BILL ANALYSIS

 

 

 

C.S.S.B. 15

By: Nichols

Transportation

Committee Report (Substituted)

 

 

 

BACKGROUND AND PURPOSE

 

Under the federal Driver's Privacy Protection Act, all states are required to set privacy protections for motor vehicle records. In Texas, the Motor Vehicle Records Disclosure Act prohibits the disclosure and use of personal information contained in motor vehicle records by state agencies and political subdivisions, except under certain conditions. However, concerns have been raised regarding the disclosure of the information that is permitted under the act. There have been calls to revise the permitted disclosures under the act in order to uphold the intent of the law while allowing essential governmental entities to access information for lawful purposes. C.S.S.B. 15 seeks to address these issues by revising the Motor Vehicle Records Disclosure Act and by prohibiting certain disclosures by the Texas Department of Transportation and the Parks and Wildlife Department.

 

CRIMINAL JUSTICE IMPACT

 

It is the committee's opinion that this bill expressly does one or more of the following: creates a criminal offense, increases the punishment for an existing criminal offense or category of offenses, or changes the eligibility of a person for community supervision, parole, or mandatory supervision.

 

RULEMAKING AUTHORITY

 

It is the committee's opinion that rulemaking authority is expressly granted to any state agency that compiles or maintains motor vehicle records in SECTION 9 of this bill.

 

ANALYSIS

 

C.S.S.B. 15 amends the Transportation Code to revise provisions of the Motor Vehicle Records Disclosure Act. The bill establishes additional circumstances under which certain personal information in connection with a motor vehicle record obtained by an agency, defined under the act as any state agency or political subdivision that compiles or maintains those records, may be disclosed. The bill creates offenses under the act, increases criminal penalties enforced under the act, includes an individual's date of birth and email address as personal information subject to disclosure under the act, and clarifies that such an agency must disclose personal information in connection with a record under the act to the subject of the information.

 

C.S.S.B. 15 revises the authorized disclosures of personal information under the act by authorizing the disclosure of information to a requestor who represents that the use of the information will be for the following uses:

·         by an insurer, insurance support organization, or self-insured entity, or an authorized agent of an insurer, insurance support organization, or self-insured entity, in connection with claims processing or investigation activities, antifraud activities, rating, or underwriting;

·         in providing notice to an owner of a vehicle that was towed or impounded and is in the possession of a vehicle storage facility;

·         use in connection with the operation of a toll transportation facility or another type of transportation project by a regional mobility authority;

·         by a motor vehicle manufacturer, dealership, or distributor, or an agent of or provider of services to a motor vehicle manufacturer, dealership, or distributor, for motor vehicle market research activities, including survey research;

·         in the ordinary course of business by a person or authorized agent of a person who does the following:

o   holds a salvage vehicle dealer license;

o   holds an independent motor vehicle dealer or wholesale motor vehicle auction general distinguishing number;

o   holds a used automotive parts recycler license; or

o   is licensed by, registered with, or subject to regulatory oversight by the Texas Department of Motor Vehicles (TxDMV), the Texas Department of Banking, the Department of Savings and Mortgage Lending, the Credit Union Department, the Office of Consumer Credit Commissioner, the Texas Department of Insurance, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Consumer Financial Protection Bureau, or the National Credit Union Administration; or

·         by an employer, principal, general contractor, nonprofit organization, charitable organization, or religious institution to obtain or verify information relating to a person who holds a driver's license or a license holder's driving history if the person is employed by, works under a contract with, or volunteers for the employer, principal, contractor, organization, or institution.

 

C.S.S.B. 15 provides for the disclosure of personal information obtained by TxDMV in connection with a motor vehicle record under the following conditions:

·         when referring potential violations to the Texas Office of Consumer Credit Commissioner, the Department of Public Safety (DPS), or the comptroller of public accounts, if the personal information is necessary for carrying out regulatory functions; or

·         to the attorney general as part of a response by TxDMV to a subpoena or a discovery request, if the personal information is necessary for litigation purposes.

The bill authorizes an agency to request that an authorized recipient or other person in possession of disclosed personal information provide the agency with information sufficient for the agency to determine whether the recipient or person has complied with the applicable law, rules, or regulations. The bill requires the recipient or person to provide the requested information not later than the fifth business day after the date the agency submits the request unless the agency extends the deadline to provide a reasonable period to produce the requested information.

 

C.S.S.B. 15 requires an agency by rule to require a requestor to delete from the requestor's records personal information received from the agency under the act if the requestor becomes aware that the requestor is not an authorized recipient of that information. This requirement applies to a person who received the personal information before the bill's effective date. The bill defines "authorized recipient" as a person who is permitted to receive and use personal information from an agency in a manner authorized under the act.

 

C.S.S.B. 15 makes a person who discloses for compensation to a person who is not an authorized recipient personal information obtained by an agency in connection with a motor vehicle record liable to the person who is the subject of the information for certain damages and court costs. The bill authorizes a person whose personal information has been disclosed for compensation to a person who is not an authorized recipient to sue for those damages, costs, and fees and for injunctive relief and any other equitable remedy determined to be appropriate by the court. A district court has exclusive original jurisdiction over such a cause of action.

 

C.S.S.B. 15 prohibits a person who receives personal information from an authorized recipient who rediscloses the information in any manner from redisclosing that information, including for compensation, to a person who is not an authorized recipient. The bill requires an authorized recipient to notify each person who receives personal information from the authorized recipient that the person may not redisclose that information to a person who is not an authorized recipient. The bill increases the maximum fine for a person who unlawfully rediscloses the information from $25,000 to $100,000.

 

C.S.S.B. 15 requires an agency that provides a requestor access to personal information in motor vehicle records in bulk under a contract to include the following in the contract:

·         a requirement that the requestor post a performance bond in a maximum amount of $1 million;

·         a prohibition on the sale or redisclosure of the personal information for the purpose of marketing extended vehicle warranties by telephone;

·         a requirement that the requestor provide proof of general liability and cyber-threat insurance coverage in a specified amount;

·         a requirement that the requestor notify the agency of a breach of system security that includes the personal information not later than 48 hours after the discovery of the breach;

·         a requirement that the requestor include in each contract with a third party that receives the personal information that the third party must comply with federal and state laws regarding the records;

·         a requirement that the requestor and any third party receiving the personal information protect the information with appropriate and accepted industry standard security measures for the type of information and the known risks from unauthorized access and use of the information; and

·         a requirement that the requestor annually provide to the agency a report of all third parties to which the personal information was disclosed and the purpose of the disclosure.

The bill requires an agency that discloses any motor vehicle records in bulk to include in the records at least two records that are created solely for the purpose of monitoring compliance with the act and detecting potential violations of the act or the required contract terms. The bill requires the agency to designate an employee to be responsible for monitoring compliance, referring potential violations to law enforcement agencies, and making recommendations to the appropriate agency administrator on the eligibility of a person to receive personal information. The bill authorizes an agency, if the agency determines that a person has violated a term of a disclosure contract with the agency under the act, to cease disclosing personal information to that person and to allow the person to remedy the violation and resume receiving personal information. This authorization does not affect any rights or remedies available under a contract or any other law.

 

C.S.S.B. 15 revises the ineligibility of a person to receive personal information under the act by making a person who is convicted of an offense under the act or who is determined in a civil action to have violated the act or an agency rule relating to the terms or conditions for a release of personal information ineligible to receive personal information under the act. The bill requires such an ineligible person, not later than one year after the date of conviction or of the court's final determination of a violation, to delete from the person's records all information received under the act and prohibits the person from redisclosing any personal information received under the act. The bill creates a misdemeanor offense punishable by a fine capped at $100,000 for a person who violates these ineligibility provisions.

 

C.S.S.B. 15 prohibits the Texas Department of Transportation (TxDOT) from disclosing to any person under any circumstances certain identifying information of a person who is a current or former subscriber to "Texas Highways" or who has purchased a promotional item from TxDOT. The bill creates a Class C misdemeanor offense for a person, including an inspector or inspection station, that discloses or sells information collected in relation to the compulsory vehicle inspection program about a unique customer or a unique vehicle owner to a person other than DPS or the person who is the subject of the information, including a customer or vehicle owner's name, address, or phone number.

 

C.S.S.B. 15 amends the Parks and Wildlife Code to prohibit the name and address and a telephone, social security, driver's license, bank account, credit card, or charge card number of a person who purchases customer products, licenses, or services from the Parks and Wildlife Department (TPWD) from being sold, rented, or traded. The bill restricts disclosure by TPWD of statistical data and compilations of such customer information that does not reveal certain identifying information to disclosure under the following conditions:

·         the disclosure is to another governmental body, including a law enforcement entity, as needed to carry out a governmental purpose;

·         the customer that is the subject of the information consents in writing to the specific disclosure; or

·         the information is part of a public record relating to the identification of a vessel or the information may be disclosed from TPWD vessel and outboard motor ownership records.

These provisions expressly do not authorize TPWD to disclose information TPWD is prohibited from disclosing by other law.    

 

C.S.S.B. 15 repeals the following provisions:

·         Section 11.030(d), Parks and Wildlife Code; and

·         Sections 204.011(c) and (d), Transportation Code.

 

EFFECTIVE DATE

 

On passage, or, if the bill does not receive the necessary vote, September 1, 2021.

 

COMPARISON OF SENATE ENGROSSED AND SUBSTITUTE

 

While C.S.S.B. 15 may differ from the engrossed in minor or nonsubstantive ways, the following summarizes the substantial differences between the engrossed and committee substitute versions of the bill.

 

The substitute changes the conduct constituting the offense relating to compulsory vehicle inspection created in the engrossed by specifying that the prohibited disclosure or sale is information collected in relation to the compulsory vehicle inspection program about a unique customer or a unique vehicle owner.

 

The substitute changes the definition in the engrossed of "authorized recipient" from a person who is eligible to receive personal information from an agency in a manner authorized by the act to a person who is permitted to receive and use that information in such a manner. The substitute does not include the definition in the engrossed of "aggregate report." The substitute does not remove the specification of "driver" from the identification number considered personal information under the act.

 

The substitute revises the uses to which the engrossed strictly limited the use of disclosed personal information by doing the following:

·         replacing use by TxDMV, DPS, and TxDOT with use by a government agency;

·         retaining the use by a private person or entity acting on behalf of a government agency in carrying out the functions of the agency;

·         retaining certain limited uses in the normal course of business by a legitimate business or an authorized agent of the business;

·         retaining use in connection with the operation of a toll transportation facility;

·         including use by a provider of services to a motor vehicle manufacturer, dealership, or distributor for motor vehicle market research activities;

·         removing as a condition of use by certain license holders or their authorized agent that the information is obtained from TxDMV in connection with individual transactions; and

·         including use by an employer, principal, general contractor, nonprofit organization, charitable organization, or religious institution to obtain or verify information relating to a person who holds a driver's license or the driving history of a person who holds a driver's license if the person is employed by, works under a contract with, or volunteers for the employer, principal, contractor, organization, or institution.

The substitute does not include a provision present in the engrossed restricting the disclosure by an agency of personal information for use in research or producing statistical reports under certain conditions.

 

The substitute includes the following provisions, all of which were absent from the engrossed:

·         provisions authorizing additional disclosures of personal information obtained by TxDMV in connection with a motor vehicle record; and

·         an authorization for an agency to request that an authorized recipient or other person in possession of disclosed personal information provide certain information for the purpose of determining compliance with the applicable regulations.

 

The substitute does not include a prohibition present in the engrossed against a person selling to a person who is not an authorized recipient personal information obtained by an agency in connection with a motor vehicle record, nor does the substitute include a provision creating a misdemeanor offense for a person who violates that prohibition punishable by a fine capped at $100,000.

 

The engrossed changed the maximum penalty for redisclosing or reselling personal information under the act from $25,000 to $100,000 per record of personal information that is a subject of the violation, whereas the substitute changes the maximum penalty for redisclosing, including redisclosing for compensation, personal information under the act from $25,000 to $100,000.

 

The substitute revises provisions of the engrossed relating to a contract providing access to bulk motor vehicle records by doing the following:

·         specifying that the access applies to personal information in those records;

·         decreasing from $5 million to $1 million the maximum amount of a performance bond that a requestor is required to post;

·         removing the requirement for a disclosing agency to designate a person responsible for recommending or implementing agency enforcement remedies for violations of the act or breach of a contract;

·         requiring a disclosing agency to designate an employee to be responsible for referring potential violations of the act to law enforcement agencies and for making recommendations to the appropriate agency administrator on the eligibility of a person to receive personal information; and

·         setting out authorized actions of an agency on the determination that a person has violated a term of a contract with the agency for the disclosure of personal information.

 

The substitute includes a provision absent from the engrossed making a person who is determined in a civil action to be in violation of the act or an agency rule relating to the terms or conditions for a release of personal information ineligible to receive personal information under the act. The engrossed created an offense for a person who violates ineligibility provisions under the act and capped the penalty for the offense at $100,000 per record of personal information that is a subject of the violation, whereas the substitute caps the penalty for the offense at $100,000.