This website will be unavailable from Thursday, May 30, 2024 at 6:00 p.m. through Monday, June 3, 2024 at 7:00 a.m. due to data center maintenance.

Amend CSSB 841 (Committee Printing) by adding the following appropriately numbered SECTION to the bill and renumbering subsequent SECTIONS accordingly:

SECTION ____. Chapter 33, Penal Code, is amended by adding Section 33.08 to read as follows:

Sec. 33.08. IMPROPER STORAGE OF DATA THAT INCLUDES IDENTIFYING INFORMATION. (a) In this section, "identifying information" has the meaning assigned by Section 32.51.

(b) A person commits an offense if the person negligently stores unencrypted data that includes identifying information for more than 50,000 persons on a computer, computer network, or computer system and negligently fails to protect against a breach of computer security by means of computer software designed to protect against a breach.

(c) An agent, including a high managerial agent, having a responsibility for the hiring or supervision of a person who provides computer services is criminally responsible for the conduct of the actor committing an offense under Subsection (b) to the same extent as if the agent engaged in the conduct.

(d) An offense under this section is:

(1) a Class B misdemeanor if the data included identifying information for less than 500,000 persons;

(2) a Class A misdemeanor if the data included identifying information for more than 500,000 but less than million persons; and

(3) a state jail felony if the data included identifying information for more than one million persons.

(e) It is an affirmative defense to prosecution under Subsection (c) that the agent or high managerial agent employed due diligence to prevent the commission of the offense under Subsection (b).