By: Nichols, et al. S.B. No. 15
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to the Texas Consumer Privacy Act Phase I; creating
  criminal offenses; increasing the punishment for an existing
  criminal offense.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  This Act may be cited as the Texas Consumer
  Privacy Act Phase I.
         SECTION 2.  Section 11.030, Parks and Wildlife Code, is
  amended by amending Subsections (a) and (c) and adding Subsections
  (e-1), (e-2), and (e-3) to read as follows:
         (a)  The name and address and a telephone, social security,
  driver's license, bank account, credit card, or charge card number
  of a person who purchases customer products, licenses, or services
  from the department may not be disclosed, sold, rented, or traded
  except as authorized under this section or Section 12.0251.
         (c)  The commission by rule shall adopt policies relating to:
               (1)  the release of the customer information; and
               (2)  the use of the customer information by the
  department[; and
               [(3)  the sale of a mailing list consisting of the names
  and addresses of persons who purchase customer products, licenses,
  or services].
         (e-1)  The department may disclose statistical data and
  compilations of customer information described by Subsection (a) if
  the information does not reveal information identifying a specific
  department customer or a department customer's address, telephone
  number, social security number, or driver's license number.
         (e-2)  The department may disclose customer information
  described by Subsection (a):
               (1)  to another governmental body, including a law
  enforcement entity, as needed to carry out a governmental purpose;
               (2)  if the customer that is the subject of the
  information consents in writing to the specific disclosure; or
               (3)  if the information is:
                     (A)  part of a record that is considered to be a
  public record under Section 31.039; or
                     (B)  authorized to be disclosed under Section
  31.0391.
         (e-3)  This section does not authorize the department to
  disclose information the department is prohibited from disclosing
  by other law.
         SECTION 3.  Section 204.011(a), Transportation Code, is
  amended to read as follows:
         (a)  The [Except as provided by this section or a rule
  adopted by the commission under this section, the] department may
  not disclose to any person the name, address, telephone number,
  social security account number, driver's license number, bank
  account number, credit or debit card number, or charge account
  number of a person who:
               (1)  is or has been a subscriber to "Texas Highways"; or
               (2)  has purchased from the department a promotional
  item described by Section 204.009.
         SECTION 4.  Section 521.0475(a), Transportation Code, is
  amended to read as follows:
         (a)  Except as provided by Subsection (b), the department
  shall provide a certified abstract of a complete driving record of a
  license holder, for a fee of $20, to the license holder or a person
  eligible to receive the information under Sections
  730.007(a)(2)(A), (C), and (H) [Sections 730.007(a)(2)(A), (D),
  and (I)].
         SECTION 5.  Section 548.601(a), Transportation Code, is
  amended to read as follows:
         (a)  A person, including an inspector or an inspection
  station, commits an offense if the person:
               (1)  submits information to the department's inspection
  database or issues a vehicle inspection report with knowledge that
  the submission or issuance is in violation of this chapter or rules
  adopted under this chapter;
               (2)  falsely or fraudulently represents to the owner or
  operator of a vehicle that equipment inspected or required to be
  inspected must be repaired, adjusted, or replaced for the vehicle
  to pass an inspection;
               (3)  misrepresents:
                     (A)  material information in an application in
  violation of Section 548.402 or 548.403; or
                     (B)  information filed with the department under
  this chapter or as required by department rule;
               (4)  submits information to the department's inspection
  database or issues a vehicle inspection report:
                     (A)  without authorization to issue the report or
  submit the information; or
                     (B)  without inspecting the vehicle;
               (5)  submits information to the department's inspection
  database indicating that a vehicle has passed the applicable
  inspections or issues a passing vehicle inspection report for a
  vehicle with knowledge that the vehicle has not been repaired,
  adjusted, or corrected after an inspection has shown a repair,
  adjustment, or correction to be necessary;
               (6)  knowingly submits information to the department's
  inspection database or issues a vehicle inspection report:
                     (A)  for a vehicle without conducting an
  inspection of each item required to be inspected; or
                     (B)  for a vehicle that is missing an item
  required to be inspected or that has an item required to be
  inspected that is not in compliance with state law or department
  rules;
               (7)  refuses to allow a vehicle's owner to have a
  qualified person of the owner's choice make a required repair,
  adjustment, or correction;
               (8)  charges for an inspection an amount greater than
  the authorized fee;
               (9)  discloses or sells information about a customer,
  vehicle owner, or vehicle to a person other than the department or
  the person who is the subject of the information, including a
  customer identification number or a customer or vehicle owner's
  name, address, or phone number; or
               (10) [(9)]  performs an act prohibited by or fails to
  perform an act required by this chapter or a rule adopted under this
  chapter.
         SECTION 6.  Section 730.003, Transportation Code, is amended
  by adding Subdivisions (1-a) and (1-b) and amending Subdivision (6)
  to read as follows:
               (1-a)  "Aggregate report" means a report created in
  response to a request for motor vehicle records by combining
  individual motor vehicle records into cross-tabulated subtotals
  using defined geographic zones that are at least as large as a zip
  code but not larger than a county.
               (1-b)  "Authorized recipient" means a person who is
  eligible to receive personal information from an agency in a manner
  authorized by this chapter.
               (6)  "Personal information" means information that
  identifies a person, including an individual's photograph or
  computerized image, social security number, date of birth, [driver]
  identification number, name, address, but not the zip code, e-mail
  address, telephone number, and medical or disability information.  
  The term does not include:
                     (A)  information on vehicle accidents, driving or
  equipment-related violations, or driver's license or registration
  status; or
                     (B)  information contained in an accident report
  prepared under:
                           (i)  Chapter 550; or
                           (ii)  former Section 601.004 before
  September 1, 2017.
         SECTION 7.  Section 730.006, Transportation Code, is amended
  to read as follows:
         Sec. 730.006.  REQUIRED DISCLOSURE WITH CONSENT. Personal
  information obtained by an agency in connection with a motor
  vehicle record shall be disclosed to a requestor who:
               (1)  is the subject of the information; or
               (2)  demonstrates, in such form and manner as the
  agency requires, that the requestor has obtained the written
  consent of the person who is the subject of the information.
         SECTION 8.  The heading to Section 730.007, Transportation
  Code, is amended to read as follows:
         Sec. 730.007.  PERMITTED DISCLOSURES OF CERTAIN PERSONAL
  INFORMATION.
         SECTION 9.  Section 730.007, Transportation Code, is amended
  by amending Subsection (a) and adding Subsection (b-1) to read as
  follows:
         (a)  Personal information obtained by an agency in
  connection with a motor vehicle record may be disclosed to any
  requestor by an agency if the requestor:
               (1)  provides the requestor's name and address and any
  proof of that information required by the agency; and
               (2)  represents that the use of the personal
  information will be strictly limited to:
                     (A)  use by the Texas Department of Motor
  Vehicles, the Department of Public Safety, the Texas Department of
  Transportation, a[:
                           [(i)  a government agency, including any]
  court, or a law enforcement agency, in carrying out its functions;
  [or
                           [(ii)  a private person or entity acting on
  behalf of a government agency in carrying out the functions of the
  agency;]
                     (B)  use in connection with a matter of:
                           (i)  motor vehicle or motor vehicle operator
  safety;
                           (ii)  motor vehicle theft;
                           (iii)  motor vehicle product alterations,
  recalls, or advisories;
                           (iv)  performance monitoring of motor
  vehicles, motor vehicle parts, or motor vehicle dealers; or
                           (v)  [motor vehicle market research
  activities, including survey research; or
                           [(vi)]  removal of nonowner records from the
  original owner records of motor vehicle manufacturers;
                     (C)  [use in the normal course of business by a
  legitimate business or an authorized agent of the business, but
  only:
                           [(i)  to verify the accuracy of personal
  information submitted by the individual to the business or the
  agent of the business; and
                           [(ii)  if the information is not correct, to
  obtain the correct information, for the sole purpose of preventing
  fraud by, pursuing a legal remedy against, or recovering on a debt
  or security interest against the individual;
                     [(D)]  use in conjunction with a civil, criminal,
  administrative, or arbitral proceeding in any court or government
  agency or before any self-regulatory body, including service of
  process, investigation in anticipation of litigation, execution or
  enforcement of a judgment or order, or under an order of any court;
                     (D) [(E)]  use in research or in producing
  statistical reports, but only if the personal information is not
  published, redisclosed, or used to contact any individual;
                     (E) [(F)]  use by an insurer, [or] insurance
  support organization, or [by a] self-insured entity, or an
  authorized agent of an insurer, insurance support organization, or
  self-insured entity [the entity], in connection with claims
  processing or investigation activities, antifraud activities,
  rating, or underwriting;
                     (F) [(G)]  use in providing notice to an owner of
  a vehicle that was towed or impounded and is in the possession of a
  vehicle storage facility;
                     (G) [(H)]  use by a licensed private investigator
  agency or licensed security service for a purpose permitted under
  this section;
                     (H) [(I)]  use by an employer or an agent or
  insurer of the employer to obtain or verify information relating to
  a holder of a commercial driver's license that is required under 49
  U.S.C. Chapter 313;
                     (I) [(J)]  use in connection with the operation of
  a type of transportation project described by Section 370.003
  [private toll transportation facility];
                     (J) [(K)]  use by a consumer reporting agency, as
  defined by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et
  seq.), for a purpose permitted under that Act;
                     (K)  use by a motor vehicle manufacturer,
  dealership, or distributor, or an agent of a motor vehicle
  manufacturer, dealership, or distributor, for motor vehicle market
  research activities, including survey research; or
                     (L)  if the information is obtained from the Texas
  Department of Motor Vehicles in connection with individual
  transactions, use in the ordinary course of business by a person or
  authorized agent of a person who:
                           (i)  holds a salvage vehicle dealer license
  issued under Chapter 2302, Occupations Code;
                           (ii)  holds an independent motor vehicle
  dealer or wholesale motor vehicle auction general distinguishing
  number issued under Chapter 503 of this code;
                           (iii)  holds a used automotive parts
  recycler license issued under Chapter 2309, Occupations Code; or
                           (iv)  is licensed by, registered with, or
  subject to regulatory oversight by the Texas Department of Motor
  Vehicles, the Texas Department of Banking, the Department of
  Savings and Mortgage Lending, the Credit Union Department, the
  Office of Consumer Credit Commissioner, the Texas Department of
  Insurance, the Board of Governors of the Federal Reserve System,
  the Office of the Comptroller of the Currency, the Federal Deposit
  Insurance Corporation, or the National Credit Union Administration
                     [(L)  use for any other purpose specifically
  authorized by law that relates to the operation of a motor vehicle
  or to public safety].
         (b-1)  Any agency may disclose personal information
  requested under Subsection (a)(2)(D) only in the form of an
  aggregate report.
         SECTION 10.  Chapter 730, Transportation Code, is amended by
  adding Sections 730.0121, 730.0122, and 730.0123 to read as
  follows:
         Sec. 730.0121.  DELETION OF INFORMATION REQUIRED IF NOT
  AUTHORIZED RECIPIENT. An agency by rule shall require a requestor
  to delete from the requestor's records personal information
  received from the agency under this chapter if the requestor
  becomes aware that the requestor is not an authorized recipient of
  that information. 
         Sec. 730.0122.  SALE PROHIBITED. (a) A person may not sell
  to a person who is not an authorized recipient personal information
  obtained by an agency in connection with a motor vehicle record.
         (b)  A person commits an offense if the person violates
  Subsection (a).  An offense under this subsection is a misdemeanor
  punishable by a fine not to exceed $100,000.
         Sec. 730.0123.  CIVIL SUIT. (a) A person who sells to a
  person who is not an authorized recipient personal information
  obtained by an agency in connection with a motor vehicle record is
  liable to the person who is the subject of the information for:
               (1)  actual damages;
               (2)  if the actual damages to the person are less than
  $2,500, an additional amount so that the total amount of damages
  equals $2,500; and
               (3)  court costs incurred by the person who is the
  subject of the information in bringing the action.
         (b)  A person whose personal information has been sold to a
  person who is not an authorized recipient may sue for:
               (1)  the damages, costs, and fees authorized under
  Subsection (a);
               (2)  injunctive relief; and
               (3)  any other equitable remedy determined to be
  appropriate by the court.
         (c)  A district court has exclusive original jurisdiction
  over a cause of action brought under this section.
         SECTION 11.  Section 730.013, Transportation Code, is
  amended to read as follows:
         Sec. 730.013.  [RESALE OR] REDISCLOSURE; OFFENSE. (a) An
  authorized recipient of personal information may not [resell or]
  redisclose the personal information in the identical or a
  substantially identical format the personal information was
  disclosed to the recipient by the applicable agency.
         (b)  An authorized recipient of personal information may
  [resell or] redisclose the information only for a use permitted
  under Section 730.007.
         (c)  An [Any] authorized recipient who [resells or]
  rediscloses personal information obtained from an agency shall be
  required by that agency to:
               (1)  maintain for a period of not less than five years
  records as to any person or entity receiving that information and
  the permitted use for which it was obtained; and
               (2)  provide copies of those records to the agency on
  request.
         (c-1)  A person who receives personal information from an
  authorized recipient may not redisclose the personal information to
  a person who is not an authorized recipient.
         (c-2)  An authorized recipient shall notify each person who
  receives personal information from the authorized recipient that
  the person may not redisclose the personal information to a person
  who is not an authorized recipient.
         (d)  A person commits an offense if the person violates this
  section.  An offense under this subsection is a misdemeanor
  punishable by a fine not to exceed $100,000 per record of personal
  information that is a subject of the violation [$25,000].
         SECTION 12.  The heading to Section 730.014, Transportation
  Code, is amended to read as follows:
         Sec. 730.014.  AGENCY RULES,[; ORGANIZATION OF] RECORDS, AND
  CONTRACTS.
         SECTION 13.  Section 730.014, Transportation Code, is
  amended by adding Subsections (c), (d), and (e) to read as follows:
         (c)  An agency that provides a requestor access to motor
  vehicle records in bulk under a contract under Section 730.007
  shall include in the contract:
               (1)  a requirement that the requestor post a
  performance bond in an amount of not more than $5 million;
               (2)  a prohibition on the sale or redisclosure of the
  personal information for the purpose of marketing extended vehicle
  warranties by telephone;
               (3)  a requirement that the requestor provide proof of
  general liability and cyber-threat insurance coverage in an amount
  specified by the contracting agency that is:
                     (A)  at least $3 million; and
                     (B)  reasonably related to the risks associated
  with unauthorized access and use of the records;
               (4)  a requirement that if a requestor experiences a
  breach of system security, as defined by Section 521.053, Business &
  Commerce Code, that includes data obtained under Section 730.007,
  the requestor must notify the agency of the breach not later than 48
  hours after the discovery of the breach;
               (5)  a requirement that the requestor include in each
  contract with a third party that receives the records from the
  requestor that the third party must comply with federal and state
  laws regarding the records;
               (6)  a requirement that the requestor and any third
  party receiving the records from the requestor protect the records
  with appropriate and accepted industry standard security measures
  for the type of record and the known risks from unauthorized access
  and use of the records; and
               (7)  a requirement that the requestor annually provide
  to the agency a report of all third parties to which the records
  were disclosed under this section and the purpose of the
  disclosure.
         (d)  An agency that discloses any motor vehicle records in
  bulk under Section 730.007 shall include in the records at least two
  records that are created solely for the purpose of monitoring
  compliance with this chapter and detecting, by receipt of certain
  forms of communications or actions directed at the subjects of the
  created records, potential violations of this chapter or contract
  terms required by this section.
         (e)  An agency that discloses motor vehicle records shall
  designate a person responsible for:
               (1)  monitoring compliance with this chapter and
  contract terms required by this section; and
               (2)  recommending or implementing agency enforcement
  remedies for violations of this chapter or breach of a contract
  described by this section.
         SECTION 14.  The heading to Section 730.016, Transportation
  Code, is amended to read as follows:
         Sec. 730.016.  INELIGIBILITY OF CERTAIN PERSONS TO RECEIVE,
  RETAIN, OR REDISCLOSE PERSONAL INFORMATION; OFFENSE.
         SECTION 15.  Section 730.016, Transportation Code, is
  amended by amending Subsection (a) and adding Subsection (c) to
  read as follows:
         (a)  A person who is convicted of an offense under this
  chapter, or who violates a rule adopted by an agency relating to the
  terms or conditions for a release of personal information to the
  person:
               (1)  [,] is ineligible to receive personal information
  under Section 730.007;
               (2)  not later than one year after the date of
  conviction or of the agency's final determination of a rule
  violation, shall delete from the person's records all personal
  information received under this chapter; and
               (3)  may not redisclose personal information received
  under this chapter.
         (c)  A person commits an offense if the person violates this
  section.  An offense under this subsection is a misdemeanor
  punishable by a fine not to exceed $100,000 per record of personal
  information that is a subject of the violation.
         SECTION 16.  The following provisions are repealed:
               (1)  Section 11.030(d), Parks and Wildlife Code; and
               (2)  Sections 204.011(c) and (d), Transportation Code.
         SECTION 17.  The changes in law made by this Act apply only
  to an offense committed on or after the effective date of this Act.
  An offense committed before the effective date of this Act is
  governed by the law in effect on the date the offense was committed,
  and the former law is continued in effect for that purpose. For
  purposes of this section, an offense was committed before the
  effective date of this Act if any element of the offense occurred
  before that date.
         SECTION 18.  (a) Section 730.0121, Transportation Code, as
  added by this Act, applies to a person who received personal
  information under Chapter 730, Transportation Code, before the
  effective date of this Act, and is not an authorized recipient of
  that personal information under Chapter 730, Transportation Code,
  as amended by this Act.
         (b)  Notwithstanding Subsection (a) of this section, an
  agency to which Section 730.0121, Transportation Code, as added by
  this Act, applies may not require a person who received personal
  information from the agency before the effective date of this Act
  and is not an authorized recipient, as defined by Section
  730.003(1-b), Transportation Code, as added by this Act, of that
  information to delete the information before the first anniversary
  of the effective date of this Act.
         SECTION 19.  This Act takes effect immediately if it
  receives a vote of two-thirds of all the members elected to each
  house, as provided by Section 39, Article III, Texas Constitution.  
  If this Act does not receive the vote necessary for immediate
  effect, this Act takes effect September 1, 2021.