85R9050 TSR-F

By: Elkins H.B. No. 2333

A BILL TO BE ENTITLED

AN ACT

relating to a breach of system security of a business that exposes consumer credit card or debit card information; providing a civil penalty.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 521.053(a), Business & Commerce Code, is amended to read as follows:

(a) In this section, "breach of system security" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information, credit card information, or debit card information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data. Good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.

SECTION 2. Subchapter B, Chapter 521, Business & Commerce Code, is amended by adding Sections 521.054 and 521.055 to read as follows:

Sec. 521.054. BREACH INVOLVING CREDIT CARD OR DEBIT CARD INFORMATION. (a) A business that accepts a credit card or debit card for payment and retains any data related to the card other than a confirmation number for the transaction shall secure the retained information from a breach of system security, as defined by Section 521.053.

(b) If a breach of system security occurs in which credit card or debit card information is compromised, the business shall:

(1) not more than 24 hours after the business discovers or receives notification of the breach of system security, send notice of the breach to the attorney general; and

(2) as soon as practicable after the business discovers or receives notification of the breach of system security, send notice of the breach to each financial institution that issued a credit or debit card affected by the breach.

Sec. 521.055. DATA SECURITY BREACH VICTIM COMPENSATION FUND. (a) The data security breach victim compensation fund is created as a dedicated account in the general revenue fund.

(b) The fund consists of money collected under Section 521.1515.

(c) Money in the fund may be appropriated only to the attorney general to:

(1) pay claims to consumers who have suffered financial loss in relation to a breach of system security under Section 521.054; and

(2) reimburse a financial institution for costs associated with a breach of system security under Section 521.054.

(d) The office of the attorney general shall develop a claims process to make payments from the fund in accordance with Subsection (c).

SECTION 3. Subchapter D, Chapter 521, Business & Commerce Code, is amended by adding Section 521.1515 to read as follows:

Sec. 521.1515. ADDITIONAL CIVIL PENALTY. (a) In addition to penalties assessed under Section 521.151, a business that fails to secure the business's computer system and suffers a breach of system security described by Section 521.054 is liable to this state for a civil penalty of $50 for each credit card and debit card from which information was compromised.

(b) The attorney general may bring an action to recover a civil penalty under this section. Amounts collected by the attorney general under this section shall be deposited to the credit of the data security breach victim compensation fund created under Section 521.055 and may be appropriated only as provided by that section.

SECTION 4. The changes in law made by this Act apply only to a breach of system security that occurs on or after the effective date of this Act. A breach of system security that occurs before the effective date of this Act is governed by the law in effect at the time the breach occurred, and that law is continued in effect for that purpose.

SECTION 5. This Act takes effect September 1, 2017.