Key Provisions of the Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act (TDPSA) is a comprehensive consumer data privacy law that was passed by the Texas legislature in May 2023 and signed into law by Governor Greg Abbott on June 16, 2023. The TDPSA will take effect on July 1, 2024.
The TDPSA applies to businesses that control or process the personal data of 50,000 or more consumers in a calendar year, or that control or process the personal data of 100,000 or more consumers in a calendar year if they are located in Texas or target their services to Texas consumers.
The TDPSA gives consumers certain rights, including the right to:
· Request access to their personal data
· Request that their personal data be corrected or deleted
· Opt out of the sale of their personal data
· Opt out of targeted advertising
The TDPSA requires businesses to take certain steps to protect the privacy and security of personal data, including:
· Conducting data protection assessments
· Implementing reasonable security measures
· Notifying consumers of data breaches
Key Provisions of the TDPSA
The TDPSA defines personal data as any information that can be used to identify an individual, including but not limited to their name, address, phone number, email address, social security number, and online identifiers.
The TDPSA defines sensitive personal data as personal data that reveals an individual's:
· Race or ethnicity
· Mental or physical health condition
· Sexual orientation
· Citizenship or immigration status
· Genetic or biometric data
· Children's data
· Precise geolocation data
The TDPSA requires businesses to obtain consent from consumers before selling their personal data or using their personal data for certain purposes, such as targeted advertising.
The TDPSA also requires businesses to conduct data protection assessments for certain processing activities, such as the sale of personal data, targeted advertising, and profiling.
The TDPSA requires businesses to implement reasonable security measures to protect personal data.
The TDPSA requires businesses to notify consumers of data breaches that are likely to result in harm to consumers.
The TDPSA is still a relatively new law, and it is not yet clear how it will be interpreted and enforced by the Texas Attorney General. However, the TDPSA is a significant piece of legislation, and it is likely to have a major impact on businesses that collect and process the personal data of Texas residents.
The TDPSA is a complex law, and its provisions have many nuances. If you are a business subject to the TDPSA, it is important to consult with an attorney to ensure that you comply with the law.