HOUSTON — Starting on July 1, 2024, consumers in Texas will have more control over their personal online data.
The Texas Data Privacy and Security Act takes effect on that day after being passed in 2023.
What is the Texas Data Privacy and Security Act?
According to a report from the Texas Tribune, the Texas Data Privacy and Security Act requires all businesses to obtain users’ consent before processing their sensitive personal data. The law also allows Texans to access any data a company has about them, delete it, or ask the company to stop collecting it for targeted advertising or to sell it.
The bill was signed into law on June 18, 2023, following the regular legislative session.
Who does the Texas Data Privacy and Security Act apply to?
Texas Data Privacy and Security Act applies to anyone who conducts business in Texas or produces a product or service consumed by state residents. These are businesses that process or engage in the sale of personal data.
This does not apply to a small business as defined by the U.S. Small Business Administration.
Who is exempt from the Texas Data Privacy and Security Act?
Texas Data Privacy and Security Act contains exemptions for:
- State agencies or political subdivisions of the state
- Financial institutions or data subject to Title V, Gramm-Leach-Bliley Act
- Healthcare providers that are already subject to the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services
- Nonprofit organizations
- Institutions of higher learning
- Electric utilities, power generation companies, or retail electric providers
What consumers need to know about the Texas Data Privacy and Security Act
Under the Texas Date Privacy and Security Act, consumers are entitled to exercise rights provided by the new law regarding the processing of personal data.
A consumer can exercise their right to:
- Confirm whether a business is processing their personal data and be able to access their personal data
- Correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of their personal data
- Delete personal data provided by or obtained about the consumer
- Opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer
Businesses must comply with a consumer’s request concerning their private data. They also must respond to a consumer's request without delay and within 45 days after receipt.
Businesses can extend the response period so long as they inform the consumer and provide the reason for the extension.
If a business declines a consumer's request, it must provide justification and instructions on how to appeal the decision.
How to file a complaint
Earlier this month, the Texas Attorney General's Office established a new team that will enforce the new Texas privacy laws.
“Any entity abusing or exploiting Texans’ sensitive data will be met with the full force of the law. Companies that collect and sell data in an unauthorized manner, harm consumers financially or use artificial intelligence irresponsibly present risks to our citizens that we take very seriously,” Texas Attorney General Ken Paxton said in a statement.
Consumers can file a complaint here with the AG's Office.