of

14

H.B.ANo.A4(b)AAA1
2

shallcomplywith

ancontrollerisauthenticatedconsumer request to exercise the right to:(1)AAconfirm

3
4

controller

whetheraprocessing

theconsumer ’s personal data and to access the personal data;

5(2)AAcorrect inaccuracies in the consumer ’s personal

6

data, taking into account the nature of the personal data and the7

purposes of the processing of the consumer ’s personal data;(3)AAdelete personal data provided by or obtained about

89the consumer;(4)AAif

10

the

data

is

availableinadigitalformat,11

obtain a copy of the consumer ’s personal data that the consumer

12

previously provided to the controller in a portable and, to the13

extent technically feasible, readily usable format that allows the14

consumer

15

hindrance; ortransmit

the

data

to

another

controller

without(5)AAopt out of the processing of the personal data for

16
17

to

purposes of:

18(A)AAtargeted advertising;

19(B)AAthe sale of personal data; or

20(C)AAprofiling in furtherance of a decision that21

produces a legal or similarly significant effect concerning the22

consumer.

23

Sec.A541.052.AACONTROLLER RESPONSE TO CONSUMER REQUEST.

24

Except as otherwise provided by this chapter, a controller shall25

comply26

consumer ’s rights pursuant to Section 541.051 as provided by this27

section.

witharequestsubmitted

15

by

a

consumertoexercise(a)theH.B.ANo.A4(b)AAA1

controller

shall

respondtotheconsumerrequest2

without undue delay, which may not be later than the 45th day after3

the date of receipt of the request.

4

response

5

necessary, taking into account the complexity and number of the

6

consumer ’s requests, so long as the controller informs the consumer

7

of

8

together with the reason for the extension.

theperiodonce

extensionbyanwithinThe controller may extend the

additional

the

45

initialdays

45-daywhen

reasonably

response

period,(c)AAIf a controller declines to take action regarding the

910

consumer ’s

11

without undue delay, which may not be later than the 45th day after

12

the

13

declining to take action and provide instructions on how to appeal

14

the decision in accordance with Section 541.053.

daterequest,ofthereceiptofcontroller

the

shall

request,of

informthetheconsumerjustification

for(d)AAA controller shall provide information in response to a15
16

consumerrequestfreeofcharge,

at

least

twice

annuallyper17

consumer.

18

excessive, or repetitive, the controller may charge the consumer a19reasonable fee to cover the administrative costs of complying with20

the request or may decline to act on the request.

21

bears the burden of demonstrating for purposes of this subsection

22

that a request is manifestly unfounded, excessive, or repetitive.

If a request from a consumer is manifestly unfounded,

The controller(e)AAIf a controller is unable to authenticate the request

23
24

using

25

required to comply with a consumer request submitted under Section

26

541.051

27

information reasonably necessary to authenticate the consumer andcommercially

and

may

reasonable

requestthat

efforts,

the

16

the

consumer

controller

provideisnotadditional

H.B.ANo.A4
1

the consumer ’s request.

2(f)AAA controller that has obtained personal data about a3

consumer from a source other than the consumer is considered in

4compliance with a consumer ’s request to delete that personal data

5

pursuant to Section 541.051(b)(3) by:

6(1)AAretaining a record of the deletion request and the7minimum data necessary for the purpose of ensuring the consumer ’s

8personal data remains deleted from the business ’s records and not

9using the retained data for any other purpose under this chapter; or

10(2)AAopting the consumer out of the processing of that

11

personal data for any purpose other than a purpose that is exempt

12

under the provisions of this chapter.

13

Sec.A541.053.AAAPPEAL.

(a)

A controller shall establish a

14

process for a consumer to appeal the controller ’s refusal to take15

action on a request within a reasonable period of time after the16

consumer ’s receipt of the decision under Section 541.052(c).

17(b)AAThe appeal process must be conspicuously available and18

similar to the process for initiating action to exercise consumer

19

rights by submitting a request under Section 541.051.

20(c)AAA controller shall inform the consumer in writing of any

21

action taken or not taken in response to an appeal under this22

section not later than the 60th day after the date of receipt of the23

appeal, including a written explanation of the reason or reasons

24

for the decision.

25(d)AAIf the controller denies an appeal, the controller shall26

provide the consumer with the online mechanism described by Section

27

541.152 through which the consumer may contact the attorney general17

H.B.ANo.A4
1

to submit a complaint.
Sec.A541.054.AAWAIVER

2

OR

LIMITATIONOFCONSUMERRIGHTS

3PROHIBITED.

Any provision of a contract or agreement that waives or4limits in any way a consumer right described by Sections 541.051,

5541.052, and 541.053 is contrary to public policy and is void and6

unenforceable.
Sec.A541.055.AAMETHODS7FORSUBMITTING

CONSUMERREQUESTS.

8(a)

A controller shall establish two or more secure and reliable9

methods to enable consumers to submit a request to exercise their

10

consumer rights under this chapter. The methods must take into

11

account:(1)AAthe ways in which consumers normally interact with12
13

the controller;(2)AAthe

14
15

for

secureandreliablecommunications of those requests; and(3)AAthe ability of the controller to authenticate the1617necessity

identity of the consumer making the request.

18(b)AAA controller may not require a consumer to create a new

19

account to exercise the consumer ’s rights under this subchapter but

20

may require a consumer to use an existing account.
(c)AAExcept as provided by Subsection (d), if the controller

21
22

maintainsanInternet

23

mechanism

on

the

24

information required to be disclosed under this chapter.

25

website,websiteforthecontroller

consumers

to

must

submitproviderequestsafor(d)AAA controller that operates exclusively online and has a26

direct27

collects personal information is only required to provide an e-mailrelationship

with

a

consumer

18

from

whom

the

controller

H.B.ANo.A4
1

address for the submission of requests described by Subsection (c).

2(e)AAA consumer may designate another person to serve as the3

consumer ’s authorized agent and act on the consumer ’s behalf to opt

4

out

5

Sections 541.051(b)(5)(A) and (B).

6authorized

7

Internet website, an Internet browser setting or extension, or a

8

global setting on an electronic device, that allows the consumer to9indicate the consumer ’s intent to opt out of the processing.

of

the

processing

agent

using

of

a

consumer ’s

thepersonal

data

under

A consumer may designate an

technology,

including

a

link

to

an

A

10

controller shall comply with an opt-out request received from an

11authorized agent under this subsection if the controller is able to12

verify, with commercially reasonable effort, the identity of the

13

consumer

14

consumer ’s behalf.

15

opt-out

16

subsection if:

andrequestauthorized

agent ’sauthority

to

act

on

the

A controller is not required to comply with anreceived(1)AAthe

17
18

the

from

an

authorized

authorized

agent

does

agent

not

under

communicate

this

the

request to the controller in a clear and unambiguous manner;(2)AAthe19

controller

is

not

able

to

verify,with

20

commercially reasonable effort, that the consumer is a resident of

21

this state;

22
23
24

(3)AAthe controller does not possess the ability toprocess the request; or(4)AAthecontroller

does

not

process

similaror25

identical requests the controller receives from consumers for the26

purpose of complying with similar or identical laws or regulations

27of another state.

19

H.B.ANo.A4(f)AAA technology described by Subsection (e):12(1)AAmay not unfairly disadvantage another controller;

3(2)AAmay not make use of a default setting, but must4

require the consumer to make an affirmative, freely given, and5unambiguous choice to indicate the consumer ’s intent to opt out of

6

any processing of a consumer ’s personal data; and(3)AAmust be consumer-friendly and easy to use by the78average consumer.

9

SUBCHAPTER C.

CONTROLLER AND PROCESSOR DATA-RELATED DUTIES AND
PROHIBITIONS

10

Sec.A541.101.AACONTROLLER

1112

DUTIES;

TRANSPARENCY.

(a)

A

controller:

13(1)AAshall limit the collection of personal data to

14

what is adequate, relevant, and reasonably necessary in relation to

15

the

16

disclosed to the consumer; andpurposes

for

which

that

personal

data

isprocessed,

as17(2)AAfor purposes ofAprotecting the confidentiality,18

integrity, and accessibility of personal data, shall establish,

19

implement, and maintain reasonable administrative, technical, and20

physical data security practices that are appropriate to the volume

21

and nature of the personal data at issue.

22(b)AAA controller may not:(1)AAexcept

23

asotherwiseprovidedby

thischapter,

24

process personal data for a purpose that is neither reasonably

25

necessary to nor compatible with the disclosed purpose for which

26

the

27

unless the controller obtains the consumer ’s consent;

personal

data

isprocessed,20

asdisclosedtotheconsumer,

H.B.ANo.A4(2)AAprocess personal data in violation of state and12federallaws

3consumers;

thatprohibit

unlawful

discrimination

against4(3)AAdiscriminate against a consumer for exercising any

5of the consumer rights contained in this chapter, including by

6

denying goods or services, charging different prices or rates for7

goods or services, or providing a different level of quality of8goods or services to the consumer; or

9(4)AAprocess the sensitive data of a consumer without

10

obtaining the consumer ’s consent, or, in the case of processing the11sensitive data of a known child, without processing that data in

12

accordance with the Children ’s Online Privacy Protection Act of

131998 (15 U.S.C. Section 6501 et seq.).

14(c)AASubsection (b)(3) may not be construed to require a

15

controller

16

personal data of a consumer that the controller does not collect or17maintain or to prohibit a controller from offering a different

18

price, rate, level, quality, or selection of goods or services to a19

consumer, including offering goods or services for no fee, if the20

consumer

21

Section 541.051 or the offer is related to a consumer ’s voluntary

22

participation in a bona fide loyalty, rewards, premium features,

23

discounts, or club card program.

24

to

has

provideexercisedaproduct

theSec.A541.102.AAPRIVACY

or

serviceconsumer ’s

NOTICE.

that

right

(a)

to

A

requiresopt

out

controller

the

under

shall

25

provide consumers with a reasonably accessible and clear privacy

26

notice that includes:

27(1)AAthe categories of personal data processed by the21

H.B.ANo.A4
1

controller, including, if applicable, any sensitive data processed2by the controller;

3(2)AAthe purpose for processing personal data;

4(3)AAhow consumers may exercise their consumer rights

5

under Subchapter B, including the process by which a consumer may

6

appeal7

request;a(4)AAif89decision

applicable,

with

the

regardtocategories

theconsumer ’sofpersonal

of

third

data

that the controller shares with third parties;(5)AAif1011

controller ’sapplicable,thecategories

partieswith whom the controller shares personal data; and(6)AAa12

description

of

the

methods

required

under

13

Section 541.055 through which consumers can submit requests to14

exercise their consumer rights under this chapter.

15(b)AAIf a controller engages in the sale of personal data

16

that is sensitive data, the controller shall include the following

17

notice:18"NOTICE: We may sell your sensitive personal data."

The

19

notice must be posted in the same location and in the same manner as

20

the privacy notice described by Subsection (a).

21(c)AAIf a controller engages in the sale of personal data

22

that is biometric data, the controller shall include the following

23

notice:24"NOTICE: We may sell your biometric personal data."

25

notice must be posted in the same location and in the same manner as

26

the privacy notice described by Subsection (a).

27

The

Sec.A541.103.AASALE OF DATA TO THIRD PARTIES AND PROCESSING

22

H.B.ANo.A4
1

DATA FOR TARGETED ADVERTISING; DISCLOSURE.

2

personal

3

targeted4

conspicuously

5

consumer may exercise the right to opt out of that process.

data

to

third

parties

advertising,disclose

the
that

or

processes

controller
process

andpersonal

shall
the

Sec.A541.104.AADUTIES OF PROCESSOR.

6

If a controller sells

clearlymanner

(a)

data

in

for
and

which

a

A processor shall7

adhere to the instructions of a controller and shall assist the8controller in meeting or complying with the controller ’s duties or

9requirements under this chapter, including:(1)AAassisting the controller in responding to consumer

10
11

rightsrequests

submitted

underSection541.051

by

using

12

appropriate technical and organizational measures, as reasonably

13

practicable, taking into account the nature of processing and the14

information available to the processor;(2)AAassisting the controller with regard to complying

15
16

with

the

17

personal data and to the notification of a breach of security of the

18

processor ’ssystem19

natureprocessing

20

processor; andof21

requirement

relating

under

to

Chapter

and

the

the

521,

securitytakinginformation

into

necessary

information

todocument

data

controller

23

under Section 541.105.

conduct

andprocessing

account

available(3)AAproviding

22

of

to

protection

the

to

the

enabletheassessments

24(b)AAA contract between a controller and a processor shall25

govern the processor ’s data processing procedures with respect to26

processing performed on behalf of the controller. The contract must27

include:23

H.B.ANo.A4
1(1)AAclear instructions for processing data;

2(2)AAthe nature and purpose of processing;

3(3)AAthe type of data subject to processing;

4(4)AAthe duration of processing;

5(5)AAthe rights and obligations of both parties; and6(6)AAa requirement that the processor shall:

7(A)AAensure that each person processing personal

8

data is subject to a duty of confidentiality with respect to the

9

data;
the

(B)AAat10controller ’s

direction,

deleteor11

return all personal data to the controller as requested after the

12

provision of the service is completed, unless retention of the13

personal data is required by law;
(C)AAmake14

available

tothecontroller,on15

reasonable request, all information in the processor ’s possession

16

necessary

17

requirements of this chapter;

18(D)AAallow,

to19

assessments

20

assessor; anddemonstrate

by

the

that

cooperateoranyrequirescompliance

the

the

with,

reasonable

controller ’s

designatedsubcontractor
the

with

pursuant

subcontractor

to

to

22

written23

requirements of the processor with respect to the personal data.

24

contract

andcontroller(E)AAengage

21

processor ’s

the

meet

a

the

(c)AANotwithstanding the requirement described by Subsection

25(b)(6)(D),aprocessor,

in

the

alternative,

26

qualified and independent assessor to conduct an assessment of the

27

processor ’s policies and technical and organizational measures in

24

may

arrangeforaH.B.ANo.A4
1

support of the requirements under this chapter using an appropriate

2

and

3

procedure.

4

to the controller on request.

accepted

controlorframeworkandassessment

The processor shall provide a report of the assessment(d)AAThis5

standardor

may

liabilities

torelieve8

relationship as described by this chapter.
whetherapersonimposedisonacontroller or processor by virtue of its role in the processing

of

the

construed

7

determination

from

be

controller(e)AAA

processor

not

6

9

a

sectionacting

the

as

a

10

controller or processor with respect to a specific processing of

11data is a fact-based determination that depends on the context in

12which personal data is to be processed.

13

to adhere to a controller ’s instructions with respect to a specific14

processing of personal data remains in the role of a processor.
Sec.A541.105.AADATA

15

PROTECTION

A processor that continues

ASSESSMENTS.

(a)

A

16

controller shall conduct and document a data protection assessment

17of each of the following processing activities involving personal

18

data:
(1)AAthe processing of personal data for purposes of

19
20

targeted advertising;

21(2)AAthe sale of personal data;

22(3)AAthe processing of personal data for purposes of23

profiling, if the profiling presents a reasonably foreseeable risk

24

of:

25
26
27

(A)AAunfair or deceptive treatment of or unlawful
disparate impact on consumers;(B)AAfinancial, physical, or reputational injury

25

H.B.ANo.A4
1

to consumers;

2(C)AAa physical or other intrusion on the solitude

3

or seclusion, or the private affairs or concerns, of consumers, if

4

the intrusion would be offensive to a reasonable person; or(D)AAother substantial injury to consumers;

56(4)AAthe processing of sensitive data; and7(5)AAany processing activities involving personal data

8910that present a heightened risk of harm to consumers.
(b)AAA data protection assessment conducted under Subsection(a) must:

11(1)AAidentify and weigh the direct or indirect benefits

12that may flow from the processing to the controller, the consumer,

13

other stakeholders, and the public, against the potential risks to

14

the rights of the consumer associated with that processing, as

15

mitigated by safeguards that can be employed by the controller to16

reduce the risks; and(2)AAfactor into the assessment:

1718(A)AAthe use of deidentified data;

19(B)AAthe reasonable expectations of consumers;

20(C)AAthe context of the processing; and21(D)AAthe relationship between the controller and2223

the consumer whose personal data will be processed.
(c)AAA controller shall make a data protection assessment

24

requested

25

general pursuant to a civil investigative demand under Section

26

541.153.

27

under

Section541.153(b)available

totheattorney(d)AAA data protection assessment is confidential and exempt

26

H.B.ANo.A4
1

from public inspection and copying under Chapter 552, Government2

Code. Disclosure of a data protection assessment in compliance with3

a request from the attorney general does not constitute a waiver of4

attorney-client privilege or work product protection with respect

5

to the assessment and any information contained in the assessment.
(e)AAA

6
7

comparable

8

activities.

single

set

of

data

protection

processing

assessment

operations

that

may

address

includeasimilar9(f)AAA data protection assessment conducted by a controller

10

for the purpose of compliance with other laws or regulations may

11constitute compliance with the requirements of this section if the12assessment has a reasonably comparable scope and effect.
Sec.A541.106.AADEIDENTIFIED OR PSEUDONYMOUS DATA.

1314(1)AAtake reasonable measures to ensure that the datacannot be associated with an individual;(3)AAcontractually(b)AAThis

chaptermay

22

controller or processor to:23(1)AAreidentify

25

maintaining

and

using

obligateany

recipientofthedeidentified data to comply with the provisions of this chapter.

21

24

to

deidentified data without attempting to reidentify the data; and1920commit(2)AApublicly

17
18

A

controller in possession of deidentified data shall:

15
16

(a)

not

be

construed

deidentified

data

to

or

requireapseudonymous

data;(2)AAmaintain

data

in

identifiable

form

or

obtain,26

retain, or access any data or technology for the purpose of allowing

27

the controller or processor to associate a consumer request with27

H.B.ANo.A4
1

personal data; or

3

with

(3)AAcomply

2

anauthenticatedconsumerrightsrequest under Section 541.051, if the controller:(A)AAis not reasonably capable of associating the45

requestwiththepersonal

data

or

it

would

be

unreasonably

6burdensome for the controller to associate the request with the7personal data;

8(B)AAdoes not use the personal data to recognize

9or respond to the specific consumer who is the subject of the10

personal data or associate the personal data with other personal

11

data about the same specific consumer; and12(C)AAdoes not sell the personal data to any third

13

party or otherwise voluntarily disclose the personal data to any

14third party other than a processor, except as otherwise permitted

15

by this section.
(c)AAThe consumer rights under Sections 541.051(b)(1)-(4)

16
17

and

18

pseudonymous

19

demonstrate any information necessary to identify the consumer is

20

kept

21

organizational controls that prevent the controller from accessing22

the information.

23

controller

dutiesdata

separately(d)AAA

in

and

under

cases

is

controllerinSectionwhich

subject

that541.101
the

to

do

controller

effective

discloses

not
is

apply

to

able

to

technical

pseudonymous

data

and

or

24

deidentified data shall exercise reasonable oversight to monitor

25

compliance26

pseudonymous data or deidentified data is subject and shall take27

appropriate

with

steps

any

to

contractual

addressany

28

commitments

breach

of

to

the

which

the

contractual

H.B.ANo.A4
12

commitments.
Sec.A541.107.AAREQUIREMENTS FOR SMALL BUSINESSES.

(a)

A

3

person described by Section 541.002(a)(3) may not engage in the4sale of personal data that is sensitive data without receiving

5prior consent from the consumer.

67(b)AAA person who violates this section is subject to thepenalty under Section 541.155.

8

SUBCHAPTER D.

9

Sec.A541.151.AAENFORCEMENT

1011ENFORCEMENTAUTHORITY

EXCLUSIVE.

The

attorney general has exclusive authority to enforce this chapter.
Sec.A541.152.AAINTERNETWEBSITEANDCOMPLAINTMECHANISM.

12

The attorney general shall post on the attorney general ’s Internet

13

website:(1)AAinformation relating to:

14(A)AAthe responsibilities of a controller under

15
16

Subchapters B and C;(B)AAthe17
18

aprocessor

under(C)AAa consumer ’s rights under Subchapter B; and(2)AAan online mechanism through which a consumer may

20

22

of

Subchapter C; and19

21

responsibilities

submit a complaint under this chapter to the attorney general.
Sec.A541.153.AAINVESTIGATIVEAUTHORITY.

(a)

If

the

23

attorney general has reasonable cause to believe that a person has

24

engaged in or is engaging in a violation of this chapter, the25

attorney

26

procedures established for the issuance of a civil investigative

27

demand under Section 15.10 apply to the same extent and manner togeneral

may

issue

a

civil

29

investigative

demand.

The

H.B.ANo.A4
1

the issuance of a civil investigative demand under this section.

2(b)AAThe attorney general may request, pursuant to a civil3

investigative demand issued under Subsection (a), that a controller

4

disclose any data protection assessment that is relevant to an

5

investigation conducted by the attorney general.

6general may evaluate the data protection assessment for compliance7with the requirements set forth in Sections 541.101, 541.102, and

8541.103.

9

The attorney

Sec.A541.154.AANOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY

10

TO CURE.

11

attorney general shall notify a person in writing, not later than12

the 30th day before bringing the action, identifying the specific13

provisions of this chapter the attorney general alleges have been

14

or are being violated.

15

against the person if:

identified violation; and(2)AAthe person provides the attorney general a written

18
19

The attorney general may not bring an action(1)AAwithin the 30-day period, the person cures the16
17

Before bringing an action under Section 541.155,Athestatement that the person:

20(A)AAcured the alleged violation;

21(B)AAnotified

information has been made available to the person;

27(C)AAprovided

if

the

supportivetheconsumer ’s

consumer ’s

23

26

addressed,that

privacy25

wasconsumer

22

24

violationthedocumentation

contacttoshow

how the privacy violation was cured; and(D)AAmadechangestointernal

policies,

necessary, to ensure that no such further violations will occur.

30

ifH.B.ANo.A4
Sec.A541.155.AACIVIL PENALTY; INJUNCTION.

1chapterfollowing

the

cure

periodA person who

2violates

3

Section 541.154 or who breaches a written statement provided to the4attorney general under that section is liable for a civil penalty in5an amount not to exceed $7,500 for each violation.

described

by(b)AAThe attorney general may bring an action in the name of

6
7

this

(a)

this state to:8(1)AArecover a civil penalty under this section;

9(2)AArestrain or enjoin the person from violating this10

chapter; or(3)AArecover

11
12

the

civil

penaltyandseek

injunctive

relief.

13(c)AAThe attorney general may recover reasonable attorney ’s

14fees and other reasonable expenses incurred in investigating and15

bringing an action under this section.
(d)AAThe

16

attorneygeneralshall

depositacivil

penalty17

collected under this section in accordance with Section 402.007,

18

Government Code.
Sec.A541.156.AANO PRIVATE RIGHT OF ACTION.

19

This chapter may

20

not be construed as providing a basis for, or being subject to, a21

private right of action for a violation of this chapter or any other

22

law.

23

SUBCHAPTER E.

CONSTRUCTION OF CHAPTER; EXEMPTIONS FOR CERTAIN USES24

OF CONSUMER PERSONAL DATA

25

Sec.A541.201.AACONSTRUCTION OF CHAPTER.

(a)This chapter

26

may not be construed to restrict a controller ’s or processor ’s

27

ability to:31

H.B.ANo.A4(1)AAcomply with federal, state, or local laws, rules,

1
2

or regulations;(2)AAcomply

3

with

a

civil,

criminal,orregulatory4

inquiry, investigation, subpoena, or summons by federal, state,

5

local, or other governmental authorities;(3)AAinvestigate, establish, exercise, prepare for, or6
7

defend legal claims;(4)AAprovide

8aproductorservicespecifically9requested by a consumer or the parent or guardian of a child,10

perform a contract to which the consumer is a party, including

11

fulfilling the terms of a written warranty, or take steps at the12request of the consumer before entering into a contract;13(5)AAtake immediate steps to protect an interest that14

is essential for the life or physical safety of the consumer or of

15

another individual and in which the processing cannot be manifestly

16

based on another legal basis;

17(6)AAprevent, detect, protect against, or respond to18

security incidents, identity theft, fraud, harassment, malicious

19

or deceptive activities, or any illegal activity;

20(7)AApreserve the integrity or security of systems or21

investigate, report, or prosecute those responsible for breaches of22system security;

23(8)AAengage in public or peer-reviewed scientific or

24

statistical research in the public interest that adheres to all

25

other

26

monitored, and governed by an institutional review board or similar

27

independent oversight entity that determines:

applicableethicsandprivacy

32

laws

and

is

approved,

H.B.ANo.A4
1(A)AAif the deletion of the information is likely

2

to provide substantial benefits that do not exclusively accrue to3

the controller;(B)AAwhether the expected benefits of the research

45

outweigh the privacy risks; and(C)AAif the controller has implemented reasonable6
7

safeguards

8

including any risks associated with reidentification; or11

mitigate(9)AAassist

9
10

to

privacyrisks

another

associatedcontroller,withresearch,

processor,

or

third

party with any of the requirements under this subsection.
(b)AAThis

chapter

may

not

be

construed

topreventa12

controller or processor from providing personal data concerning a

13

consumer to a person covered by an evidentiary privilege under the14laws of this state as part of a privileged communication.

15(c)AAThis

chapter

may

not

be

construed

as

imposinga16

requirement on controllers and processors that adversely affects

17

the rights or freedoms of any person, including the right of free18

speech.

19(d)AAThis

chapter

may

not

be

construedasrequiringa20

controller, processor, third party, or consumer to disclose a trade

21

secret.

22

Sec.A541.202.AACOLLECTION,OR

RETENTION

OF

DATA

FOR

23

CERTAIN PURPOSES.

24

processors under this chapter may not restrict a controller ’s or

25

processor ’s ability to collect, use, or retain data to:

26
27

(a)

USE,

The requirements imposed on controllers and(1)AAconduct internal research to develop, improve, or
repair products, services, or technology;33

H.B.ANo.A4
1(2)AAeffect a product recall;

2(3)AAidentify and repair technical errors that impair

3

existing or intended functionality; or(4)AAperform internal operations that:

4(A)AAare reasonably aligned with the expectations

5
6of the consumer;(B)AAare7
8

reasonably

anticipated

based

on

the

consumer ’s existing relationship with the controller; orotherwise(C)AAare9infurtheranceofcompatible

10

data

11

specifically12

contract to which the consumer is a party.

requested

theprovision

of

a

by

consumer

or

the

a

with

product

processingorserviceperformance

of

a

13

(b)AAA requirement imposed on a controller or processor under

14

this chapter does not apply if compliance with the requirement by

15

the

16

evidentiary privilege under the laws of this state.

controller

orprocessor,

asapplicable,

would

violatean

Sec.A541.203.AADISCLOSURE OF PERSONAL DATA TO THIRD-PARTY

17
18

CONTROLLER

19

discloses personal data to a third-party controller or processor,

20

in

21

violate this chapter if the third-party controller or processor

22

that receives and processes that personal data is in violation of

23

this chapter, provided that, at the time of the data ’s disclosure,

24

the

25

knowledge that the recipient intended to commit a violation.

26
27

OR

compliance

PROCESSOR.

withdisclosing(b)AAA

the

(a)

A

controller

requirements

controller

third-party

or

of

this

processor

controller

or

did

or

processor

chapter,

not

does

have

processor

that

not

actualreceiving

personal data from a controller or processor in compliance with the34

H.B.ANo.A4
1

requirements of this chapter does not violate this chapter for the2transgressions

3

third-party controller or processor receives the personal data.

4

of

the

controller

Sec.A541.204.AAPROCESSINGorOF

CERTAIN

from

which

PERSONAL

the

DATA

BY

5

CONTROLLER OR OTHER PERSON.

6

controller

7

purpose8otherwise allowed by this chapter. Personal data processed by a9controller under this subchapter may be processed to the extent

10

under

other

this

than

a

(a)

processor

subchapter
purposePersonal data processed by amaylistedinbeprocessed

for

this

subchapter

anyunlessthat the processing of the data is:

11(1)AAreasonably

12

purposes listed in this subchapter; and

13(2)AAadequate,

relevant,

in

the

14

necessary

15

subchapter.

16

not

relation(b)AAPersonal

to

data

necessary

andproportionate

andlimitedspecificcollected,

purposes

used,

or

to

the

to

what

is

listedinretained

this

under

17

Section 541.202(a) must, where applicable, take into account the18

nature and purpose of such collection, use, or retention.

19

personal data described by this subsection is subject to reasonable20

administrative, technical, and physical measures to protect the21

confidentiality, integrity, and accessibility of the personal data

22

and to reduce reasonably foreseeable risks of harm to consumers

23

relating to the collection, use, or retention of personal data.

24(c)AAA

controller

thatprocesses

personal

data

under

The

an

25

exemption in this subchapter bears the burden of demonstrating that26

the processing of the personal data qualifies for the exemption and27complies with the requirements of Subsections (a) and (b).

35

H.B.ANo.A4
1(d)AAThe processing of personal data by an entity for the2

purposes described by Section 541.201 does not solely make the3entity a controller with respect to the processing of the data.

4

Sec.A541.205.AALOCAL PREEMPTION.

This chapter supersedes5and preempts any ordinance, resolution, rule, or other regulation

6

adopted by a political subdivision regarding the processing of

7

personal data by a controller or processor.

8
9

SECTIONA3.AA(a)The Department of Information Resources,

under the management of the chief privacy officer, shall review the10

implementation

of

the

requirements

11

Commerce Code, as added by this Act.

of

Chapter

541,

Business&

12(b)AANot later than September 1, 2024, the Department of

13

Information Resources shall create an online portal available on14

the department ’s Internet website for members of the public to15

provide feedback and recommend changes to Chapter 541, Business &16

Commerce Code, as added by this Act.

17

open for receiving feedback from the public for at least 90 days.

18(c)AANot

later

than

January

The online portal must remain

1,

2025,

the

Department

of

19

Information Resources shall make available to the public a report20

detailing the status of the implementation of the requirements of

21

Chapter 541, Business & Commerce Code, as added by this Act, and any

22

recommendations to the legislature regarding changes to that law.

23(d)AAThis section expires September 1, 2025.

24

SECTIONA4.AAData

protection

assessments

required

to

be

25

conducted under Section 541.105, Business & Commerce Code, as added

26by this Act, apply only to processing activities generated after27

the effective date of this Act and are not retroactive.

36

H.B.ANo.A4
1

SECTIONA5.AANot later than July 1, 2024, the attorney general

2

shall post the information and online mechanism required by Section

3

541.152, Business & Commerce Code, as added by this Act.

4

SECTIONA6.AAThe provisions of this Act are hereby declared

5

severable, and if any provision of this Act or the application of

6such provision to any person or circumstance is declared invalid

7

for any reason, such declaration shall not affect the validity of8

the remaining portions of this Act.

9
10
11
12

SECTIONA7.AA(a)Except as provided by Subsection (b) of thissection, this Act takes effect July 1, 2024.
(b)AASection 541.055(e), Business & Commerce Code, as addedby this Act, takes effect January 1, 2025.

37

H.B.ANo.A4____________________________________________________________

AAPresident of the Senate

Speaker of the HouseAAAAAA

I certify that H.B. No. 4 was passed by the House on April 5,
2023, by the following vote:AAYeas 146, Nays 0, 1 present, notvoting; that the House refused to concur in Senate amendments to
H.B. No. 4 on May 15, 2023, and requested the appointment of aconference committee to consider the differences between the twohouses; and that the House adopted the conference committee reporton H.B. No. 4 on May 28, 2023, by the following vote:AAYeas 144,
Nays 0, 1 present, not voting.

______________________________
Chief Clerk of the HouseAAA

38

H.B.ANo.A4
I certify that H.B. No. 4 was passed by the Senate, with
amendments, on May 10, 2023, by the following vote:AAYeas 30, Nays0; at the request of the House, the Senate appointed a conference
committee to consider the differences between the two houses; andthat the Senate adopted the conference committee report on H.B. No.
4 on May 27, 2023, by the following vote:AAYeas 31, Nays 0.

______________________________
Secretary of the SenateAAA

APPROVED: __________________AAAAAAAAAAAAAAAAADateAAAAAAA

AAAAAAAAA __________________AAAAAAAAAAAAAAAGovernorAAAAAAA

39