Source: http://www.jdsupra.com/legalnews/texass-amended-data-breach-notification-73593/
Timestamp: 2017-05-30 13:06:33
Document Index: 515610837

Matched Legal Cases: ['§ 521', '§ 521', '§ 521', '§ 521', '§ 521', '§ 521']

Texas's Amended Data Breach Notification Law Increases Complexity for Businesses | Jackson Walker - JDSupra
On September 1, 2012, Texas's amended data breach notification law passed in June 2011 will go into effect, and residents of all 50 states will potentially feel the effects. Under the amended law, Texas extends the reach of its data breach notification laws beyond Texas borders to all affected "individuals."
Under the current law, any entity that "conducts business" in Texas and maintains sensitive personal information on its computer network is required to notify any "Texas resident" whose personal information is, or is reasonably believed to have been acquired by an unauthorized user. The types of Texas businesses affected includes most businesses that maintain customer information, as well as virtually any health care-related business. Yet under the new amendment, any such entity conducting business in Texas must notify all affected "individuals" regardless of whether they call Texas home or not. Thus, any entity conducting business in Texas may be required to notify residents of all 50 states in the event of a data breach involving sensitive personal information. However, for affected out-of-state residents who live in states with their own notification requirements (all but four states have their own data breach notification laws), compliance with their own state law satisfies Texas requirements.
Download PDF August 20, 2012ResourcesJW CybersecurityPractice AreaContact JWwww.jw.comOfficesAustin100 Congress AvenueSuite 1100Austin, TX 78701Dallas901 Main StreetSuite 6000Dallas, TX 75202Fort Worth777 Main StreetSuite 2100Fort Worth, TX 76102Houston1401 McKinney StreetSuite 1900Houston, TX 77010San Angelo301 W. BeauregardAvenueSuite 200San Angelo, TX 76903San Antonio112 E. Pecan StreetSuite 2400San Antonio, TX 78205 Texas's Amended Data BreachNotification Law Increases Complexityfor BusinessesBy Anna Trimble and Bill CobbOn September 1, 2012, Texas's amended data breach notificationlaw passed in June 2011 will go into effect, and residents of all 50states will potentially feel the effects. Under the amended law, Texasextends the reach of its data breach notification laws beyond Texasborders to all affected "individuals."1 Under the current law, any entity that "conducts business" in Texasand maintains sensitive personal information on its computernetwork is required to notify any "Texas resident" whose personalinformation is, or is reasonably believed to have been acquired byan unauthorized user. The types of Texas businesses affectedincludes most businesses that maintain customer information, aswell as virtually any health care-related business. Yet under the newamendment, any such entity conducting business in Texas mustnotify all affected "individuals" regardless of whether they call Texashome or not. Thus, any entity conducting business in Texas may berequired to notify residents of all 50 states in the event of a databreach involving sensitive personal information. However, foraffected out-of-state residents who live in states with their ownnotification requirements (all but four states have their own databreach notification laws), compliance with their own state lawsatisfies Texas requirements.2"Sensitive personal information" is defined as an individual's firstname or first initial and last name in combination with theindividual's social security number; driver's license number orgovernment-issued identification number; or account number orcredit or debit card information in combination with a requiredsecurity code.3 The definition under the Texas statute also includesinformation regarding an individual's physical or mental healthinformation; the provision of health care to the individual; or thepayment for the provision of health care to the individual;4 thisinformation is referred to as "protected health information" or "PHI"in the health care industry, and is also subject to the privacy andsecurity restrictions of the federal privacy statute known asHIPAA. Texas entities subject to HIPAA will have to determinewhether they have breach reporting obligations under HIPAA, theTexas statute, or both, since the standards and requirements ofHIPAA and the Texas statute are different.The amendment also increases the penalties for a failure to notifyindividuals of a data breach from a maximum of $50,000 (under theold law) to $100 per individual per day of failed or delayednotification, not to exceed $250,000 for a single breach.5 Abusiness subject to this regulation is required to provide notice "asquickly as possible," with exceptions made for criminalinvestigations.6 However, business owners should keep in mind thatwritten proof of cooperation with law enforcement will be required tojustify such a delay.Cyber security is a timely topic. Studies have shown that in 2011,over 174 million records were reported breached.7 The average costto an organization resulting from a data breach incident is nowreported to be upwards of $6.65 million.8 Despite such figures,Congress has yet to enact a law requiring businesses to notifyconsumers when their personal information has beencompromised. Consumers are protected on a state level in 46 of the50 states as all but Alabama, Kentucky, New Mexico and SouthDakota have enacted breach notification statutes to address thisgrowing trend.Leaving aside the question of whether Congress's interstatecommerce power potentially preempts the extraterritorial nature ofthe Texas law, more practically, the statute does not elaborate onwhat it means to "conduct business" in Texas. Under a broadreading of the statute, a business headquartered in New Mexicoshipping products to consumers in Texas might be required to notifya customer in South Dakota of a data breach, where the personalinformation was stored in a data-farm in Indiana. There is also some question of how the broadly worded law mightapply to non-U.S. citizens living abroad whose information is storedon the servers of companies conducting business in Texas. Unlessthe legislature elaborates on what it means to "conduct business" inTexas, the matter will likely be examined and refined by the courtsthrough consequent litigation. This issue is likely to remain a potential liability for any entity thathas any business dealings in Texas. If you have any questionsregarding this e-Alert or how it may affect your business, pleasecontact Bill Cobb at 512.236.2326 or bcobb@jw.comor Stephanie Chandler at 210.978.7704 or schandler@jw.com orAnna Trimble at 512.236.2381 or atrimble@jw.com or JeffDrummond at 214.953.5781 or jdrummond@jw.com.1Tex Bus. & Comm. Code § 521.053(b) (effective September 1,2012). 2Id. 3Id. § 521.002(a)(2)(A). 4Id. § 521.002(a)(2)(B).5Id. § 521.151(a) (current law) and § 521.151(a-1) (effectiveSeptember 1, 2012).6Id. § 521.053(b).7Verizon Risk Team, 2012 Data Breach Investigation Report (2012)8Ponemon Institute, Fourth Annual U.S. Cost of Data Breach If you wish to be added to this e-Alert listing, please SIGN UPHERE. If you wish to follow the JW Technology group on Twitter,please CLICK HERE.AustinDallasFort WorthHoustonSan AngeloSan AntonioCybersecurity e-Alert is published by the law firm of Jackson Walker L.L.P. to inform readers ofrelevant information in cybersecurity law and related areas. It is not intended nor should it be usedas a substitute for legal advice or opinion which can be rendered only when related to specific factsituations. For more information, please call 1.866.922.5559 or visit us at www.jw.com.©2012 Jackson Walker L.L.P.Click here to unsubscribe your e-mail address901 Main Street, Suite 6000 | Dallas, Texas 75202