By:  West                                                         S.B. No. 674
	(In the Senate - Filed February 23, 2005; March 2, 2005, 
read first time and referred to Committee on Business and Commerce; 
April 18, 2005, reported adversely, with favorable Committee 
Substitute by the following vote:  Yeas 9, Nays 0; April 18, 2005, 
sent to printer.)


COMMITTEE SUBSTITUTE FOR S.B. No. 674                                    By:  Lucio


A BILL TO BE ENTITLED

AN ACT


relating to limiting the use of customers' social security numbers 
by persons; providing a civil penalty.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:                        
	SECTION 1.  Subchapter D, Chapter 35, Business & Commerce 
Code, is amended by adding Section 35.62 to read as follows:
	Sec. 35.62.  PROHIBITED ACTS WITH RESPECT TO USE OF 
CUSTOMERS' SOCIAL SECURITY NUMBERS.  (a)  In this section:
		(1)  "Customer" means an individual who has established 
or is attempting to establish an account with a person.
		(2)  "Financial institution" means:                                    
			(A)  a bank, savings association, savings bank, or 
credit union maintaining an office, branch, or agency office in 
this state; and
			(B)  a financial institution as defined by 15 
U.S.C. Sections 6801-6809.
	(b)  A person may not request a customer's social security 
number, or another number that includes four or more consecutive 
digits of a customer's social security number, as an identifier 
unless the number is needed to complete a credit check that is 
required to provide a service or product requested by the customer.
	(c)  A person that requests a customer's number to complete a 
credit check, as provided in Subsection (b), must destroy each 
record of the number by shredding, erasing, or other means after the 
credit check is completed.
	(d)  This section does not apply to:                                    
		(1)  a financial institution;                                          
		(2)  a covered entity as defined by Section 601.001 or 
602.001, Insurance Code;
		(3)  a governmental entity; or                                         
		(4)  a person who is required to maintain and 
disseminate a privacy policy under the Health Insurance Portability 
and Accountability Act of 1996 (Pub. L. No. 104-191).
	(e)  A person that violates this section is liable to the 
state for a civil penalty of $1,000 for each violation.  The 
attorney general or the prosecuting attorney in the county in which 
the violation occurs may bring suit to recover the civil penalty 
imposed under this section.  The attorney general may bring an 
action in the name of the state to restrain or enjoin a business 
from violating this section.
	SECTION 2.  This Act takes effect September 1, 2005.                           



* * * * *