01/19/2024
Did you know: Texas is the 11th state to provide consumers with comprehensive privacy protection? This was achieved by enacting the Texas Data Privacy and Security Act ( TDPSA) on June 16, 2023. The law itself actually goes into effect on July 1, 2024.
Who does it apply to?
Persons and entities that meet ALL of the following conditions:
Conduct business in Texas or produce products or services that Texas residents consume.
Process any volume of personal data or engage in personal data sales.
Do not qualify as a small business as defined by the US Small Business Administration. However, please note that a small business must still obtain the consumer’s consent prior to selling sensitive personal data.
The following is an example of entities that are excluded from TDPSA :
State agencies or political subdivisions
Nonprofits
Institutes of higher education
Electric utilities, power generations companies nad retail electric providers
Employment related data
Entities or data regulated by other sector-specific laws like HIPAA, GLBA, FCRA and COPPA)
TDPSA considers the following to be sensitive personal data:
Revealing an individual’s:
o Religious beliefs
o Mental or physical health diagnosis
o Racial or ethnic origin
o Citizenship or immigration status
o Sexuality
Personal data collected from a known child
Precise geolocation data
Genetic or biometric data processed to uniquely identify an individual
What must you as a regulated person/entity do if you fall under TDPSA?
Minimize data collection to the extent possible
Maintain transparency by issuing privacy notices with specific disclaimers if you engage in the sale of sensitive or biometric data
Limit personal data use to purposes reasonably necessary for the disclosed processing purpose unless the consumer agrees to secondary use
Provide reasonable data security to protect the personal data’s confidentiality, integrity and accessibility
No discrimination or retaliation if a consumer exercises their rights under TDPSA
Avoid unlawful discrimination when processing personal data
Comply with COPPA ( regarding children’s sensitive data)
Obtain consent before processing sensitive data
Timely respond to consumer requests to exercise their personal data rights
Make sure to check with your local attorney if you have questions about further details about TDPSA and how it may apply to your business.
violations may result in potential civil penalties of up to $7,500 per violation.