79R1024 CLG-D

By:  Zaffirini                                                    S.B. No. 327

relating to the unauthorized collection and transmission of certain information by computer; providing a penalty. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: SECTION 1. Title 4, Business & Commerce Code, is amended by adding Chapter 48 to read as follows:
Sec. 48.001. DEFINITIONS. In this chapter: (1) "Authorized user" with respect to a computer means a person who: (A) owns the computer; or (B) is authorized by the owner to use or exercise control over the computer. (2) "Keylogging program" means a computer program that: (A) is installed on a computer without the knowledge of an authorized user of the computer; and (B) transmits electronic communications displaying all of the keystrokes made by a person using the computer to another person. (3) "Spyware" means an executable computer program, including a keylogging program, that automatically and without the knowledge or control of a person using a computer collects and transmits to another person: (A) information about the person using the computer, including the person's identifying information; or (B) information regarding the use of a computer, including which Internet sites are visited by a person using the computer. (4) "Identifying information" has the meaning assigned by Section 32.51, Penal Code. Sec. 48.002. PROVISION OF SPYWARE; CONSENT OR NOTICE REQUIRED. (a) If a person is not, or does not have the effective consent of, an authorized user of the computer, a person may not install, copy, download, or provide for downloading spyware to a computer in this state unless: (1) the person provides a clear and conspicuous notice to an authorized user of the computer who is 18 years of age or older that: (A) appears set out from any electronic window or form visible on the computer; (B) states that spyware is being installed on, copied to, or downloaded to the computer, as appropriate; (C) describes the type of information that is being collected and the name and address of the other person to whom the information is being transmitted; and (D) describes how the spyware is intended to affect the performance or operation of the computer; and (2) the person provides a method by which the authorized user of the computer can: (A) quickly and easily disable and remove the spyware from the computer without affecting the performance or operation of the computer; and (B) if spyware is being installed, refuse the installation and require that no further contact be made regarding the installation. (b) For purposes of Subsection (a), a person is considered to provide spyware for downloading to a computer if: (1) the person provides the spyware as an individual product; or (2) the spyware is bundled as a component of another computer program provided or made available by the person, regardless of whether that program can be downloaded from the Internet. (c) The notice required by Subsection (a) must be provided during the initial execution, start-up, installation, download, configuration, or operation of the computer, as appropriate. Sec. 48.003. CIVIL PENALTY. (a) A person who violates this chapter is liable to the state for a civil penalty not to exceed $1,000 for each violation. (b) The attorney general or the prosecuting attorney in the county in which a violation occurs may: (1) bring suit to recover the civil penalty imposed under Subsection (a); or (2) seek an injunction to prevent or restrain a violation of this chapter. (c) The attorney general or the prosecuting attorney may recover reasonable expenses incurred in obtaining a civil penalty under this section, including court costs and reasonable attorney's fees. Sec. 48.004. APPLICABILITY OF CHAPTER. This chapter does not apply to a person who makes available to an authorized user of a computer software that is: (1) installed on, copied to, or downloaded to a computer solely to diagnose or resolve technical difficulties; (2) intended solely to facilitate ordinary and expected access to and use of the computer; or (3) considered reasonably necessary for any legitimate law enforcement purpose as authorized by law. SECTION 2. A civil penalty for a violation of Section 48.002, Business & Commerce Code, as added by this Act, may be imposed only for a violation that occurs on or after January 1, 2006. SECTION 3. This Act takes effect September 1, 2005.