1-1 By: McCall, Wolens, et al. (Senate Sponsor-Duncan) H.B. No. 1922 1-2 (In the Senate - Received from the House April 17, 2001; 1-3 April 18, 2001, read first time and referred to Committee on State 1-4 Affairs; May 7, 2001, reported favorably by the following vote: 1-5 Yeas 7, Nays 0; May 7, 2001, sent to printer.) 1-6 A BILL TO BE ENTITLED 1-7 AN ACT 1-8 relating to state government privacy policy. 1-9 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: 1-10 SECTION 1. Subtitle A, Title 5, Government Code, is amended 1-11 by adding Chapter 559 to read as follows: 1-12 CHAPTER 559. STATE GOVERNMENT PRIVACY POLICIES 1-13 Sec. 559.001. DEFINITION. In this chapter, "state 1-14 governmental body" means a governmental body as defined by Section 1-15 552.003 that is part of state government. 1-16 Sec. 559.002. RIGHT TO BE INFORMED ABOUT INFORMATION 1-17 COLLECTED. It is the policy of this state that an individual is 1-18 entitled to be informed about information that a state governmental 1-19 body collects about the individual unless the state governmental 1-20 body is allowed to withhold the information from the individual 1-21 under Section 552.023. 1-22 Sec. 559.003. RIGHT TO NOTICE ABOUT CERTAIN INFORMATION LAWS 1-23 AND PRACTICES. (a) Each state governmental body that collects 1-24 information about an individual by means of a form that the 1-25 individual completes and files with the governmental body in a 1-26 paper format or in an electronic format on an Internet site shall 1-27 prominently state, on the paper form and prominently post on the 1-28 Internet site in connection with the electronic form, that: 1-29 (1) with few exceptions, the individual is entitled on 1-30 request to be informed about the information that the state 1-31 governmental body collects about the individual; 1-32 (2) under Sections 552.021 and 552.023 of the 1-33 Government Code, the individual is entitled to receive and review 1-34 the information; and 1-35 (3) under Section 559.004 of the Government Code, the 1-36 individual is entitled to have the state governmental body correct 1-37 information about the individual that is incorrect. 1-38 (b) Each state governmental body that collects information 1-39 about an individual by means of an Internet site or that collects 1-40 information about the computer network location or identity of a 1-41 user of the Internet site shall prominently post on the Internet 1-42 site what information is being collected through the site about the 1-43 individual or about the computer network location or identity of a 1-44 user of the site, including what information is being collected by 1-45 means that are not obvious. 1-46 Sec. 559.004. RIGHT TO CORRECTION OF INCORRECT INFORMATION. 1-47 Each state governmental body shall establish a reasonable procedure 1-48 under which an individual is entitled to have the state 1-49 governmental body correct information about the individual that is 1-50 possessed by the state governmental body and that is incorrect. 1-51 The procedure may not unduly burden an individual using the 1-52 procedure. 1-53 Sec. 559.005. APPLICABILITY OF AND CONSTRUCTION WITH PUBLIC 1-54 INFORMATION LAW. (a) Chapter 552 governs the charges that a state 1-55 governmental body may impose on an individual who requests 1-56 information the governmental body collects about the individual. 1-57 The governmental body may not charge an individual to correct 1-58 information about the individual. 1-59 (b) To the extent of a conflict between this chapter and the 1-60 public information law, Chapter 552, Chapter 552 controls. 1-61 SECTION 2. (a) The lieutenant governor and the speaker of 1-62 the house of representatives shall establish a privacy task force 1-63 to study issues related to the information practices of state 1-64 government that affect personal privacy. 2-1 (b) The lieutenant governor and the speaker shall each 2-2 appoint five members to the task force. In making the 2-3 appointments, the lieutenant governor and the speaker shall make an 2-4 effort to ensure that the composition of the task force includes 2-5 members with a demonstrated interest in and knowledge regarding: 2-6 (1) consumer issues; 2-7 (2) business issues; 2-8 (3) issues related to the openness and accessibility 2-9 of government records; and 2-10 (4) issues related to conducting business transactions 2-11 electronically. 2-12 (c) The task force shall elect a presiding officer and 2-13 assistant presiding officer from among its members. 2-14 (d) The task force shall meet: 2-15 (1) as directed by the lieutenant governor and the 2-16 speaker, if applicable; and 2-17 (2) otherwise as determined by the members of the task 2-18 force but not less often than quarterly, beginning not later than 2-19 September 30, 2001. 2-20 (e) A legislative agency shall assist the task force at the 2-21 request of the lieutenant governor or the speaker, and a state 2-22 agency in the executive branch of state government shall assist the 2-23 task force at the request of the task force. 2-24 (f) The task force shall: 2-25 (1) identify the types of personal information about 2-26 individuals that are being collected by state governmental bodies 2-27 and how the information, once collected, is used; 2-28 (2) identify how state governmental bodies disseminate 2-29 personal information about individuals, including the extent to 2-30 which the information is sold or given to commercial enterprises; 2-31 (3) identify existing protections in state law and 2-32 administrative rules against unwarranted disclosure of personal 2-33 information about individuals and recommend legislation or rule 2-34 changes to enhance protections against unwarranted disclosure; 2-35 (4) assess the impact that evolving technologies have 2-36 on the collection, dissemination, and use of personal information 2-37 by state governmental bodies; 2-38 (5) identify the benefits and detriments of 2-39 information sharing among state governmental bodies that collect, 2-40 store, and disseminate information relating to individuals and 2-41 businesses; 2-42 (6) determine the proper role of state government in 2-43 the context of federal law and federal regulations in establishing 2-44 statutory and regulatory privacy protections; 2-45 (7) recommend steps to ensure that personal 2-46 information transmitted to, by, or from state governmental bodies 2-47 in an electronic format is adequately encrypted and secured to 2-48 protect individuals' privacy; 2-49 (8) recommend legislation and changes in 2-50 administrative policy governing the collection, storage, and 2-51 transfer of information among and within state governmental bodies; 2-52 (9) recommend legislation under which an individual 2-53 would have the right to be notified if a state governmental body 2-54 proposed to sell personally identifiable information about the 2-55 individual and would have the right to prohibit the sale unless the 2-56 sale was in furtherance of the statutory duties of the state 2-57 governmental body; and 2-58 (10) assess and analyze federal laws, regulations, and 2-59 practices that affect, may affect, or could serve as a model for 2-60 state government or commercial privacy practices and recommend 2-61 legislation based on its assessment and analysis. 2-62 (g) The task force shall report the results of its study and 2-63 its recommendations to the lieutenant governor and the speaker by 2-64 September 1, 2002. 2-65 (h) Unless continued in existence at the direction of the 2-66 lieutenant governor and the speaker, the task force is abolished 2-67 and this section expires September 1, 2003. 2-68 SECTION 3. Each state governmental body must be in compliance 2-69 with Chapter 559, Government Code, as added by this Act, before 3-1 January 1, 2002. 3-2 SECTION 4. This Act takes effect September 1, 2001. 3-3 * * * * *