|
|
A BILL TO BE ENTITLED
|
|
AN ACT
|
|
relating to prohibiting the reidentification of certain |
|
deidentified information and the release of any reidentified |
|
information; creating a criminal offense. |
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
SECTION 1. Subtitle A, Title 11, Business & Commerce Code, |
|
is amended by adding Chapter 506 to read as follows: |
|
CHAPTER 506. REIDENTIFICATION OF DEIDENTIFIED INFORMATION |
|
Sec. 506.001. DEFINITIONS. In this chapter: |
|
(1) "Deidentified information" means information with |
|
respect to which the holder of the information has made a good faith |
|
effort to remove all personal identifying information or other |
|
information that may be used by itself or in combination with other |
|
information to identify the subject of the information. The term |
|
includes aggregate statistics, redacted information, information |
|
for which random or fictitious alternatives have been substituted |
|
for personal identifying information, and information for which |
|
personal identifying information has been encrypted and for which |
|
the encryption key is maintained by a person otherwise authorized |
|
to have access to the information in an identifiable format. |
|
(2) "Personal identifying information" has the |
|
meaning assigned by Section 521.002(a)(1). |
|
Sec. 506.0015. APPLICABILITY. This chapter applies only to |
|
the release of deidentified information by a board, commission, |
|
department, or other agency of this state, including an institution |
|
of higher education defined by Section 61.003, Education Code, or a |
|
hospital maintained or operated by the state. |
|
Sec. 506.002. PROHIBITED ACTS. (a) A person may not: |
|
(1) reidentify or attempt to reidentify an individual |
|
who is the subject of deidentified information; or |
|
(2) disclose or release information the person knows |
|
was reidentified in violation of this section. |
|
(b) It is a defense to prosecution under this section that |
|
the person: |
|
(1) was reidentifying the information for the purpose |
|
of a study or other scholarly research, including performing an |
|
evaluation or test of software intended to deidentify information; |
|
and |
|
(2) did not release or publish the names or other |
|
information identifying any subjects of the reidentified |
|
information. |
|
Sec. 506.003. OFFENSE. (a) A person who violates Section |
|
506.002 commits an offense. |
|
(b) An offense under this section is a Class A misdemeanor. |
|
Sec. 506.004. PRIVATE CAUSE OF ACTION. A person who |
|
violates Section 506.002 is liable to the individual who is the |
|
subject of the information for any damages caused by the |
|
reidentification or release of the information. |
|
SECTION 2. The change in law made by this Act applies to |
|
conduct that occurs on or after the effective date of this Act. |
|
Conduct that occurs before the effective date of this Act is |
|
governed by the law in effect on the date the conduct occurred, and |
|
the former law is continued in effect for that purpose. |
|
SECTION 3. This Act takes effect September 1, 2015. |