iOn May 10, 2023, the Texas Senate passed H.B. 4, also known as the Texas Data Privacy and Security Act (“TDPSA”). The TDPSA now heads to Texas Governor Greg Abbott for a final signature. If the TDPSA is signed into law, Texas could become the tenth state to enact comprehensive privacy legislation.
The final text of the TDPSA closely follows H.B. 1844, which we previously reported on when it was introduced in the Texas House in February. In addition to the provisions of H.B. 1844, the TDPSA:
-
Revises the definition of personal data to include pseudonymous data only when the data is used by a controller or a processor in conjunction with additional information that reasonably links the data to an identified or an identifiable individual;
-
Adds a requirement that if a controller sells sensitive or biometric data, the controller must disclose that fact in its privacy policy;
-
Requires small businesses, as defined by the United States Small Business Administration, to receive consent from consumers before selling consumers’ sensitive data;
-
Directs the Texas Attorney General to provide (1) information outlining consumer rights and the responsibilities of controllers and processors under the TDPSA, and (2) an Internet mechanism for submitting consumer complaints; and
-
Introduces prescriptive requirements for curing a violation.
If enacted, the TDPSA will take effect on March 1, 2024.
