89R9729 SCR-D

By: Blanco S.B. No. 2610

A BILL TO BE ENTITLED

AN ACT

relating to civil liability of business entities in connection with a breach of system security.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subtitle C, Title 11, Business & Commerce Code, is amended by adding Chapter 542 to read as follows:

CHAPTER 542. CYBERSECURITY PROGRAM

Sec. 542.001. DEFINITIONS. In this chapter:

(1) "Breach of system security" has the meaning assigned by Section 521.053.

(2) "Personal identifying information" and "sensitive personal information" have the meanings assigned by Section 521.002.

Sec. 542.002. APPLICABILITY OF CHAPTER. This chapter applies to a business entity in this state that owns or licenses computerized data that includes sensitive personal information.

Sec. 542.003. LIABILITY FOR DATA BREACH. If a business entity fails to implement reasonable cybersecurity controls and that failure results in a breach of system security, the business entity is liable to a person whose sensitive personal information was stolen in the breach and who suffered economic harm as a result of the theft of the information.

Sec. 542.004. INDUSTRY STANDARD CYBERSECURITY PROGRAM. (a) For purposes of Section 542.003, a business entity has implemented reasonable cybersecurity controls if the entity has created and maintained a cybersecurity program:

(1) that contains administrative, technical, and physical safeguards for the protection of personal identifying information and sensitive personal information;

(2) that conforms to an industry recognized cybersecurity framework as described by Subsection (b);

(3) that is designed to:

(A) protect the security of personal identifying information and sensitive personal information;

(B) protect against any threat or hazard to the integrity of personal identifying information and sensitive personal information; and

(C) protect against unauthorized access to or acquisition of personal identifying information and sensitive personal information that would result in a material risk of identity theft or other fraud to the individual to whom the information relates; and

(4) the scale and scope of which meets the requirements of Subsection (d).

(b) A cybersecurity program under this section conforms to an industry recognized cybersecurity framework for purposes of this section if the program conforms to:

(1) a current version of or any combination of current versions of the following, as determined by the Department of Public Safety:

(A) the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology (NIST);

(B) the NIST's special publication 800-171;

(C) the NIST's special publications 800-53 and 800-53a;

(D) the Federal Risk and Authorization Management Program's FedRAMP Security Assessment Framework;

(E) the Center for Internet Security Critical Security Controls for Effective Cyber Defense;

(F) the ISO/IEC 27000-series information security standards published by the International Organization for Standardization and the International Electrotechnical Commission;

(G) the Health Information Trust Alliance's Common Security Framework;

(H) the Secure Controls Framework;

(I) the Service Organization Control Type 2 Framework; or

(J) other similar frameworks or standards of the cybersecurity industry;

(2) if the business entity is subject to its requirements, the current version of the following, as determined by the Department of Public Safety:

(A) the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);

(B) Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.);

(C) the Federal Information Security Modernization Act of 2014 (Pub. L. No. 113-283); or

(D) the Health Information Technology for Economic and Clinical Health Act (Division A, Title XIII, and Division B, Title IV, Pub. L. No. 111-5); and

(3) if applicable to the business entity, a current version of the Payment Card Industry Data Security Standard, as determined by the Department of Public Safety.

(c) If any standard described by Subsection (b)(1) is published and updated, a business entity's cybersecurity program continues to meet the requirements of a program under this section if the entity updates the program to meet the updated standard not later than the 180th day after the date on which the standard is published.

(d) The scale and scope of a cybersecurity program under this section must be based on:

(1) the size and complexity of the business entity;

(2) the nature and scope of the activities of the business entity;

(3) the sensitivity of the personal identifying information or sensitive personal information; and

(4) the cost and availability of tools to improve information security and reduce vulnerabilities.

Sec. 542.005. AUTHORITY OF ATTORNEY GENERAL NOT AFFECTED. This chapter may not be construed to limit the authority of the attorney general to seek any legal or equitable remedy under the laws of this state.

Sec. 542.006. CLASS ACTION CERTIFICATION NOT AFFECTED. This chapter does not affect the certification of an action as a class action.

SECTION 2. Section 542.003, Business & Commerce Code, as added by this Act, applies only to a cause of action that accrues on or after the effective date of this Act.

SECTION 3. This Act takes effect September 1, 2025.