- The categories of personal data processed by the controller, including the processing of any sensitive data;
- The purpose for processing personal data;
- The categories of personal data the controller shares with third parties (if applicable);
- The categories of third parties with whom the controller shares personal data (if applicable); and
- A description of the methods required for a consumer to submit a request to exercise their rights under the TDPSA, and how consumers may exercise their rights, including their appeal rights.
Exemptions
Consistent with most other state data privacy laws, the TDPSA contains entity-level, data-specific, and employment-related exemptions. Additionally, the TDPSA only protects consumers acting in an individual or household capacity, meaning it is also not applicable in business-to-business (B2B) contexts. Other exempted entities and data types are summarized below.
Entity-level exemptions:
- Electric utilities, power generation companies, and retail electric providers;[7]
- Financial institutions subject to Title V of the Gramm-Leach-Bliley Act;
- Covered entities and business associates governed by HIPAA (which would include many professional services firms and cloud service providers);
- State agencies and political subdivisions;
- Nonprofit organizations; and
- Institutions of higher education.
Data-specific exemptions:
- Protected Health Information subject to HIPAA, health records, patient identifying information for the purposes of 42 U.S.C. § 290dd–2, information and documents created for purposes of the Health Care Quality Improvement Act of 1986, patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, or identifiable private information used in connection with human clinical trials and research.
- Information originating from, and "intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section" that is maintained by a HIPAA-covered entity or HIPAA-defined business associate.
- Personal information covered by and/or processed in accordance with the Fair Credit Reporting Act, Driver's Privacy Protection Act, Family Educational Rights and Privacy Act of 1974, the Farm Credit Act of 1971, and several others.
- Personal data processed by a person in the course of a purely personal or household activity.
- Emergency contact information.
Employment-related exemption:
- Data processed or maintained in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent such data is collected and used within the context of that role.
Processing-related exemptions:
The TDPSA does not restrict a controller's or processor's ability to:
- Comply with federal, state, or local laws, rules, or regulations;
- Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons, by federal, state, municipal, or other governmental authorities;
- Protect an interest that is essential for the life or physical safety of the consumer or of another individual and in which the processing cannot be manifestly based on another legal basis;
- Investigate, establish, exercise, prepare for, or defend legal claims;
- Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, and to preserve the integrity or security of systems or investigate, report, or prosecute those responsible for breaches of system security;
- Provide a product or service specifically requested by a consumer;
- Fulfill the terms of a written warranty;
- Conduct internal research to develop, improve, or repair products, services, or technology;
- Effectuate a product recall;
- Identify and repair technical errors that impair existing or intended product functionality; or
- Perform internal operations that are reasonable based on consumer expectations or the consumer relationship, or are compatible with the provision of a requested product or service or the performance of a consumer contract.
Additionally, the statutory requirements imposed on a controller or processor under the TDPSA do not apply if compliance would require violating an evidentiary privilege under Texas law or the disclosure of a trade secret, or "adversely affect[ ] the rights or freedoms of any person, including the right of free speech."
Consent Defined
The TDPSA narrowly defines "consent" as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. The term includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action. The Texas law expressly does not recognize the following as viable forms of consent:
- Acceptance of a general terms of use or similar document containing descriptions of personal data processing in combination with other, unrelated information;
- Hovering over, muting, pausing or closing a given piece of content; or
- Any agreement obtained via "dark patterns."[8]
Biometric Data
Like other state privacy laws, the TDPSA defines the term "biometric data" as data generated by automatic measurements of an individual's biological characteristics, such as fingerprint, voiceprint, eye retina or iris, or other unique biological patterns or characteristics (perhaps including "faceprints," although they are not mentioned explicitly). The term expressly excludes physical and digital photographs as well as video or audio recordings, and any data generated therefrom. This exclusion is similar to ones found in other state privacy laws' definitions of biometric data. However, this exclusion distinguishes the TDPSA from the Illinois biometrics law,[9] which, while generally exempting photographs and video and audio recordings, applies to scans of facial geometry created from photographs.[10] Biometric data is characterized as "sensitive data" under the TDPSA (see below) only when "processed for the purpose of uniquely identifying an individual."
Sensitive Data
Like most other state privacy laws, the TDPSA prohibits businesses from collecting and processing "sensitive data" without obtaining the consumer's consent (or the parent's consent if under 13). The TDPSA defines "sensitive data" as personal data revealing:
- Racial or ethnic origin;
- Religious beliefs;
- Mental or physical health diagnosis;
- Sexual orientation; or
- Citizenship and immigration status; and also includes:
- Genetic and biometric data that is processed to uniquely identify an individual;
- Precise geolocation data (location within a radius of 1,750 feet); and
- Personal data collected from a known child (i.e., someone under the age of 13).
As noted above, if the sensitive data pertains to a known child, compliance with the COPPA (verifiable parental consent) is required.
Definition of "Sale"
The TDPSA defines "sale of personal data" as the "sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party." As a result, the Texas definition tracks with California's broader definition of "sale," as compared to the narrower definition under Virginia's privacy law, which only applies to disclosures of personal data "for monetary consideration" and not "other valuable" consideration.
TDPSA's definition of a "sale" excludes any disclosure to an affiliate of the controller, the controller's processor, for the purpose of providing a requested product or service, in a merger or acquisition of the controller's business or assets, or of information that the consumer intentionally made public via mass media.
Consumer Rights
As with other state privacy laws, the TDPSA provides consumers the right to confirm the processing of and obtain access to the consumer's personal data; request that a controller correct inaccuracies in the consumer's personal data; delete personal data about the consumer; and if available in digital format, obtain a copy of the data "the consumer previously provided to the controller" in a portable and readily usable format "that allows the consumer to transmit the data to another controller without hindrance."
The TDPSA requires covered businesses to establish two or more secure and accessible methods (through the website or by email in specified circumstances) for consumers to submit authenticated requests to exercise their rights with respect to their personal data. Responses to consumer requests are due within 45 days of receipt, subject to a 45-day extension, when reasonably necessary. Controllers must provide information in response to a consumer's request "at least twice annually per consumer" and free of charge, unless the request is "manifestly unfounded, excessive, or repetitive."
The TDPSA also provides that any provision of a contract or agreement that waives or limits consumer rights is void and unenforceable.
Data Protection Assessments
The TDPSA requires controllers to conduct and document data protection assessments for certain types of processing that pose heightened risks to consumers. The assessments must identify and weigh the benefits of the processing to the controller, consumer, other stakeholders, and the public, against the potential risks to the consumer (while also taking into consideration any mitigating safeguards that could reduce those risks).[11] The categories that require assessments are identical to those required by Connecticut's privacy law, including:
- Processing personal data for targeted advertising;
- The sale of personal data;
- Processing personal data for profiling consumers, if such profiling presents a reasonably foreseeable risk to consumers of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury, physical or other intrusion upon seclusion of private affairs, or "other substantial injury";
- Processing of sensitive data; and
- Any processing activities involving personal data that present a "heightened risk of harm to consumers."
Data protection assessments conducted to comply with comparable requirements of other laws or regulations (such as other states' privacy laws) will satisfy the requirements of the TDPSA. Data protection assessments must cover processing activities occurring only after the law's effective date and do not need to be retroactive (some state privacy laws require such assessments to cover processing activities occurring for a period prior to the law's effective date).
Data Governance Principles
The TDPSA incorporates data governance principles, including purpose limitation and reasonable security practices. Furthermore, controllers are prohibited from collecting additional categories of personal information or using collected information for additional purposes, unless they've obtained a consumer's consent.
Processor Contracts
The TDPSA uses a controller-processor framework and requires that controllers and processors—those that process personal data on a controller's behalf—enter into agreements that include terms that are standard under other state privacy laws, including clear instructions for processing data, the nature and purpose of processing, the type of data processed, the duration of processing, and the rights and obligations of both parties, including confidentiality of personal information, contracts with sub-processors, deletion or return of personal data upon termination of the agreement, and cooperation with reasonable assessments by the controller.
Enforcement – Private Right of Action?
The Texas attorney general has exclusive authority to enforce the TDPSA, though – in contrast to California, Colorado, and Florida – Texas does not provide any rulemaking authority. The Texas attorney general may levy civil penalties of up to $7,500 per violation and seek injunctive relief as well as attorney's fees and other expenses incurred in investigating and bringing an action for violations.
There is no private right of action afforded to consumers for violations under the TDPSA or "any other law."
Cure Period
Before commencing an action to enforce the TDPSA, the Texas attorney general must notify the person of the specific provisions alleged to have been violated. Following that notice, there will be a 30-day "cure" period within which the person can correct the violation. If the violation is cured, no enforcement action can be brought.
To properly "cure" under the TDPSA, the person must provide the attorney general a written statement within the 30-day period that the person: cured the alleged violation; notified the consumer that the consumer's privacy violation was addressed, if the consumer's contact information has been made available to the person; provided supporting documentation to show how the privacy violation was cured; and made changes to internal policies, if necessary, to ensure that no such further violations will occur.
The right to cure has no sunset provision and would remain a permanent part of the law, which is in contrast to states such as Colorado, Connecticut, Montana, and others where the cure period sunsets after a number of years.
Looking Ahead
The TDPSA will go into effect the same time as the recently enacted Florida Digital Bill of Rights (which is actually prior to four other states that recently passed consumer data privacy laws earlier in 2023).
The seven state privacy laws enacted so far in 2023 are slated to go into effect as follows:
- July 1, 2024 – Texas
- July 1, 2024 – Florida
- October 1, 2024 – Montana
- January 1, 2025 – Iowa
- July 1, 2025 – Tennessee
- January 1, 2026 – Indiana
Laws in Oregon and Delaware, if signed as currently presented to their governors, would be effective July 1, 2024, and January 1, 2025, respectively.
DWT's Privacy and Security team regularly counsels clients on how their business practices can comply with state privacy laws. We will continue to monitor the rapid development of other new state and federal privacy laws and regulations.
[1] Section 541.055(e) will give consumers the right to designate an agent for purposes of opting out of processing and using a global opt-out setting on January 1, 2025.
[2] The term "sensitive data" includes personal data revealing an individual's racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed for the purpose of uniquely identifying an individual, personal data collected from a known child, and precise geolocation data. Although biometric data is included within the definition of "sensitive" data, its inclusion is limited to when it is "processed for the purpose of uniquely identifying an individual." If not used for uniquely identifying an individual, it is not "sensitive" data, but still biometric data subject to the data sale notice provision.
[3] "Targeted advertising" means "displaying to a consumer an advertisement that is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests." The term expressly excludes advertising based on a consumer's activities on the controller's website, current search query, website, or online application visit (not limited to "affiliated" websites but not including "activities" on the visited website or application), or in response to a consumer request for information. The term also excludes the "processing of personal data solely for measuring or reporting advertising performance, reach, or frequency."
[4] To properly assess whether a business qualifies as "small" in the eyes of the SBA, an array of tools and assessments can be used. For example, the SBA offers a "Size Standards Tool" utilizing economic activity measurements based on the North American Industrial Classification System (NAICS).
[5] See note 3, above, for the TDPSA's definition of "targeted advertising."
[6] The TDPSA defines a "decision that produces a legal or similarly significant effect concerning the consumer" as "a decision made by the controller that results in the provision or denial by the controller of: (A) financial and lending services; (B) housing, insurance, or health care services; (C) education enrollment; (D) employment opportunities; (E) criminal justice; or (F) access to basic necessities, such as food and water."
[7] As all are defined in Section 31.002 of the Texas Utilities Code.
[8] "Dark Patterns" means a "user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice," as well as any practice designated as such by the Federal Trade Commission.
[9] Biometric Information Privacy Act, 740 ILCS 14/10 (2018).
[10] Sosa v. Onfido, 600 F.Supp.3d 859, 873 (N.D. Ill. 2022); Rivera v. Google, Inc., 238 F.Supp.3d 1088, 1095-1100 (N.D. Ill. 2017).
[11] Items to be considered as mitigating safeguards include the use of deidentified data, the reasonable expectations of consumers, the context of the processing, and the relationship between the controller and the consumer whose personal data will be processed.
