| |
| |
| |
|
|
AN ACT
|
|
|
relating to prohibiting the reidentification of certain |
|
|
deidentified information and the release of reidentified |
|
|
information; creating a criminal offense; providing a civil |
|
|
penalty. |
|
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
|
SECTION 1. Subtitle A, Title 11, Business & Commerce Code, |
|
|
is amended by adding Chapter 506 to read as follows: |
|
|
CHAPTER 506. REIDENTIFICATION OF DEIDENTIFIED INFORMATION |
|
|
Sec. 506.001. DEFINITIONS. In this chapter: |
|
|
(1) "Covered information" means deidentified |
|
|
information released by a board, commission, department, or other |
|
|
agency of this state, including an institution of higher education |
|
|
as defined by Section 61.003, Education Code, or a hospital that is |
|
|
maintained or operated by the state. |
|
|
(2) "Deidentified information" means information with |
|
|
respect to which the holder of the information has made a good faith |
|
|
effort to remove all personal identifying information or other |
|
|
information that may be used by itself or in combination with other |
|
|
information to identify the subject of the information. The term |
|
|
includes aggregate statistics, redacted information, information |
|
|
for which random or fictitious alternatives have been substituted |
|
|
for personal identifying information, and information for which |
|
|
personal identifying information has been encrypted and for which |
|
|
the encryption key is maintained by a person otherwise authorized |
|
|
to have access to the information in an identifiable format. |
|
|
(3) "Personal identifying information" has the |
|
|
meaning assigned by Section 521.002(a)(1). |
|
|
Sec. 506.002. REQUIRED NOTICES. (a) An agency of this |
|
|
state shall provide written notice to a person to whom the agency |
|
|
releases deidentified information that the information is |
|
|
deidentified information. |
|
|
(b) A person who sells covered information or otherwise |
|
|
receives compensation for the transfer or disclosure of covered |
|
|
information shall provide written notice to the person to whom the |
|
|
information is sold, transferred, or disclosed that the information |
|
|
is deidentified information obtained from an agency of this state. |
|
|
Sec. 506.003. PROHIBITED ACTS. (a) A person may not: |
|
|
(1) reidentify or attempt to reidentify personal |
|
|
identifying information about an individual who is the subject of |
|
|
covered information; or |
|
|
(2) knowingly disclose or release covered information |
|
|
that was reidentified in violation of this section. |
|
|
(b) It is a defense to a civil action or prosecution for a |
|
|
violation of this section that: |
|
|
(1) the person: |
|
|
(A) was reidentifying the covered information |
|
|
for the purpose of a study or other scholarly research, including |
|
|
performing an evaluation or test of software intended to deidentify |
|
|
information; and |
|
|
(B) did not release or publish the names or other |
|
|
information identifying any subjects of the reidentified covered |
|
|
information; or |
|
|
(2) the person obtained informed, written consent from |
|
|
the individual who is the subject of the covered information that |
|
|
specifically referenced the information to be reidentified, |
|
|
disclosed, or released, and authorized the reidentification, |
|
|
disclosure, or release of that information. |
|
|
Sec. 506.004. OFFENSE. (a) A person who violates Section |
|
|
506.003 commits an offense. |
|
|
(b) An offense under this section is a Class A misdemeanor. |
|
|
Sec. 506.005. PRIVATE CAUSE OF ACTION. A person who |
|
|
violates Section 506.003 is liable to the individual who is the |
|
|
subject of the covered information for statutory damages in an |
|
|
amount of not less than $25 or more than $500 for each violation, |
|
|
not to exceed a total amount of $150,000. |
|
|
Sec. 506.006. CIVIL PENALTY. (a) In addition to other |
|
|
penalties and remedies assessed or recovered under this chapter, a |
|
|
person who violates Section 506.003 is liable to this state for a |
|
|
civil penalty in an amount of not less than $25 or more than $500 for |
|
|
each violation, not to exceed a total amount of $150,000. |
|
|
(b) The attorney general may bring an action to recover a |
|
|
civil penalty under this section. |
|
|
(c) The attorney general is entitled to recover reasonable |
|
|
expenses incurred in bringing an action under this section, |
|
|
including reasonable attorney's fees, court costs, and |
|
|
investigatory costs. |
|
|
SECTION 2. The change in law made by this Act applies to |
|
|
conduct that occurs on or after the effective date of this Act. |
|
|
Conduct that occurs before the effective date of this Act is |
|
|
governed by the law in effect on the date the conduct occurred, and |
|
|
the former law is continued in effect for that purpose. |
|
|
SECTION 3. This Act takes effect September 1, 2015. |
|
|
|
|
|
|
| |
| |
| |
| |
______________________________ |
______________________________ |
| |
President of the Senate |
Speaker of the House |
| |
|
|
I hereby certify that S.B. No. 1213 passed the Senate on |
|
|
April 20, 2015, by the following vote: Yeas 30, Nays 0; and that |
|
|
the Senate concurred in House amendment on May 29, 2015, by the |
|
|
following vote: Yeas 31, Nays 0. |
|
|
|
| |
| |
______________________________ |
| |
Secretary of the Senate |
| |
|
|
I hereby certify that S.B. No. 1213 passed the House, with |
|
|
amendment, on May 26, 2015, by the following vote: Yeas 142, |
|
|
Nays 0, two present not voting. |
|
|
|
| |
| |
______________________________ |
| |
Chief Clerk of the House |
| |
|
|
|
| |
|
|
Approved: |
|
|
|
|
|
______________________________ |
|
|
Date |
|
|
|
|
|
|
|
|
______________________________ |
|
|
Governor |