By: Kolkhorst S.B. No. 1213

(In the Senate - Filed March 10, 2015; March 17, 2015, read first time and referred to Committee on Business and Commerce; April 8, 2015, reported favorably by the following vote: Yeas 9, Nays 0; April 8, 2015, sent to printer.) Click here to see the committee vote

A BILL TO BE ENTITLED

AN ACT

relating to prohibiting the reidentification of certain deidentified information and the release of any reidentified information; creating a criminal offense.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subtitle A, Title 11, Business & Commerce Code, is amended by adding Chapter 506 to read as follows:

CHAPTER 506. REIDENTIFICATION OF DEIDENTIFIED INFORMATION

Sec. 506.001. DEFINITIONS. In this chapter:

(1) "Deidentified information" means information with respect to which the holder of the information has made a good faith effort to remove all personal identifying information or other information that may be used by itself or in combination with other information to identify the subject of the information. The term includes aggregate statistics, redacted information, information for which random or fictitious alternatives have been substituted for personal identifying information, and information for which personal identifying information has been encrypted and for which the encryption key is maintained by a person otherwise authorized to have access to the information in an identifiable format.

(2) "Personal identifying information" has the meaning assigned by Section 521.002(a)(1).

Sec. 506.0015. APPLICABILITY. This chapter applies only to the release of deidentified information by a board, commission, department, or other agency of this state, including an institution of higher education defined by Section 61.003, Education Code, or a hospital maintained or operated by the state.

Sec. 506.002. PROHIBITED ACTS. (a) A person may not:

(1) reidentify or attempt to reidentify an individual who is the subject of deidentified information; or

(2) disclose or release information the person knows was reidentified in violation of this section.

(b) It is a defense to prosecution under this section that the person:

(1) was reidentifying the information for the purpose of a study or other scholarly research, including performing an evaluation or test of software intended to deidentify information; and

(2) did not release or publish the names or other information identifying any subjects of the reidentified information.

Sec. 506.003. OFFENSE. (a) A person who violates Section 506.002 commits an offense.

(b) An offense under this section is a Class A misdemeanor.

Sec. 506.004. PRIVATE CAUSE OF ACTION. A person who violates Section 506.002 is liable to the individual who is the subject of the information for any damages caused by the reidentification or release of the information.

SECTION 2. The change in law made by this Act applies to conduct that occurs on or after the effective date of this Act. Conduct that occurs before the effective date of this Act is governed by the law in effect on the date the conduct occurred, and the former law is continued in effect for that purpose.

SECTION 3. This Act takes effect September 1, 2015.

* * * * *