What Is
What Is Chapter 521 (Texas Breach Notification and Data Security)
Business and Commerce Code chapter 521, the Identity Theft Enforcement and Protection Act (§521.001), is Texas's general data security and breach notification law. Chapter 521 was codified through HB 2278's 2007 nonsubstantive revision, effective April 1, 2009; SB 768 set the current Attorney General notice deadline effective September 1, 2023.
The chapter protects “sensitive personal information”: an individual's first name or first initial and last name in combination with any one or more of a Social Security number, a driver's license or government-issued identification number, or an account or card number with any required code or password that would permit access to the individual's financial account, if the name and the items are not encrypted; or information that identifies an individual and relates to the individual's health, health care, or payment for health care (§521.002(a)(2)). Information lawfully made public by a federal, state, or local government is excluded (§521.002(b)).
A business must implement and maintain reasonable procedures, including corrective action, to protect sensitive personal information collected or maintained in the regular course of business from unlawful use or disclosure (§521.052(a)). It must also destroy customer records containing sensitive personal information in its custody or control that it will not retain, by shredding, erasing, or otherwise making the information unreadable or indecipherable (§521.052(b)). The destruction duty applies to customer records the business will not retain. Section 521.052's protection and destruction duties do not apply to a financial institution as defined by 15 U.S.C. §6809 (§521.052(c)).
A breach of system security is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including encrypted data when the accessor has the key needed to decrypt it. Good-faith acquisition by an employee or agent for the person's purposes is not a breach unless the information is used or disclosed in an unauthorized manner (§521.053(a)). After a qualifying breach, a person conducting business in Texas that owns or licenses computerized data containing sensitive personal information must:
- notify each affected individual without unreasonable delay and no later than 60 days after determining the breach occurred, subject to §521.053(b)'s allowance as necessary to determine the breach's scope and restore the data system's reasonable integrity, and the law-enforcement delay in subsection (d); individual notice goes to anyone whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person (§521.053(b));
- notify the Attorney General on the AG's electronic form, as soon as practicable and no later than 30 days after that determination, if at least 250 Texas residents are affected (§521.053(i)); and
- notify the nationwide consumer reporting agencies without unreasonable delay if more than 10,000 people must be notified at one time (§521.053(h)).
A person that maintains computerized data it does not own or license must notify the owner or license holder immediately after discovering a breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person (§521.053(c)). A person may delay notice at the request of a law enforcement agency that determines notice would impede a criminal investigation, and must give the notice as soon as the agency determines it will not compromise the investigation (§521.053(d)). Notice may be written to the last known address or electronic if provided in accordance with 15 U.S.C. Section 7001, the federal E-SIGN Act (§521.053(e)). Where the cost of notice would exceed $250,000, more than 500,000 persons are affected, or the person lacks sufficient contact information, the notice may instead be given by any one of three alternative methods: email, if the person has email addresses for affected persons, conspicuous website posting, or publication in or broadcast on major statewide media (§521.053(f)).
The Attorney General enforces the chapter. Civil penalties run from $2,000 to $50,000 per violation, and a person who fails to take reasonable action to give timely individual notice owes up to $100 per individual per day, capped at $250,000 per breach (§521.151(a), (a-1)). The chapter gives no private right of action for the notice duty; its separate identity theft prohibition (§521.051) is actionable under the DTPA (§521.152). A related law, chapter 542, limits exemplary damages for businesses that maintain qualifying cybersecurity programs.
Pinpoint: Tex. Bus. & Com. Code ch. 521. Related term: Sensitive personal information (Texas identity-theft and breach law).