BILL ANALYSIS

C.S.H.B. 2564

By: McClendon

Technology, Economic Development & Workforce

Committee Report (Substituted)

BACKGROUND AND PURPOSE

Presently, there is confusion about the application and practical effect of amendments made to the Private Security Act by Ch. 906 (H.B. 2833), 80th Legislature, Regular Session, 2007, which placed forensic computer analysts, data recovery specialists, and information technology technicians in the position of needing a private investigator's license in order to work with the electronic data being imaged, recovered, or analyzed from computers. Under the Private Security Act, the definition of an "investigations company" refers to those persons engaged in investigative services as identified in considerable detail under the Occupations Code provisions regarding licensing and duties of investigations companies and security services contractors. As amended in 2007, this statute expanded the definition of a person engaged in investigative services by obtaining or furnishing information or accepting employment to obtain or furnish information, so that investigative services would encompass "information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public."  This ambiguity raised unanswered questions about the need or relevance of treating electronic data recovery, forensic analysis, and maintenance of computers as private investigation work. As a practical matter, access to the hardware which stores electronic data is granted to the computer specialist by the owner of the unit, or in the case of a business, by an authorized agent of the owner. If litigation is pending or contemplated, the rules of civil and criminal procedure and evidence require that there be no spoliation of any data or evidence which could lead to or be discoverable evidence, if not admissible evidence, in a court or administrative proceeding. Data recovery or imaging specialists and forensic data analysts would be engaged by legal counsel to serve as litigation consultants or testifying experts, and would be subject derivatively to the same disciplinary rules and oversight by the tribunal as the attorneys. Therefore, no legal or practical need exists for forensic computer analysts, data recovery specialists, or information technology technicians and repairmen to meet the qualifications to obtain a license as a private investigator, as presently required by the Occupations Code. If, however, a forensic analyst or data recovery specialist chose to augment professional credentials by obtaining a private investigator license, there would be no prohibition against doing so.

C.S.H.B. 2564 prohibits a computer data recovery specialist, computer forensic analyst, or computer technician from analyzing or recovering data contained in a computer without first obtaining a signed statement of ownership of the computer from the person requesting the service and requires the work order statement to be maintained for at least a year and available for inspection. The bill makes failure to comply with the recordkeeping requirements a Class C misdemeanor and makes providing a false statement in a work order a Class A misdemeanor.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.H.B. 2564 amends the Business & Commerce Code to prohibit a computer data recovery specialist, computer forensic analyst, or computer technician, in the course and scope of employment or for a fee, from analyzing or recovering data contained in a computer unless the computer specialist, analyst, or technician or that person's employer has obtained a dated work order that includes a signed statement from the person requesting the service that the facts contained in the work order form are true and correct and that the person requesting the service owns or has the right of possession to the computer, or represents the owner as an authorized agent or attorney, or the data analysis is authorized by a court or a law enforcement agency. The bill makes these provisions inapplicable to a computer owned by the employer of the computer data recovery specialist, computer forensic analyst, or computer technician. The bill creates a Class A misdemeanor offense for providing a materially false statement in a signed work order statement.

C.S.H.B. 2564 requires a computer data recovery specialist, computer forensic analyst, computer technician, or employer who obtains a statement of ownership to maintain the statement for a period of not less than one year, and to make the statement available for inspection on request by a law enforcement agency under a court-ordered subpoena or search warrant. The bill creates a Class C misdemeanor offense for failing to maintain a statement or make it available for inspection as required.

C.S.H.B. 2564 amends the Occupations Code to specify, for purposes of the law governing an investigations company, that "obtaining or furnishing information" does not include obtaining or furnishing computer-based data by a person acting as a computer data recovery specialist or computer forensic analyst, as those terms are defined by this bill, which does not constitute an investigation for purposes of that law and does not require licensing under the Private Security Act. The bill establishes that the repair or maintenance of a computer does not constitute an investigation and does not require licensing if the person performing the repair or maintenance is installing or repairing computer equipment or diagnosing a computer or software problem, and is not furnishing information or securing evidence as an investigations company. The bill establishes that a computer data recovery specialist or computer forensic analyst who engages in an activity described by the law governing an investigations company is not conducting an investigation for the purposes of that law and does not require licensing under the Private Security Act.

C.S.H.B. 2564 defines "computer data recovery specialist," "computer forensic analyst," and "computer technician."

EFFECTIVE DATE

September 1, 2009.

COMPARISON OF ORIGINAL AND SUBSTITUTE

C.S.H.B. 2564 adds a provision not in the original to exempt a computer owned by the employer of a computer data recovery specialist from requirements relating to obtaining a statement of ownership. The substitute differs from the original by adding a computer data recovery specialist to provisions establishing that "obtaining or furnishing information" for purposes of the law governing an investigations company does not include obtaining or furnishing certain computer-based data. The substitute adds a provision not in the original establishing that a computer data recovery specialist or computer forensic analyst who engages in an activity described by the law governing an investigations company is not conducting an investigation for purposes of that law and does not require licensing under the Private Security Act.