reglab/statecodes huggingface dataset:
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter A. Confidentiality of Social Security Numbers › Section 501.002. Certain Uses of Social Security Number Prohibited; Remedies

Sec. 501.002.  CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED; REMEDIES.  (a)  A person may not print an individual's social security number on a card or other device required to access a product or service provided by the person unless the individual has requested in writing that printing.  The person may not require a request for that printing as a condition of receipt of or access to a product or service provided by the person.
(b)  A person who violates this section is liable to this state for a civil penalty in an amount not to exceed $500 for each violation.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this section.
(c)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating this section.
(d)  This section does not apply to:
(1)  the collection, use, or release of a social security number required by state or federal law, including Chapter 552, Government Code; or
(2)  the use of a social security number for internal verification or administrative purposes.
(e)  This section applies to a card or other device issued in connection with an insurance policy only if the policy is delivered, issued for delivery, or renewed on or after March 1, 2005.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter B. Privacy Policy to Protect Social Security Numbers › Section 501.051. Inapplicability of Subchapter

Sec. 501.051.  INAPPLICABILITY OF SUBCHAPTER.  This subchapter does not apply to:
(1)  a person who is required to maintain and disseminate a privacy policy under:
(A)  the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6801 to 6809);
(B)  the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. Section 1232g); or
(C)  the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
(2)  a covered entity under rules adopted by the commissioner of insurance relating to insurance consumer health information privacy or insurance consumer financial information privacy;
(3)  a governmental body, as defined by Section 552.003, Government Code, other than a municipally owned utility;
(4)  a person with respect to a loan transaction, if the person is not engaged in the business of making loans; or
(5)  a person subject to Section 901.457, Occupations Code.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.009(a), eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter B. Privacy Policy to Protect Social Security Numbers › Section 501.052. Privacy Policy Necessary to Require Disclosure of Social Security Number

Sec. 501.052.  PRIVACY POLICY NECESSARY TO REQUIRE DISCLOSURE OF SOCIAL SECURITY NUMBER.  (a)  A person may not require an individual to disclose the individual's social security number to obtain goods or services from or enter into a business transaction with the person unless the person:
(1)  adopts a privacy policy as provided by Subsection (b);
(2)  makes the privacy policy available to the individual; and
(3)  maintains under the privacy policy the confidentiality and security of the social security number disclosed to the person.
(b)  A privacy policy adopted under this section must include:
(1)  how personal information is collected;
(2)  how and when the personal information is used;
(3)  how the personal information is protected;
(4)  who has access to the personal information; and
(5)  the method of disposal of the personal information.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter B. Privacy Policy to Protect Social Security Numbers › Section 501.053. Civil Penalty; Injunction

Sec. 501.053.  CIVIL PENALTY; INJUNCTION.  (a)  A person who violates Section 501.052(a) is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month during which a violation occurs.  The civil penalty may not be imposed for more than one violation that occurs in a month.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this section.
(b)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating Section 501.052(a).
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter C. Other Restrictions to Protect Driver's License and Social Security Numbers › Section 501.101. Use of Consumer Driver's License or Social Security Number by Merchant or Certain Third Party

Sec. 501.101.  USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY.  (a)  A merchant or a third party under contract with a merchant who requires a consumer returning merchandise to provide the consumer's driver's license or social security number may use the number or numbers provided by the consumer solely for identification purposes if the consumer does not have a valid receipt for the item being returned and is seeking a cash, credit, or store credit refund.
(b)  A merchant or a third party under contract with a merchant may not disclose a consumer's driver's license or social security number to any other third party, including a merchant, not involved in the initial transaction.
(c)  A merchant or a third party under contract with a merchant may use a consumer's driver's license or social security number only to monitor, investigate, or prosecute fraudulent return of merchandise.
(d)  A merchant or a third party under contract with a merchant shall destroy or arrange for the destruction of records containing the consumer's driver's license or social security number at the expiration of six months from the date of the last transaction.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter C. Other Restrictions to Protect Driver's License and Social Security Numbers › Section 501.1011. Sales Receipt Containing Driver's License Number Prohibited

Sec. 501.1011.  SALES RECEIPT CONTAINING DRIVER'S LICENSE NUMBER PROHIBITED.  A person may not print an individual's driver's license number on a receipt that evidences payment for a sale of goods or services and is provided to the individual.
Added by Acts 2009, 81st Leg., R.S., Ch. 90 (H.B. 523), Sec. 1, eff. January 1, 2010.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 501 - Protection of Driver's License and Social Security Numbers › Subchapter C. Other Restrictions to Protect Driver's License and Social Security Numbers › Section 501.102. Civil Penalty; Injunction

Sec. 501.102.  CIVIL PENALTY; INJUNCTION.  (a)  A person who violates Section 501.101 is liable to this state for a civil penalty in an amount not to exceed $500 for each violation.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this subsection.
(a-1)  A person who violates Section 501.1011 is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month in which a violation occurs.  The civil penalty may not be imposed for more than one violation that occurs in a month.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this subsection.
(b)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating this subchapter.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch. 90 (H.B. 523), Sec. 2, eff. January 1, 2010.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 502 - Protection of Identifying Financial Information › Section 502.001. Warning Sign About Identity Theft for Restaurant or Bar Employees

Sec. 502.001.  WARNING SIGN ABOUT IDENTITY THEFT FOR RESTAURANT OR BAR EMPLOYEES.  (a)  In this section:
(1)  "Credit card" means an identification card, plate, coupon, book, or number or any other device authorizing a designated person or bearer to obtain property or service on credit.
(2)  "Debit card" means an identification card, plate, coupon, book, or number or any other device authorizing a designated person or bearer to communicate a request to an unmanned teller machine or a customer convenience terminal or to obtain property or services by debit to an account at a financial institution.
(b)  This section applies only to a restaurant or bar that accepts credit cards or debit cards from customers in the ordinary course of business.
(c)  A restaurant or bar owner shall display in a prominent place on the premises of the restaurant or bar a sign stating in letters at least one-half inch high: "UNDER SECTION 32.51, PENAL CODE, IT IS A STATE JAIL FELONY (PUNISHABLE BY CONFINEMENT IN A STATE JAIL FOR NOT MORE THAN TWO YEARS) TO OBTAIN, POSSESS, TRANSFER, OR USE A CUSTOMER'S DEBIT CARD OR CREDIT CARD NUMBER WITHOUT THE CUSTOMER'S CONSENT OR EFFECTIVE CONSENT."
(d)  The restaurant or bar owner shall display the sign in English and in another language spoken by a substantial portion of the employees of the restaurant or bar as their familiar language.
(e)  A restaurant or bar owner who fails to comply with this section commits an offense.  An offense under this subsection is a misdemeanor punishable by a fine not to exceed $25.
(f)  It is a defense to prosecution under Subsection (e) that the restaurant or bar owner charged with the offense produces to the court satisfactory evidence that the person displayed the sign required by Subsection (c) not later than 48 hours after the person received a citation for an offense under Subsection (e).  If the court is satisfied with the evidence produced by the person, the court shall dismiss the charge.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2019, 86th Leg., R.S., Ch. 319 (H.B. 2697), Sec. 1, eff. September 1, 2019.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 502 - Protection of Identifying Financial Information › Section 502.002. Business Receipt Containing Credit Card or Debit Card Information

Sec. 502.002.  BUSINESS RECEIPT CONTAINING CREDIT CARD OR DEBIT CARD INFORMATION.  (a)  A person who accepts a credit card or debit card for the transaction of business may not print on a receipt or other document that evidences the transaction and is provided to a cardholder more than the last four digits of the credit card or debit card account number or the month and year that the credit card or debit card expires.
(b)  This section does not apply to a transaction in which the sole means of recording a person's credit card or debit card account number on a receipt or other document evidencing the transaction is by handwriting or an imprint or copy of the credit card or debit card.
(c)  A person who provides, leases, or sells a cash register or other machine used to print a receipt or other document evidencing a credit card or debit card transaction shall provide notice of the requirements of this section to the recipient, lessee, or buyer, as applicable, of the machine.
(d)  A person who violates Subsection (a) is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month in which a violation occurs.  The civil penalty may not be imposed for more than one violation that occurs in a month.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this section.
(e)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating Subsection (a).
(f)  A court may not certify an action brought under this section as a class action.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 502 - Protection of Identifying Financial Information › Section 502.003. Delivery of Check Form

Sec. 502.003.  DELIVERY OF CHECK FORM.  (a)  In this section:
(1)  "Addressee" means a person to whom a check form is sent.
(2)  "Check form" means a device for the transmission or payment of money that:
(A)  is not a negotiable instrument under Section 3.104;
(B)  if completed would be a check as defined by Section 3.104;  and
(C)  is printed with information relating to the financial institution on which the completed check may be drawn.
(3)  "Check form provider" means a business that provides check forms to a customer for a personal or business account.
(4)  "Courier" means an entity that delivers parcels for a fee.
(b)  If an addressee requests that a check form provider employ courier delivery of a check form with signature required, and that service is available in the delivery area of the addressee, the entity arranging for courier delivery in compliance with the addressee's request must provide the addressee with the option to require that the signature of the addressee, or the representative of the addressee, be obtained on delivery.
(c)  The option under Subsection (b) to require the signature of the addressee or representative may be provided:
(1)  on a printed check form order form;
(2)  on an electronic check form order form where check form orders are offered on the Internet;
(3)  by electronic mail to an address established for that purpose by the entity making the offer; or
(4)  by another method reasonably designed to effectively communicate the addressee's intent.
(d)  An entity that arranges for the courier delivery of a check form to an addressee as requested under Subsection (b) shall notify the courier of the check form that the signature of the addressee or a representative of the addressee is required for delivery under that subsection.
(e)  If the addressee suffers a pecuniary loss because of the use of a check form stolen at the time of delivery to the addressee, a civil penalty of not more than $1,000 for each delivery may be imposed on:
(1)  an entity that violates Subsection (b), (c), or (d); or
(2)  a courier that:
(A)  is properly notified under Subsection (d) that a signature is required for delivery; and
(B)  delivers the check form without obtaining the signature of the addressee or a representative of the addressee.
(f)  The attorney general may bring an action to recover a civil penalty imposed under Subsection (e).  The attorney general may recover reasonable expenses incurred in obtaining the civil penalty, including court costs, reasonable attorney's fees, investigative costs, witness fees, and deposition expenses.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.001. Definitions

Sec. 503A.001.  DEFINITIONS.  In this chapter:
(1)  "Biological sample" means a material part of the human body, or a discharge or derivative part of the body, including tissue, blood, urine, or saliva that is known to contain DNA.
(2)  "Deidentified data" means data not reasonably linked to and that cannot reasonably be used to infer information about an identifiable individual.
(3)  "Direct-to-consumer genetic testing company" means an entity that:
(A)  offers genetic testing products or services directly to individuals as consumers of those products or services; or
(B)  collects, uses, or analyzes genetic data that:
(i)  results from a direct-to-consumer genetic testing product or service; and
(ii)  an individual rather than a health care provider provides to the entity.
(4)  "DNA" means deoxyribonucleic acid.
(5)  "Express consent" means an individual's affirmative response to a clear and meaningful notice regarding the collection, use, or disclosure of genetic data for a specific purpose.
(6)  "Genetic data" means any data, regardless of format, concerning an individual's genetic characteristics.  The term:
(A)  includes:
(i)  raw sequence data derived from sequencing all or a portion of an individual's extracted DNA;
(ii)  genotypic and phenotypic information obtained from analyzing an individual's raw sequence data; and
(iii)  health information regarding the health conditions that an individual self-reports to a company and that the company:
(a)  uses for scientific research or product development; and
(b)  analyzes in connection with the individual's raw sequence data; and
(B)  does not include deidentified data.
(7)  "Genetic testing" means a laboratory test of an individual's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of the individual's genetic characteristics.
(8)  "Person" means an individual, partnership, corporation, association, business, or business trust or the legal representative of an organization.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.002. Applicability

Sec. 503A.002.  APPLICABILITY.  (a) This chapter applies to a direct-to-consumer genetic testing company that:
(1)  offers its products or services to individuals who are residents of this state; or
(2)  collects, uses, or analyzes genetic data that:
(A)  results from the company's products or services; and
(B)  was provided to the company by an individual who is a resident of this state rather than by or at the direction of a health care provider.
(b)  This chapter does not apply to:
(1)  an entity only when they are engaged in collecting, using, or analyzing genetic data or biological samples in the context of research, as defined by 45 C.F.R. Section 164.501, that is conducted in accordance with:
(A)  the federal policy for the protection of human subjects (45 C.F.R. Part 46);
(B)  the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH); or
(C)  the United States Food and Drug Administration policy for the protection of human subjects (21 C.F.R. Parts 50 and 56);
(2)  genetic data that is protected health information collected by a covered entity or business associate, as defined by 45 C.F.R. Part 160, subject to the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
(3)  an institution of higher education or a private or independent institution of higher education, as those terms are defined by Section 61.003, Education Code;
(4)  an entity when the entity is offering genetic testing products or services through a health care provider; or
(5)  the collection, use, or analysis of genetic data by a health care provider.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.003. Exclusive Property Right in Dna; Confidentiality

Sec. 503A.003.  EXCLUSIVE PROPERTY RIGHT IN DNA; CONFIDENTIALITY.  An individual has a property right in, and retains the right to exercise exclusive control over, the individual's biological sample that is provided to or used by a direct-to-consumer genetic testing company and the results of genetic testing or analysis conducted on the individual's DNA by a direct-to-consumer genetic testing company, including to the collection, use, retention, maintenance, disclosure, or destruction of the sample or results.  The results of the genetic testing of an individual's DNA are confidential and may not be disclosed to another person without the individual's express consent.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.004. Requirements for Certain Uses of Deidentified Data

Sec. 503A.004.  REQUIREMENTS FOR CERTAIN USES OF DEIDENTIFIED DATA.  (a)  Except as otherwise provided by this chapter or other law, a direct-to-consumer genetic testing company that possesses an individual's deidentified data shall:
(1)  implement administrative and technical measures to ensure the data is not associated with a particular individual; and
(2)  publicly commit to maintaining and using data in deidentified form and refraining from making any attempt to identify an individual using the individual's deidentified data.
(b)  If a direct-to-consumer genetic testing company shares an individual's deidentified data with another person, the company shall enter into a legally enforceable contractual obligation prohibiting the person from attempting to identify an individual using the individual's deidentified data.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.005. Requirements for Certain Uses or Disclosure of Genetic Data and Biological Sample

Sec. 503A.005.  REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE OF GENETIC DATA AND BIOLOGICAL SAMPLE.  (a)  A direct-to-consumer genetic testing company shall:
(1)  develop, implement, and maintain a comprehensive security program to protect an individual's genetic data against unauthorized access, use, or disclosure; and
(2)  make publicly available:
(A)  a high-level privacy policy overview that includes basic, essential information about the company's collection, use, or disclosure of genetic data; and
(B)  a prominent privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.
(b)  Before collecting, using, or disclosing an individual's genetic data, a direct-to-consumer genetic testing company shall provide to the individual information about the company's collection, use, and disclosure of genetic data the company collects through a genetic testing product or service, including information that:
(1)  clearly describes the company's use of the genetic data;
(2)  specifies the persons who have access to test results; and
(3)  specifies the manner in which the company may share the genetic data.
(c)  A direct-to-consumer genetic testing company shall provide a process for an individual to:
(1)  access the individual's genetic data;
(2)  delete the individual's account and genetic data; and
(3)  destroy or require the destruction of the individual's biological sample.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.006. Required Consent

Sec. 503A.006.  REQUIRED CONSENT.  (a)  A direct-to-consumer genetic testing company engaging in any of the following activities must obtain:
(1)  an individual's separate express consent for:
(A)  the transfer or disclosure of the individual's genetic data to any person other than the company's vendors and service providers;
(B)  the use of genetic data for a purpose other than the primary purpose of the company's genetic testing product or service; or
(C)  the retention of any biological sample provided by the individual following the company's completion of the initial testing service requested by the individual;
(2)  an individual's informed consent in accordance with guidelines for the protection of human subjects issued under 45 C.F.R. Part 46, for transfer or disclosure of the individual's genetic data to a third party for:
(A)  research purposes; or
(B)  research conducted under the control of the company for the purpose of publication or generalizable knowledge; and
(3)  an individual's express consent for:
(A)  marketing by the company to the individual based on the individual's genetic data; or
(B)  marketing by a third party to the individual based on the individual's ordering or purchasing of a genetic testing product or service.
(b)  For purposes of Subsection (a), "marketing" does not include providing customized content or offers to an individual with whom a direct-to-consumer genetic testing company has a first-party relationship on the company's Internet website or through an application or service provided by the company to the individual.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.007. Prohibited Disclosures

Sec. 503A.007.  PROHIBITED DISCLOSURES.  (a)  A direct-to-consumer genetic testing company may not disclose an individual's genetic data to a law enforcement entity or other governmental body unless:
(1)  the company first obtains the individual's express written consent; or
(2)  the entity or body obtains a warrant or complies with another valid legal process required by the company.
(b)  A direct-to-consumer genetic testing company may not disclose, without first obtaining an individual's written consent, the individual's genetic data to:
(1)  an entity that offers health insurance, life insurance, or long-term care insurance; or
(2)  an employer of the individual.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 503A - Direct-to-Consumer Genetic Testing Companies; Rights Regarding DNA › Section 503A.008. Civil Penalty

Sec. 503A.008.  CIVIL PENALTY.  (a)  A direct-to-consumer genetic testing company that violates this chapter is liable to this state for a civil penalty in an amount not to exceed $2,500 for each violation.
(b)  The attorney general may bring an action to recover a civil penalty imposed under Subsection (a) and to restrain and enjoin a violation of this chapter.  The attorney general may recover reasonable attorney's fees and court costs incurred in bringing the action.
Added by Acts 2023, 88th Leg., R.S., Ch. 912 (H.B. 2545), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 504 - Prohibited Use of Crime Victim or Motor Vehicle Collision Information › Section 504.001. Definitions

Sec. 504.001.  DEFINITIONS.  In this chapter:
(1)  "Crime victim information" means information that:
(A)  is collected or prepared by a law enforcement agency; and
(B)  identifies or serves to identify a person who, according to a record of the agency, may have been the victim of a crime in which:
(i)  physical injury to the person occurred or was attempted; or
(ii)  the offender entered or attempted to enter the dwelling of the person.
(2)  "Motor vehicle collision information" means information that:
(A)  is collected or prepared by a law enforcement agency; and
(B)  identifies or serves to identify a person who, according to a record of the agency, may have been involved in a motor vehicle collision.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2023, 88th Leg., R.S., Ch. 709 (H.B. 2190), Sec. 110, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 504 - Prohibited Use of Crime Victim or Motor Vehicle Collision Information › Section 504.002. Prohibition on Use for Solicitation or Sale of Information

Sec. 504.002.  PROHIBITION ON USE FOR SOLICITATION OR SALE OF INFORMATION.  (a)  A person who possesses crime victim or motor vehicle collision information that the person obtained or knows was obtained from a law enforcement agency may not:
(1)  use the information to contact directly any of the following persons for the purpose of soliciting business from the person:
(A)  a crime victim;
(B)  a person who was involved in a motor vehicle collision; or
(C)  a member of the family of a person described by Paragraph (A) or (B); or
(2)  sell the information to another person for financial gain.
(b)  The attorney general may bring an action against a person who violates Subsection (a) pursuant to Section 17.47.
(c)  A person commits an offense if the person violates Subsection (a).  An offense under this subsection is a Class C misdemeanor unless the defendant has been previously convicted under this section three or more times, in which event the offense is a felony of the third degree.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2023, 88th Leg., R.S., Ch. 709 (H.B. 2190), Sec. 111, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 505 - Use of Zip Code to Verify Customer's Identity › Section 505.001. Definitions

Sec. 505.001.  DEFINITIONS.  In this chapter:
(1)  "Credit card" means a card or device issued under an agreement by which the issuer gives to a cardholder the right to obtain credit from the issuer or another person.
(2)  "Credit card issuer" means a lender, including a financial institution, or a merchant that receives applications and issues credit cards to individuals.
Added by Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.010(a), eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 505 - Use of Zip Code to Verify Customer's Identity › Section 505.002. Use of Zip Code to Verify Identity in Credit Card Transaction

Sec. 505.002.  USE OF ZIP CODE TO VERIFY IDENTITY IN CREDIT CARD TRANSACTION.  (a)  A business may require a customer who purchases a good or service from the business using a credit card to provide the customer's zip code to verify the customer's identity as provided by Subsection (b).
(b)  A business that obtains a customer's zip code under Subsection (a) may electronically verify with the credit card issuer that the zip code matches any zip code that the credit card issuer has on file for the credit card.
Added by Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.010(a), eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 505 - Use of Zip Code to Verify Customer's Identity › Section 505.003. Retention of Zip Code Prohibited

Sec. 505.003.  RETENTION OF ZIP CODE PROHIBITED.  A business that obtains a customer's zip code under Section 505.002 may not retain the zip code in any form after the purchase of the good or service has been completed.
Added by Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.010(a), eff. September 1, 2009.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.001. Definitions

Sec. 506.001.  DEFINITIONS.  In this chapter:
(1)  "Covered information" means deidentified information released by a board, commission, department, or other agency of this state, including an institution of higher education as defined by Section 61.003, Education Code, or a hospital that is maintained or operated by the state.
(2)  "Deidentified information" means information with respect to which the holder of the information has made a good faith effort to remove all personal identifying information or other information that may be used by itself or in combination with other information to identify the subject of the information.  The term includes aggregate statistics, redacted information, information for which random or fictitious alternatives have been substituted for personal identifying information, and information for which personal identifying information has been encrypted and for which the encryption key is maintained by a person otherwise authorized to have access to the information in an identifiable format.
(3)  "Personal identifying information" has the meaning assigned by Section 521.002(a)(1).
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.002. Required Notices

Sec. 506.002.  REQUIRED NOTICES.  (a)  An agency of this state shall provide written notice to a person to whom the agency releases deidentified information that the information is deidentified information.
(b)  A person who sells covered information or otherwise receives compensation for the transfer or disclosure of covered information shall provide written notice to the person to whom the information is sold, transferred, or disclosed that the information is deidentified information obtained from an agency of this state.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.003. Prohibited Acts

Sec. 506.003.  PROHIBITED ACTS.  (a)  A person may not:
(1)  reidentify or attempt to reidentify personal identifying information about an individual who is the subject of covered information; or
(2)  knowingly disclose or release covered information that was reidentified in violation of this section.
(b)  It is a defense to a civil action or prosecution for a violation of this section that:
(1)  the person:
(A)  was reidentifying the covered information for the purpose of a study or other scholarly research, including performing an evaluation or test of software intended to deidentify information; and
(B)  did not release or publish the names or other information identifying any subjects of the reidentified covered information; or
(2)  the person obtained informed, written consent from the individual who is the subject of the covered information that specifically referenced the information to be reidentified, disclosed, or released, and authorized the reidentification, disclosure, or release of that information.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.004. Offense

Sec. 506.004.  OFFENSE.  (a)  A person who violates Section 506.003 commits an offense.
(b)  An offense under this section is a Class A misdemeanor.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.005. Private Cause of Action

Sec. 506.005.  PRIVATE CAUSE OF ACTION.  A person who violates Section 506.003 is liable to the individual who is the subject of the covered information for statutory damages in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 506 - Reidentification of Deidentified Information › Section 506.006. Civil Penalty

Sec. 506.006.  CIVIL PENALTY.  (a)  In addition to other penalties and remedies assessed or recovered under this chapter, a person who violates Section 506.003 is liable to this state for a civil penalty in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
(b)  The attorney general may bring an action to recover a civil penalty under this section.
(c)  The attorney general is entitled to recover reasonable expenses incurred in bringing an action under this section, including reasonable attorney's fees, court costs, and investigatory costs.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 507 - Concealed Handgun Licenses as Valid Forms of Personal Identification › Section 507.001. Concealed Handgun License as Valid Proof of Identification

Sec. 507.001.  CONCEALED HANDGUN LICENSE AS VALID PROOF OF IDENTIFICATION.  (a)  A person may not deny the holder of a concealed handgun license issued under Subchapter H, Chapter 411, Government Code, access to goods, services, or facilities, except as provided by Section 521.460, Transportation Code, or in regard to the operation of a motor vehicle, because the holder has or presents a concealed handgun license rather than a driver's license or other acceptable form of personal identification.
(b)  This section does not affect:
(1)  the requirement under Section 411.205, Government Code, that a person subject to that section present a driver's license or identification certificate in addition to a concealed handgun license; or
(2)  the types of identification required under federal law to access airport premises or pass through airport security.
Redesignated from Business and Commerce Code, Chapter 506 by Acts 2017, 85th Leg., R.S., Ch. 324 (S.B. 1488), Sec. 24.001(2), eff. September 1, 2017.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 508 - Requiring Verification of Identity for Certain Card Transactions › Section 508.001. Definitions

Sec. 508.001.  DEFINITIONS.  In this chapter:
(1)  "Cardholder" means the person named on the face of a credit card or debit card to whom or for whose benefit the credit card or debit card is issued.
(2)  "Credit card" means a card or device issued under an agreement by which the issuer gives to a cardholder the right to obtain credit from the issuer or another person.
(3)  "Debit card" means a card, device, or other means of access to an individual's account at a financial institution that the individual may use to initiate electronic fund transfers.
(4)  "Merchant" means a person in the business of selling goods or services.
(5)  "Mobile wallet" means a device that uses an encrypted digital token to authenticate a cardholder's identity and account information.
(6)  "Photo identification" means a card or other document that:
(A)  is issued by a governmental entity to identify an individual; and
(B)  displays a photograph of the individual identified on the card or other document.
Added by Acts 2017, 85th Leg., R.S., Ch. 749 (S.B. 1381), Sec. 1, eff. January 1, 2018.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 508 - Requiring Verification of Identity for Certain Card Transactions › Section 508.002. Requiring Photo Identification for Credit or Debit Card Transaction

Sec. 508.002.  REQUIRING PHOTO IDENTIFICATION FOR CREDIT OR DEBIT CARD TRANSACTION.  (a)  A merchant, in a point of sale transaction, may require the individual using the credit card or debit card to provide photo identification verifying the individual's identity as the cardholder.
(b)  A merchant may choose to not accept the card for payment if the individual fails to provide photo identification verifying the individual's identity as the cardholder.
(c)  This section does not apply to transactions conducted with a mobile wallet.
Added by Acts 2017, 85th Leg., R.S., Ch. 749 (S.B. 1381), Sec. 1, eff. January 1, 2018.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.002. Applicability to Certain Data

Sec. 509.002.  APPLICABILITY TO CERTAIN DATA.  (a)  Except as provided by Subsection (b), this chapter applies to personal data from an individual that is collected, transferred, or processed by a data broker.
(b)  This chapter does not apply to the following data:
(1)  deidentified data, if the data broker:
(A)  takes reasonable technical measures to ensure that the data is not able to be used to identify an individual with whom the data is associated;
(B)  publicly commits in a clear and conspicuous manner:
(i)  to process and transfer the data solely in a deidentified form without any reasonable means for reidentification; and
(ii)  to not attempt to identify the information to an individual with whom the data is associated; and
(C)  contractually obligates a person that receives the information from the provider:
(i)  to comply with this subsection with respect to the information; and
(ii)  to require that those contractual obligations be included in any subsequent transfer of the data to another person;
(2)  employee data;
(3)  publicly available information;
(4)  inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data with respect to an individual; or
(5)  data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.).
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.003. Applicability of Chapter to Certain Entities

Sec. 509.003.  APPLICABILITY OF CHAPTER TO CERTAIN ENTITIES.  (a)  Except as provided by Subsection (b), this chapter applies only to a data broker that, in a 12-month period, derives:
(1)  more than 50 percent of the data broker's revenue from processing or transferring personal data that the data broker did not collect directly from the individuals to whom the data pertains; or
(2)  revenue from processing or transferring the personal data of more than 50,000 individuals that the data broker did not collect directly from the individuals to whom the data pertains.
(b)  This chapter does not apply to:
(1)  a service provider, including a service provider that engages in the business of processing employee data for a third-party employer for the sole purpose of providing benefits to the third-party employer's employees;
(2)  a person or entity that collects personal data from another person or entity to which the person or entity is related by common ownership or corporate control, provided a reasonable consumer would expect the persons or entities to share data;
(3)  a federal, state, tribal, territorial, or local governmental entity, including a body, authority, board, bureau, commission, district, agency, or political subdivision of a governmental entity;
(4)  an entity that serves as a congressionally designated nonprofit, national resource center, or clearinghouse to provide assistance to victims, families, child-serving professionals, and the general public on missing and exploited children issues;
(5)  a consumer reporting agency or other person or entity that furnishes information for inclusion in a consumer credit report or obtains a consumer credit report, but only to the extent the person or entity engages in activity regulated or authorized by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.), including the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living; or
(6)  a financial institution subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.).
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.
2023 Texas Statutes › Business and Commerce Code › Title 11 - Personal Identity Information › Subtitle A - Identifying Information › Chapter 509 - Data Brokers › Section 509.004. Notice on Website or Mobile Application

Sec. 509.004.  NOTICE ON WEBSITE OR MOBILE APPLICATION.  A data broker that maintains an Internet website or mobile application shall post a conspicuous notice on the website or application that:
(1)  states that the entity maintaining the website or application is a data broker;
(2)  is clear, not misleading, and readily accessible by the general public, including individuals with a disability; and
(3)  contains language provided by rule of the secretary of state for inclusion in the notice.
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.