BILL ANALYSIS

Senate Research Center	C.S.S.B. 821
88R19162 MCK-D	By: Nichols
	Business & Commerce
	3/30/2023
	Committee Report (Substituted)

AUTHOR'S / SPONSOR'S STATEMENT OF INTENT

S.B. 821 would require the Sunset Advisory Commission to evaluate whether a state agency sells personal data, to whom it is sold, the purpose for which it is sold, the dollar amount the agency receives for the sale, and the statute that authorizes the agency to sell the data. The Sunset Advisory Commission would then recommend prohibiting the practice unless the commission identifies a compelling state interest justifying the sale.

(Original Author's/Sponsor's Statement of Intent)

C.S.S.B. 821 amends current law relating to the review by the Sunset Advisory Commission of the sale of personal data by state agencies.

RULEMAKING AUTHORITY

This bill does not expressly grant any additional rulemaking authority to a state officer, institution, or agency.

SECTION BY SECTION ANALYSIS

SECTION 1. Amends Chapter 325, Government Code, by adding Section 325.0124, as follows:

Sec. 325.0124.  REVIEW OF AGENCY'S SALE OF PERSONAL DATA. (a)� Defines "personal data."

(b) Requires the Sunset Advisory Commission (commission), as part of its review of a state agency, to determine whether the state agency sells personal data the agency possesses. Requires the commission to determine, if the state agency sells personal data:

(1)  to whom the personal data is sold;

(2)  to the extent possible, the purpose for which the personal data is sold;

(3)  the amount the state agency receives for the sale of the personal data; and

(4)  the law that authorizes the state agency to sell the personal data.

(c)  Requires the commission to recommend prohibiting the sale of personal data by a state agency, unless the commission identifies a compelling state or public interest justifying the state agency's authority to sell the personal data. Requires the commission, if the commission recommends continuing the state agency's authority to sell personal data, to make any recommendations it considers necessary to protect the personal data from improper use and dissemination.

SECTION 2. Effective date: September 1, 2023.