BILL ANALYSIS
|
Senate Research Center |
S.B. 15 |
|
|
By: Nichols |
|
|
Transportation |
|
|
6/2/2021 |
|
|
Enrolled |
AUTHOR'S / SPONSOR'S STATEMENT OF INTENT
Under the Driver's Privacy Protection Act, all states are required to set privacy protections for motor vehicle records. Governmental entities are selling, disclosing, and allowing resale of personal information attached to motor vehicle records to private entities. Personal information includes name, address, and driver's license number of the vehicle owner or lienholder, along with vehicle registration and title. S.B. 15 restricts disclosure of personal information to essential government agencies, and forbids personal information from redisclosure or resale to private entities such as marketing and technology companies.
(Original Author's/ Sponsor's Statement of Intent)
S.B. 15 amends current law relating to the Texas Consumer Privacy Act Phase I, creates criminal offenses, and increases the punishment for an existing criminal offense.
RULEMAKING AUTHORITY
Rulemaking authority previously granted to the Texas Parks and Wildlife Commission is modified in SECTION 2 (Section 11.030, Parks and Wildlife Code) of this bill.
Rulemaking authority is expressly granted to an applicable agency in SECTION 9 (Section 730.0121, Transportation Code) of this bill.
Rulemaking authority previously granted to the Texas Transportation Commission is rescinded in SECTION 15 (Section 204.011, Transportation Code) of this bill.
SECTION BY SECTION ANALYSIS
SECTION 1. Provides that this Act may be cited as the Texas Consumer Privacy Act Phase I.
SECTION 2. Amends Section 11.030, Parks and Wildlife Code, by amending Subsections (a) and (c) and adding Subsections (e-1), (e-2), and (e-3), as follows:
(a) Prohibits certain personal identification information of a person who purchases customer products, licenses, or services from the Texas Parks and Wildlife Department (TPWD) from being disclosed, sold, rented, or traded, rather than from being disclosed, except as authorized under Section 11.030 (Disclosure of Personal Customer Information) or Section 12.0251 (Disclosure of Information Collected During Technical Guidance to Private Landowner).
(c)� Deletes existing text requiring the Texas Parks and Wildlife Commission (TPWC) by rule to adopt policies relating to the sale of a mailing list consisting of the names and addresses of persons who purchase customer products, licenses, or services. Makes nonsubstantive changes.
(e-1) Authorizes TPWD to disclose statistical data and compilations of customer information described by Subsection (a) if the information does not reveal information identifying a specific TPWD customer or a TPWD customer's address, telephone number, social security number, or driver's license number.
(e-2) Authorizes TPWD to disclose customer information described by Subsection (a) only:
(1) to another governmental body, including a law enforcement entity, as needed to carry out a governmental purpose;
(2) if the customer that is the subject of the information consents in writing to the specific disclosure; or
(3) if the information is part of a record that is considered to be a public record under Section 31.039 (Public Records; Fees) or is authorized to be disclosed under Section 31.0391 (Release of Information).
(e-3) Provides that Section 11.030 does not authorize TPWD to disclose information TPWD is prohibited from disclosing by other law.
SECTION 3. Amends Section 204.011(a), Transportation Code, to delete existing text providing an exception as provided by Section 204.011 (Subscriber or Purchaser Information) or a rule adopted by the Texas Transportation Commission (TTC) under Section 204.011 to the prohibition of the Texas Department of Transportation (TxDOT) from disclosing to any person certain personal identification information of certain persons. Makes a nonsubstantive change.
SECTION 4. Amends Section 548.601(a), Transportation Code, as follows:
(a) Provides that a person, including an inspector or an inspection station, commits an offense under certain circumstances, including if the person discloses or sells information collected in relation to the vehicle inspection program under Chapter 548 (Compulsory Inspection of Vehicles) about a unique customer or a unique vehicle owner to a person other than the Department of Public Safety of the State of Texas (DPS) or the person who is the subject of the information, including a customer or vehicle owner's name, address, or phone number. Makes a nonsubstantive change.
SECTION 5. Amends Section 730.003, Transportation Code, by adding Subdivision (1-a) and amending Subdivision (6), to define "authorized recipient" and to redefine "personal information" for purposes of Chapter 730 (Motor Vehicle Records Disclosure Act).
SECTION 6. Amends Section 730.006, Transportation Code, as follows:
Sec. 730.006. REQUIRED DISCLOSURE WITH CONSENT. Requires that personal information obtained by an agency in connection with a motor vehicle record be disclosed to certain individuals, including a requestor who is the subject of the information. Makes nonsubstantive changes.
SECTION 7. Amends the heading to Section 730.007, Transportation Code, to read as follows:
Sec. 730.007. PERMITTED DISCLOSURES OF CERTAIN PERSONAL INFORMATION.
SECTION 8. Amends Section 730.007, Transportation Code, by amending Subsection (a) and adding Subsections (a-1), (a-2), and (g), as follows:
(a) Authorizes disclosure of personal information obtained by an agency in connection with a motor vehicle record to any requestor by an agency if the requestor:
(1) makes no changes to this subdivision; and
(2) represents that the use of the personal information will be strictly limited to:
(A) makes no changes to this paragraph;
(B) deletes existing text relating to use in connection with a matter of motor vehicle market research activities, including survey research;
(C)-(E) makes no changes to these paragraphs;
�(F) use by an insurer, insurance support organization, or self-insured entity, or an authorized agent of an insurer, insurance support organization, or self-insured entity, in connection with claims processing or investigation activities, antifraud activities, rating, or underwriting, rather than use by an insurer or insurance support organization, or by a self-insured entity, or an authorized agent of the entity, in connection with claims investigation activities, antifraud activities, rating, or underwriting;
(G) use in providing notice to an owner of a vehicle that was towed or impounded and is in the possession of a vehicle storage facility, rather than use in providing notice to an owner of a towed or impounded vehicle;
(H) and (I) makes no changes to these paragraphs;
(J) use in connection with the operation of a toll transportation facility or another type of transportation project described by Section 370.003 (Definitions), rather than use in connection with the operation of a private toll transportation facility;
(K) makes no changes to this paragraph;
(L)� use by a motor vehicle manufacturer, dealership, or distributor, or an agent of or provider of services to a motor vehicle manufacturer, dealership, or distributor, for motor vehicle market research activities, including survey research;
(M)� use in the ordinary course of business by a person or authorized agent of a person who:
(i) holds a salvage vehicle dealer license issued under Chapter 2302 (Salvage Vehicle Dealers), Occupations Code;
(ii) holds an independent motor vehicle dealer or wholesale motor vehicle auction general distinguishing number issued under Chapter 503 (Dealer's and Manufacturer's Vehicle License Plates) of this code;
(iii) holds a used automotive parts recycler license issued under Chapter 2309 (Used Automotive Parts Recyclers), Occupations Code; or
(iv)� is licensed by, registered with, or subject to regulatory oversight by the Texas Department of Motor Vehicles (TxDMV), the Texas Department of Banking, the Department of Savings and Mortgage Lending, the Credit Union Department, the Office of Consumer Credit Commissioner (CCC), the Texas Department of Insurance, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Consumer Financial Protection Bureau, or the National Credit Union Administration; or
(N) use by an employer, principal, general contractor, nonprofit organization, charitable organization, or religious institution to obtain or verify information relating to a person who holds a driver's license or the driving history of a person who holds a driver's license if the person is employed by, works under a contract with, or volunteers for the employer, principal, contractor, organization, or institution.
Deletes existing text authorizing disclosure of personal information obtained by an agency in connection with a motor vehicle record to any requestor by an agency if the requestor represents that the use of the personal information will be strictly limited to use for any other purpose specifically authorized by law that relates to the operation of a motor vehicle or to public safety. Makes nonsubstantive changes.
(a-1) Authorizes personal information obtained by TxDMV in connection with a motor vehicle record to be disclosed:
(1)� when referring potential violations to CCC, DPS, law enforcement agencies, or the Comptroller of Public Accounts of the State of Texas, if the personal information is necessary for carrying out regulatory functions;
(2)� to the attorney general as part of a response by TxDMV to a subpoena or a discovery request, if the personal information is necessary for litigation purposes; or
(3)� to a county assessor-collector if the personal information is related to a finding from an audit or investigation conducted under Section 520.010 (Audit and Investigation Related to Registration and Titling Services).
(a-2) Provides that Subsection (a)(2)(C) does not authorize the disclosure of personal information to a natural person who is not a business licensed by, registered with, or subject to regulatory oversight by a government agency.
(g) Authorizes an agency to request that an authorized recipient or other person in possession of personal information disclosed for a use authorized by Section 730.007 provide to the agency information sufficient for the agency to determine whether the authorized recipient or person has complied with Chapter 730, agency rules, or other law that applies to the disclosed personal information. Requires the authorized recipient or person to provide the requested information not later than the fifth business day after the date the agency submits the request unless the agency extends the deadline to provide a reasonable period to produce the requested information.
SECTION 9. Amends Chapter 730, Transportation Code, by adding Sections 730.0121, 730.0122, and 730.0123, as follows:
Sec. 730.0121. DELETION OF INFORMATION REQUIRED IF NOT AUTHORIZED RECIPIENT. Requires an agency by rule to require a requestor to delete from the requestor's records personal information received from the agency under Chapter 730 if the requestor becomes aware that the requestor is not an authorized recipient of that information.
Sec. 730.0122. SALE PROHIBITED. (a) Prohibits a person from selling to a person who is not an authorized recipient personal information obtained by an agency in connection with a motor vehicle record.
(b) Provides that a person commits a misdemeanor offense punishable by a fine not to exceed $100,000 if the person violates Subsection (a).
Sec. 730.0123. CIVIL SUIT. (a) Provides that a person who sells to a person who is not an authorized recipient personal information obtained by an agency in connection with a motor vehicle record is liable to the person who is the subject of the information for:
(1) actual damages;
(2) if the actual damages to the person are less than $2,500, an additional amount so that the total amount of damages equals $2,500; and
(3) court costs incurred by the person who is the subject of the information in bringing the action.
(b) Authorizes a person whose personal information has been disclosed for compensation to a person who is not an authorized recipient to sue for the damages, costs, and fees authorized under Subsection (a), injunctive relief, and any other equitable remedy determined to be appropriate by the court.
(c) Provides that a district court has exclusive original jurisdiction over a cause of action brought under this section.
SECTION 10. Amends Section 730.013, Transportation Code, as follows:
Sec. 730.013. New heading: REDISCLOSURE; OFFENSE. (a) Deletes existing text prohibiting an authorized recipient of personal information from reselling the personal information in the identical or a substantially identical format the personal information was disclosed to the recipient by the applicable agency.
(b) Authorizes an authorized recipient of personal information to redisclose the information, including redisclosure for compensation, rather than to resell or redisclose the information, only for a use permitted under Section 730.007.
(c) Deletes existing text requiring any authorized recipient who resells personal information obtained from an agency to be required by that agency to take certain actions. Makes a nonsubstantive change.
(c-1) Prohibits a person who receives personal information under Subsection (b) from redisclosing the personal information, including redisclosure for compensation, to a person who is not an authorized recipient.
(c-2) Requires an authorized recipient to notify each person who receives personal information from the authorized recipient that the person is prohibited from redisclosing the personal information to a person who is not an authorized recipient.
(d) Provides that a person who violates this section commits a misdemeanor offense punishable by a fine not to exceed $100,000, rather than $25,000.
SECTION 11. Amends the heading to Section 730.014, Transportation Code, to read as follows:
Sec. 730.014.� AGENCY RULES, RECORDS, AND CONTRACTS.
SECTION 12. Amends Section 730.014, Transportation Code, by adding Subsections (c), (d), (e), (f), and (g), as follows:
(c) Requires an agency that provides a requestor access to personal information in motor vehicle records in bulk under a contract under Section 730.007 to include in the contract:
(1)� a requirement that the requestor post a performance bond in an amount of not more than $1 million;
(2)� a prohibition on the sale or redisclosure of the personal information for the purpose of marketing extended vehicle warranties by telephone;
(3)� a requirement that the requestor provide proof of general liability and cyber-threat insurance coverage in an amount specified by the contracting agency that is at least $3 million and is reasonably related to the risks associated with unauthorized access and use of the records;
(4)� a requirement that if a requestor experiences a breach of system security, as defined by Section 521.053 (Notification Required Following Breach of Security of Computerized Data), Business & Commerce Code, that includes data obtained under Section 730.007, the requestor is required to notify the agency of the breach not later than 48 hours after the discovery of the breach;
(5)� a requirement that the requestor include in each contract with a third party that receives the personal information from the requestor that the third party is required to comply with federal and state laws regarding the records;
(6)� a requirement that the requestor and any third party receiving the personal information from the requestor protect the personal information with appropriate and accepted industry standard security measures for the type of information and the known risks from unauthorized access and use of the information; and
(7)� a requirement that the requestor annually provide to the agency a report of all third parties to which the personal information was disclosed under this section and the purpose of the disclosure.
(d) Provides that the bond and insurance requirements in Subsections (c)(1) and (3) do not apply to a contract under Section 730.007 between a government agency and another government agency, including a court or law enforcement agency.
(e) Requires an agency that discloses any motor vehicle records in bulk under Section 730.007 to include in the records at least two records that are created solely for the purpose of monitoring compliance with Chapter 730 and detecting, by receipt of certain forms of communications or actions directed at the subjects of the created records, potential violations of Chapter 730 or contract terms required by Section 730.014.
(f) Requires an agency that discloses motor vehicle records to designate an employee to be responsible for:
(1)� monitoring compliance with Chapter 730 and contract terms required by Section 730.014;
(2)� referring potential violations of Chapter 730 to law enforcement agencies; and
(3) making recommendations to the administrative head of the agency or the designee of the administrative head of the agency on the eligibility of a person under Section 730.016 to receive personal information.
(g) Provides that this subsection does not affect any rights or remedies available under a contract or any other law. Authorizes an agency, if the agency determines that a person has violated a term of a contract with the agency for the disclosure under Chapter 730 of personal information obtained by the agency in connection with a motor vehicle record, to:
(1) cease disclosing personal information to that person; and
(2) allow the person to remedy the violation and resume receiving personal information.
SECTION 13. Amends the heading to Section 730.016, Transportation Code, to read as follows:
Sec. 730.016. INELIGIBILITY OF CERTAIN PERSONS TO RECEIVE, RETAIN, OR REDISCLOSE PERSONAL INFORMATION; OFFENSE.
SECTION 14. Amends Section 730.016, Transportation Code, by amending Subsection (a) and adding Subsection (c), as follows:
(a) Provides that a person who is convicted of an offense under Chapter 730, or who violates a rule adopted by an agency relating to the terms or conditions for a release of personal information, including a rule adopted under Section 730.0121:
(1) creates this subdivision from existing text and makes nonsubstantive changes;
(2) not later than one year after the date of conviction or the court's final determination under this subsection, is required to delete from the person's records all personal information received under Chapter 730; and
(3) is prohibited from redisclosing personal information received under Chapter 730.
(c) Provides that a person who violates this section commits a misdemeanor offense punishable by a fine not to exceed $100,000.
SECTION 15. (1) Repealer: Section 11.030(d) (relating to requiring TPWC to include in its policies a method for a person by request to exclude information about the person from a certain mailing list), Parks and Wildlife Code.
(2) Repealers: Sections 204.011(c) (relating to certain policies regarding subscriber and purchaser information established by rule of TTC) and (d) (relating to the requirement that the policies include certain protections of personal information), Transportation Code.
SECTION 16. Makes application of this Act prospective.
SECTION 17. (a) Provides that Section 730.0121, Transportation Code, as added by this Act, applies to a person who received personal information under Chapter 730, Transportation Code, before the effective date of this Act, and is not an authorized recipient, as defined by Section 730.003(1-a), Transportation Code, as added by this Act, of that personal information under Chapter 730, Transportation Code, as amended by this Act.
(b) Prohibits an agency to which Section 730.0121, Transportation Code, as added by this Act, applies, notwithstanding Subsection (a) of this section, from requiring a person who received personal information from the agency before the effective date of this Act and is not an authorized recipient, as defined by Section 730.003(1-a), Transportation Code, as added by this Act, of that information to delete the information before the first anniversary of the effective date of this Act.
SECTION 18. Effective date: upon passage or September 1, 2021.