reglab/statecodes huggingface dataset:
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.005. Registration

Sec. 509.005.  REGISTRATION.  (a)  To conduct business in this state, a data broker to which this chapter applies shall register with the secretary of state by filing a registration statement and paying a registration fee of $300.
(b)  The registration statement must include:
(1)  the legal name of the data broker;
(2)  a contact person and the primary physical address, e-mail address, telephone number, and Internet website address for the data broker;
(3)  a description of the categories of data the data broker processes and transfers;
(4)  a statement of whether or not the data broker implements a purchaser credentialing process;
(5)  if the data broker has actual knowledge that the data broker possesses personal data of a known child:
(A)  a statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the personal data of a known child; and
(B)  a statement on how the data broker complies with applicable federal and state law regarding the collection, use, or disclosure of personal data from and about a child on the Internet; and
(6)  the number of security breaches the data broker has experienced during the year immediately preceding the year in which the registration is filed, and if known, the total number of consumers affected by each breach.
(c)  A registration of a data broker may include any additional information or explanation the data broker chooses to provide to the secretary of state concerning the data broker's data collection practices.
(d)  A registration certificate expires on the first anniversary of its date of issuance.  A data broker may renew a registration certificate by filing a renewal application, in the form prescribed by the secretary of state, and paying a renewal fee in the amount of $300.
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.006. Registry of Data Brokers

Sec. 509.006.  REGISTRY OF DATA BROKERS.  (a)  The secretary of state shall establish and maintain, on its Internet website, a searchable, central registry of data brokers registered under Section 509.005.
(b)  The registry must include:
(1)  a search feature that allows a person searching the registry to identify a specific data broker; and
(2)  for each data broker, the information filed under Section 509.005(b).
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.008. Civil Penalty

Sec. 509.008.  CIVIL PENALTY.  (a)  A data broker that violates Section 509.004 or 509.005 is liable to this state for a civil penalty as prescribed by this section.
(b)  A civil penalty imposed against a data broker under this section:
(1)  subject to Subdivision (2), may not be in an amount less than the total of:
(A)  $100 for each day the entity is in violation of Section 509.004 or 509.005; and
(B)  the amount of unpaid registration fees for each year the entity failed to register in violation of Section 509.005; and
(2)  may not exceed $10,000 assessed against the same data broker in a 12-month period.
(c)  The attorney general may bring an action to recover a civil penalty imposed under this section.  The attorney general may recover reasonable attorney's fees and court costs incurred in bringing the action.
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.009. Deceptive Trade Practice

Sec. 509.009.  DECEPTIVE TRADE PRACTICE.  A violation of Section 509.007 by a data broker constitutes a deceptive trade practice in addition to the practices described by Subchapter E, Chapter 17, and is actionable under that subchapter.
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.010. Rules

Sec. 509.010.  RULES.  The secretary of state shall adopt rules as necessary to implement this chapter.
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter A. General Provisions › Section 509.001. Definitions

Text of section effective on September 01, 2024
Sec. 509.001.  DEFINITIONS.  In this chapter:
(1)  "Digital service" means a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity.
(2)  "Digital service provider" means a person who:
(A)  owns or operates a digital service;
(B)  determines the purpose of collecting and processing the personal identifying information of users of the digital service; and
(C)  determines the means used to collect and process the personal identifying information of users of the digital service.
(3)  "Harmful material" has the meaning assigned by Section 43.24, Penal Code.
(4)  "Known minor" means a person that a digital service provider knows to be a minor.
(5)  "Minor" means a child who is younger than 18 years of age who has not had the disabilities of minority removed for general purposes.
(6)  "Personal identifying information" means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. The term does not include deidentified information or publicly available information.
(7)  "Verified parent" means the parent or guardian of a known minor whose identity and relationship to the minor have been verified by a digital service provider under Section 509.101.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.051. Digital Service Provider Duty to Register Age of User

Text of section effective on September 01, 2024
Sec. 509.051.  DIGITAL SERVICE PROVIDER DUTY TO REGISTER AGE OF USER.  (a) A digital service provider may not enter into an agreement with a person to create an account with a digital service unless the person has registered the person's age with the digital service provider.
(b)  A person who registers the person's age as younger than 18 years of age is considered to be a known minor to the digital service provider until after the person's 18th birthday.
(c)  A digital service provider may not allow a person who registers the person's age to alter the person's registered age, unless the alteration process involves a commercially reasonable review process.
(d)  A minor is considered to be a known minor to a digital service provider if:
(1)  the minor registers the minor's age under Section 509.051 as younger than 18 years of age; or
(2)  the minor's parent or guardian, including a verified parent:
(A)  notifies a digital service provider that the minor is younger than 18 years of age;
(B)  successfully disputes the registered age of the minor; or
(C)  performs another function of a parent or guardian under this chapter.
(e)  If a minor is a known minor, or if the minor's parent or guardian, including a verified parent, takes an action under Subsection (a), a digital service provider:
(1)  is considered to have actual knowledge that the minor is younger than 18 years of age; and
(2)  shall treat the minor as a known minor under this chapter.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.052. Digital Service Provider Duties Relating to Agreement With Minor

Text of section effective on September 01, 2024
Sec. 509.052.  DIGITAL SERVICE PROVIDER DUTIES RELATING TO AGREEMENT WITH MINOR.  Unless a verified parent provides otherwise under Section 509.102, a digital service provider that enters into an agreement with a known minor for access to a digital service:
(1)  shall:
(A)  limit collection of the known minor's personal identifying information to information reasonably necessary to provide the digital service; and
(B)  limit use of the known minor's personal identifying information to the purpose for which the information was collected; and
(2)  may not:
(A)  allow the known minor to make purchases or engage in other financial transactions through the digital service;
(B)  share, disclose, or sell the known minor's personal identifying information;
(C)  use the digital service to collect the known minor's precise geolocation data; or
(D)  use the digital service to display targeted advertising to the known minor.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.053. Digital Service Provider Duty to Prevent Harm to Known Minors

Text of section effective on September 01, 2024
Sec. 509.053.  DIGITAL SERVICE PROVIDER DUTY TO PREVENT HARM TO KNOWN MINORS.  (a) In relation to a known minor's use of a digital service, a digital service provider shall develop and implement a strategy to prevent the known minor's exposure to harmful material and other content that promotes, glorifies, or facilitates:
(1)  suicide, self-harm, or eating disorders;
(2)  substance abuse;
(3)  stalking, bullying, or harassment; or
(4)  grooming, trafficking, child pornography, or other sexual exploitation or abuse.
(b)  A strategy developed under Subsection (a):
(1)  must include:
(A)  creating and maintaining a comprehensive list of harmful material or other content described by Subsection (a) to block from display to a known minor;
(B)  using filtering technology and other protocols to enforce the blocking of material or content on the list under Paragraph (A);
(C)  using hash-sharing technology and other protocols to identify recurring harmful material or other content described by Subsection (a);
(D)  creating and maintaining a database of keywords used for filter evasion, such as identifiable misspellings, hash-tags, or identifiable homoglyphs;
(E)  performing standard human-performed monitoring reviews to ensure efficacy of filtering technology;
(F)  making available to users a comprehensive description of the categories of harmful material or other content described by Subsection (a) that will be filtered; and
(G)  except as provided by Section 509.058, making available the digital service provider's algorithm code to independent security researchers; and
(2)  may include:
(A)  engaging a third party to rigorously review the digital service provider's content filtering technology;
(B)  participating in industry-specific partnerships to share best practices in preventing access to harmful material or other content described by Subsection (a); or
(C)  conducting periodic independent audits to ensure:
(i)  continued compliance with the digital service provider's strategy; and
(ii)  efficacy of filtering technology and protocols used by the digital service provider.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.054. Digital Service Provider Duty to Create Parental Tools

Text of section effective on September 01, 2024
Sec. 509.054.  DIGITAL SERVICE PROVIDER DUTY TO CREATE PARENTAL TOOLS.  (a) A digital service provider shall create and provide to a verified parent parental tools to allow the verified parent to supervise the verified parent's known minor's use of a digital service.
(b)  Parental tools under this section must allow a verified parent to:
(1)  control the known minor's privacy and account settings;
(2)  alter the duties of a digital service provider under Section 509.052 with regard to the verified parent's known minor;
(3)  if the verified parent alters the duty of a digital service provider under Section 509.052(2)(A), restrict the ability of the verified parent's known minor to make purchases or engage in financial transactions; and
(4)  monitor and limit the amount of time the verified parent's known minor spends using the digital service.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.055. Digital Service Provider Duties Regarding Advertising and Marketing

Text of section effective on September 01, 2024
Sec. 509.055.  DIGITAL SERVICE PROVIDER DUTIES REGARDING ADVERTISING AND MARKETING.  A digital service provider shall make a commercially reasonable effort to prevent advertisers on the digital service provider's digital service from targeting a known minor with advertisements that facilitate, promote, or offer a product, service, or activity that is unlawful for a minor in this state to use or engage in.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.056. Use of Algorithms

Text of section effective on September 01, 2024
Sec. 509.056.  USE OF ALGORITHMS.  A digital service provider that uses algorithms to automate the suggestion, promotion, or ranking of information to known minors on the digital service shall:
(1)  make a commercially reasonable effort to ensure that the algorithm does not interfere with the digital service provider's duties under Section 509.053; and
(2)  disclose in the digital service provider's terms of service, privacy policy, or similar document, in a clear and accessible manner, an overview of:
(A)  the manner in which the digital service uses algorithms to provide information or content;
(B)  the manner in which algorithms promote, rank, or filter information or content; and
(C)  the personal identifying information used as inputs to provide information or content.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.057. Digital Service Provider Duty as to Harmful Material

Text of section effective on September 01, 2024
Sec. 509.057.  DIGITAL SERVICE PROVIDER DUTY AS TO HARMFUL MATERIAL.  (a) A digital service provider as defined by Section 509.001 that knowingly publishes or distributes material, more than one-third of which is harmful material or obscene as defined by Section 43.21, Penal Code, must use a commercially reasonable age verification method to verify that any person seeking to access content on or through the provider's digital service is 18 years of age or older.
(b)  If a person seeking to access content on or through the digital service of a provider for which age verification is required under this section is not 18 years of age or older, the digital service provider may not enter into an agreement with the person for access to the digital service.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.058. Protection of Trade Secrets

Text of section effective on September 01, 2024
Sec. 509.058.  PROTECTION OF TRADE SECRETS.  Nothing in this subchapter may be construed to require a digital service provider to disclose a trade secret.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter B. Digital Service Provider Duties and Prohibitions › Section 509.059. Use of Known Minor's Personal Identifying Information for Certain Purposes

Text of section effective on September 01, 2024
Sec. 509.059.  USE OF KNOWN MINOR'S PERSONAL IDENTIFYING INFORMATION FOR CERTAIN PURPOSES. Nothing in this subchapter may be construed to prevent a digital service provider from collecting, processing, or sharing a known minor's personal identifying information in a manner necessary to:
(1)  comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a governmental entity;
(2)  comply with a law enforcement investigation;
(3)  detect, block, or prevent the distribution of unlawful, obscene, or other harmful material to a known minor;
(4)  block or filter spam;
(5)  prevent criminal activity; or
(6)  protect the security of a digital service.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter C. Verified Parents › Section 509.101. Verification of Parent or Guardian

Text of section effective on September 01, 2024
Sec. 509.101.  VERIFICATION OF PARENT OR GUARDIAN.  (a) A digital service provider shall verify, using a commercially reasonable method and for each person seeking to perform an action on a digital service as a minor's parent or guardian:
(1)  the person's identity; and
(2)  the relationship of the person to the known minor.
(b)  A digital service provider shall provide a process by which a person who has been verified under Subsection (a) as the parent or guardian of a known minor may participate in the digital service as the known minor's verified parent as provided by this chapter.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter C. Verified Parents › Section 509.102. Powers of Verified Parent

Text of section effective on September 01, 2024
Sec. 509.102.  POWERS OF VERIFIED PARENT.  (a) A verified parent is entitled to alter the duties of a digital service provider under Section 509.052 with regard to the verified parent's known minor.
(b)  A verified parent is entitled to supervise the verified parent's known minor's use of a digital service using tools provided by a digital service provider under Section 509.054.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter C. Verified Parents › Section 509.103. Access to Known Minor's Personal Identifying Information

Text of section effective on September 01, 2024
Sec. 509.103.  ACCESS TO KNOWN MINOR'S PERSONAL IDENTIFYING INFORMATION. (a) A known minor's verified parent may submit a request to a digital service provider to:
(1)  review and download any personal identifying information associated with the minor in the possession of the digital service provider; and
(2)  delete any personal identifying information associated with the minor collected or processed by the digital service provider.
(b)  A digital service provider shall establish and make available on the digital service provider's digital service a method by which a known minor's parent or guardian may make a request for access under this section.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter C. Verified Parents › Section 509.104. Minor in Conservatorship of Department of Family and Protective Services

Text of section effective on September 01, 2024
Sec. 509.104.  MINOR IN CONSERVATORSHIP OF DEPARTMENT OF FAMILY AND PROTECTIVE SERVICES.  If a minor is in the conservatorship of the Department of Family and Protective Services, the department may designate the minor's caregiver or a member of the department's staff to perform the functions of the minor's parent or guardian under this chapter.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter D. Enforcement › Section 509.151. Deceptive Trade Practice; Enforcement by Attorney General

Text of section effective on September 01, 2024
Sec. 509.151.  DECEPTIVE TRADE PRACTICE; ENFORCEMENT BY ATTORNEY GENERAL. A violation of this chapter is a deceptive act or practice actionable under Subchapter E, Chapter 17, solely as an enforcement action by the consumer protection division of the attorney general's office.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Use of Digital Services by Minors › Subchapter D. Enforcement › Section 509.152. Private Cause of Action

Text of section effective on September 01, 2024
Sec. 509.152.  PRIVATE CAUSE OF ACTION.  (a) Except as provided by Subsection (b), this chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter.
(b)  If a digital service provider violates this chapter, the parent or guardian of a known minor affected by that violation may bring a cause of action seeking:
(1)  a declaratory judgment under Chapter 37, Civil Practice and Remedies Code; or
(2)  an injunction against the digital service provider.
(c)  A court may not certify an action brought under this section as a class action.
Added by Acts 2023, 88th Leg., R.S., Ch. 795 (H.B. 18), Sec. 2.01, eff. September 1, 2024.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter A. General Provisions › Section 521.001. Short Title

Sec. 521.001.  SHORT TITLE.  This chapter may be cited as the Identity Theft Enforcement and Protection Act.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter A. General Provisions › Section 521.002. Definitions

Sec. 521.002.  DEFINITIONS.  (a)  In this chapter:
(1)  "Personal identifying information" means information that alone or in conjunction with other information identifies an individual, including an individual's:
(A)  name, social security number, date of birth, or government-issued identification number;
(B)  mother's maiden name;
(C)  unique biometric data, including the individual's fingerprint, voice print, and retina or iris image;
(D)  unique electronic identification number, address, or routing code; and
(E)  telecommunication access device as defined by Section 32.51, Penal Code.
(2)  "Sensitive personal information" means, subject to Subsection (b):
(A)  an individual's first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:
(i)  social security number;
(ii)  driver's license number or government-issued identification number; or
(iii)  account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account; or
(B)  information that identifies an individual and relates to:
(i)  the physical or mental health or condition of the individual;
(ii)  the provision of health care to the individual; or
(iii)  payment for the provision of health care to the individual.
(3)  "Victim" means a person whose identifying information is used by an unauthorized person.
(b)  For purposes of this chapter, the term "sensitive personal information" does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 419 (H.B. 2004), Sec. 1, eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter B. Identity Theft › Section 521.051. Unauthorized Use or Possession of Personal Identifying Information

Sec. 521.051.  UNAUTHORIZED USE OR POSSESSION OF PERSONAL IDENTIFYING INFORMATION.  (a)  A person may not obtain, possess, transfer, or use personal identifying information of another person without the other person's consent or effective consent and with intent to obtain a good, a service, insurance, an extension of credit, or any other thing of value in the other person's name.
(a-1)  For purposes of this section, "effective consent" includes consent given by a person legally authorized to act on behalf of the person from whom consent is required.  Consent is not effective if:
(1)  induced by force, threat, fraud, or coercion; or
(2)  given by a person who by reason of youth, mental illness, or intellectual disability is known by the actor to be unable to make reasonable decisions.
(b)  It is a defense to an action brought under this section that an act by a person:
(1)  is covered by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.); and
(2)  is in compliance with that Act and regulations adopted under that Act.
(c)  This section does not apply to:
(1)  a financial institution as defined by 15 U.S.C. Section 6809; or
(2)  a covered entity as defined by Section 601.001 or 602.001, Insurance Code.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2021, 87th Leg., R.S., Ch. 143 (H.B. 3529), Sec. 1, eff. September 1, 2021.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter B. Identity Theft › Section 521.052. Business Duty to Protect Sensitive Personal Information

Sec. 521.052.  BUSINESS DUTY TO PROTECT SENSITIVE PERSONAL INFORMATION.  (a)  A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business in the regular course of business.
(b)  A business shall destroy or arrange for the destruction of customer records containing sensitive personal information within the business's custody or control that are not to be retained by the business by:
(1)  shredding;
(2)  erasing; or
(3)  otherwise modifying the sensitive personal information in the records to make the information unreadable or indecipherable through any means.
(c)  This section does not apply to a financial institution as defined by 15 U.S.C. Section 6809.
(d)  As used in this section, "business" includes a nonprofit athletic or sports association.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 419 (H.B. 2004), Sec. 2, eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter C. Court Order Declaring Individual › Section 521.101. Application for Court Order to Declare Individual a Victim of Identity Theft

Sec. 521.101.  APPLICATION FOR COURT ORDER TO DECLARE INDIVIDUAL A VICTIM OF IDENTITY THEFT.  (a)  A person who is injured by a violation of Section 521.051 or who has filed a criminal complaint alleging commission of an offense under Section 32.51, Penal Code, may file an application with a district court for the issuance of an order declaring that the person is a victim of identity theft.
(b)  A person may file an application under this section regardless of whether the person is able to identify each person who allegedly transferred or used the person's identifying information in an unlawful manner.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter C. Court Order Declaring Individual › Section 521.102. Presumption of Applicant's Status as Victim

Sec. 521.102.  PRESUMPTION OF APPLICANT'S STATUS AS VICTIM.  An applicant under Section 521.101 is presumed to be a victim of identity theft under this subchapter if the person charged with an offense under Section 32.51, Penal Code, is convicted of the offense.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter C. Court Order Declaring Individual › Section 521.103. Issuance of Order; Contents

Sec. 521.103.  ISSUANCE OF ORDER; CONTENTS.  (a)  After notice and hearing, if the court is satisfied by a preponderance of the evidence that an applicant under Section 521.101 has been injured by a violation of Section 521.051 or is the victim of an offense under Section 32.51, Penal Code, the court shall enter an order declaring that the applicant is a victim of identity theft resulting from a violation of Section 521.051 or an offense under Section 32.51, Penal Code, as appropriate.
(b)  An order under this section must contain:
(1)  any known information identifying the violator or person charged with the offense;
(2)  the specific personal identifying information and any related document used to commit the alleged violation or offense; and
(3)  information identifying any financial account or transaction affected by the alleged violation or offense, including:
(A)  the name of the financial institution in which the account is established or of the merchant involved in the transaction, as appropriate;
(B)  any relevant account numbers;
(C)  the dollar amount of the account or transaction affected by the alleged violation or offense; and
(D)  the date of the alleged violation or offense.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter C. Court Order Declaring Individual › Section 521.104. Confidentiality of Order

Sec. 521.104.  CONFIDENTIALITY OF ORDER.  (a)  An order issued under Section 521.103 must be sealed because of the confidential nature of the information required to be included in the order.  The order may be opened and the order or a copy of the order may be released only:
(1)  to the proper officials in a civil proceeding brought by or against the victim arising or resulting from a violation of this chapter, including a proceeding to set aside a judgment obtained against the victim;
(2)  to the victim for the purpose of submitting the copy of the order to a governmental entity or private business to:
(A)  prove that a financial transaction or account of the victim was directly affected by a violation of this chapter or the commission of an offense under Section 32.51, Penal Code; or
(B)  correct any record of the entity or business that contains inaccurate or false information as a result of the violation or offense;
(3)  on order of the judge; or
(4)  as otherwise required or provided by law.
(b)  A copy of an order provided to a person under Subsection (a)(1) must remain sealed throughout and after the civil proceeding.
(c)  Information contained in a copy of an order provided to a governmental entity or business under Subsection (a)(2) is confidential and may not be released to another person except as otherwise required or provided by law.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter C. Court Order Declaring Individual › Section 521.105. Grounds for Vacating Order

Sec. 521.105.  GROUNDS FOR VACATING ORDER.  A court at any time may vacate an order issued under Section 521.103 if the court finds that the application filed under Section 521.101 or any information submitted to the court by the applicant contains a fraudulent misrepresentation or a material misrepresentation of fact.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter D. Remedies › Section 521.151. Civil Penalty; Injunction

Sec. 521.151.  CIVIL PENALTY; INJUNCTION.  (a)  A person who violates this chapter is liable to this state for a civil penalty of at least $2,000 but not more than $50,000 for each violation.  The attorney general may bring an action to recover the civil penalty imposed under this subsection.
(a-1)  In addition to penalties assessed under Subsection (a), a person who fails to take reasonable action to comply with Section 521.053(b) is liable to this state for a civil penalty of not more than $100 for each individual to whom notification is due under that subsection for each consecutive day that the person fails to take reasonable action to comply with that subsection.  Civil penalties under this section may not exceed $250,000 for all individuals to whom notification is due after a single breach.  The attorney general may bring an action to recover the civil penalties imposed under this subsection.
(b)  If it appears to the attorney general that a person is engaging in, has engaged in, or is about to engage in conduct that violates this chapter, the attorney general may bring an action in the name of the state against the person to restrain the violation by a temporary restraining order or by a permanent or temporary injunction.
(c)  An action brought under Subsection (b) must be filed in a district court in Travis County or:
(1)  in any county in which the violation occurred; or
(2)  in the county in which the victim resides, regardless of whether the alleged violator has resided, worked, or transacted business in the county in which the victim resides.
(d)  The attorney general is not required to give a bond in an action under this section.
(e)  In an action under this section, the court may grant any other equitable relief that the court considers appropriate to:
(1)  prevent any additional harm to a victim of identity theft or a further violation of this chapter; or
(2)  satisfy any judgment entered against the defendant, including issuing an order to appoint a receiver, sequester assets, correct a public or private record, or prevent the dissipation of a victim's assets.
(f)  The attorney general is entitled to recover reasonable expenses, including reasonable attorney's fees, court costs, and investigatory costs, incurred in obtaining injunctive relief or civil penalties, or both, under this section.  Amounts collected by the attorney general under this section shall be deposited in the general revenue fund and may be appropriated only for the investigation and prosecution of other cases under this chapter.
(g)  The fees associated with an action under this section are the same as in a civil case, but the fees may be assessed only against the defendant.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 15, eff. September 1, 2012.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 521 - Unauthorized Use of Identifying Information › Subchapter D. Remedies › Section 521.152. Deceptive Trade Practice

Sec. 521.152.  DECEPTIVE TRADE PRACTICE.  A violation of Section 521.051 is a deceptive trade practice actionable under Subchapter E, Chapter 17.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 522 - Identity Theft by Electronic Device › Section 522.001. Definitions

Sec. 522.001.  DEFINITIONS.  In this chapter:
(1)  "Payment card" means a credit card, debit card, check card, or other card that is issued to an authorized user to purchase or obtain goods, services, money, or any other thing of value.
(2)  "Re-encoder" means an electronic device that can be used to transfer encoded information from a magnetic strip on a payment card onto the magnetic strip of a different payment card.
(3)  "Scanning device" means an electronic device used to access, read, scan, or store information encoded on the magnetic strip of a payment card.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 522 - Identity Theft by Electronic Device › Section 522.002. Offense; Penalty

Sec. 522.002.  OFFENSE; PENALTY.  (a)  A person commits an offense if the person uses a scanning device or re-encoder to access, read, scan, store, or transfer information encoded on the magnetic strip of a payment card without the consent of an authorized user of the payment card and with intent to harm or defraud another.
(b)  An offense under this section is a Class B misdemeanor, except that the offense is a state jail felony if the information accessed, read, scanned, stored, or transferred was protected health information as defined by the Health Insurance Portability and Accountability Act and Privacy Standards, as defined by Section 181.001, Health and Safety Code.
(c)  If conduct that constitutes an offense under this section also constitutes an offense under any other law, the actor may be prosecuted under this section or the other law.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 16, eff. September 1, 2012.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 523 - Provisions Relating to Victims of Identity Theft › Subchapter A. Extensions of Credit and Verification › Section 523.001. Extension of Credit to Victim of Identity Theft

Sec. 523.001.  EXTENSION OF CREDIT TO VICTIM OF IDENTITY THEFT.  (a)  In this section, "victim of identity theft" means an individual who has filed a criminal complaint alleging the commission of an offense under Section 32.51, Penal Code, other than a person who is convicted of an offense under Section 37.08, Penal Code, with respect to that complaint.
(b)  A person who has been notified that an individual has been the victim of identity theft may not deny the individual an extension of credit, including a loan, in the individual's name or restrict or limit the credit extended solely because the individual has been a victim of identity theft.  This subsection does not prohibit a person from denying an individual an extension of credit for a reason other than the individual's having been a victim of identity theft, including by reason of the individual's lack of capacity to contract.
(c)  A license issued under Subtitle B, Title 4, Finance Code, that is held by a person who violates this section is subject to revocation or suspension under that subtitle.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 523 - Provisions Relating to Victims of Identity Theft › Subchapter A. Extensions of Credit and Verification › Section 523.002. Verification of Consumer Identity

Sec. 523.002.  VERIFICATION OF CONSUMER IDENTITY.  (a)  In this section:
(1)  "Consumer report" has the meaning assigned by Section 20.01.
(2)  "Extension of credit" does not include:
(A)  an increase in the dollar limit of an existing open-end credit plan as defined by federal Regulation Z (12 C.F.R. Section 226.2), as amended; or
(B)  any change to, or review of, an existing credit account.
(3)  "Security alert" has the meaning assigned by Section 20.01.
(b)  A person who receives notification of a security alert under Section 20.032 in connection with a request for a consumer report for the approval of a credit-based application, including an application for an extension of credit, a purchase, lease, or rental agreement for goods, or for an application for a noncredit-related service, may not lend money, extend credit, or authorize an application without taking reasonable steps to verify the consumer's identity.
(c)  If a consumer has included with a security alert a specified telephone number to be used for identity verification purposes, a person who receives that number with a security alert must take reasonable steps to contact the consumer using that number before lending money, extending credit, or completing any purchase, lease, or rental of goods, or approving any noncredit-related services.
(d)  If a person uses a consumer report to facilitate the extension of credit or for any other transaction on behalf of a subsidiary, affiliate, agent, assignee, or prospective assignee, that person, rather than the subsidiary, affiliate, agent, assignee, or prospective assignee, may verify the consumer's identity.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle B - Identity Theft › Chapter 523 - Provisions Relating to Victims of Identity Theft › Subchapter B. Duties of Financial Institutions And › Section 523.051. Notation of Forged Check

Sec. 523.051.  NOTATION OF FORGED CHECK.  (a)  In this section, "victim of identity theft" means a person who has filed with an appropriate law enforcement agency a criminal complaint alleging commission of an offense under Section 32.51, Penal Code.
(b)  A financial institution, in accordance with its customary procedures, shall process as forgeries checks received on the account of a victim of identity theft if the victim:
(1)  closes the account at the financial institution as a result of the identity theft;
(2)  notifies the financial institution that the identity theft is the reason for closing the account;
(3)  provides the financial institution with a copy of the criminal complaint described by Subsection (a); and
(4)  requests that the financial institution return checks with the notation "forgery."
(c)  A victim of identity theft who requests that a financial institution return checks with the notation "forgery" as provided by Subsection (b):
(1)  may not assert that the financial institution is liable under Section 4.402 for wrongfully dishonoring a check returned after the victim makes the request; and
(2)  shall hold the financial institution harmless for acting in accordance with the victim's request.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Redesignated from Business and Commerce Code, Section 523.003 by Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.011(b), eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle C - Consumer Data Protection › Chapter 541 - Consumer Data Protection › Subchapter A. General Provisions › Section 541.002. Applicability of Chapter

Text of section effective on July 01, 2024
Sec. 541.002.  APPLICABILITY OF CHAPTER.  (a)  This chapter applies only to a person that:
(1)  conducts business in this state or produces a product or service consumed by residents of this state;
(2)  processes or engages in the sale of personal data; and
(3)  is not a small business as defined by the United States Small Business Administration, except to the extent that Section 541.107 applies to a person described by this subdivision.
(b)  This chapter does not apply to:
(1)  a state agency or a political subdivision of this state;
(2)  a financial institution or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.);
(3)  a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.), and the Health Information Technology for Economic and Clinical Health Act (Division A, Title XIII, and Division B, Title IV, Pub. L. No. 111-5);
(4)  a nonprofit organization;
(5)  an institution of higher education; or
(6)  an electric utility, a power generation company, or a retail electric provider, as those terms are defined by Section 31.002, Utilities Code.
Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.