Texas Data Privacy and Security Act: Understanding the New Data Security Landscape

Texas Takes the Wheel on Data Privacy Enforcement

Texas is revving up to become a major player in data privacy enforcement. With the Texas Data Privacy and Security Act (TDPSA) taking effect on July 1, 2024, and Attorney General Ken Paxton establishing a dedicated privacy task force, and businesses that collect consumer data in Texas better buckle up.

Texas Attorney General Gets Serious About Privacy

Paxton’s new task force signals a strong commitment to enforcing Texas’ data privacy laws. This includes the TDPSA, the Capture or Use of Biometric Identifier Act (CUBI), the Data Broker Law, and the Deceptive Trade Practices Act (DTPA) – all aimed at protecting Texans’ data privacy and security.

The task force will focus on “aggressive enforcement,” targeting companies that:

• Collect and sell data without permission
• Cause financial harm to consumers through data practices
• Use artificial intelligence in risky ways

Texas Data Privacy and Security Act: A Look Under the Hood

The TDPSA applies broadly to businesses that “conduct business in Texas” or offer products/services to Texans, regardless of company size. Here’s a quick rundown of key provisions:

• Consumer Rights: Texans gain rights to access, correct, and delete their data, opt-out of sales and targeted advertising, and control how sensitive data is used.
• Consent for Sensitive Data: Businesses need consumer consent to collect sensitive data like race, religion, health information, and precise geolocation.
• Data Security: Businesses must implement strong data security practices to protect consumer information.
• Data Protection Assessments: Businesses need to assess risks associated with targeted advertising, data sales,profiling, and processing sensitive data.
• Universal Opt-Out Mechanisms: By 2025, businesses must recognize opt-out mechanisms like the Global Privacy Control.

What Do Business Need To Do In Order To Comply With The TDPSA Laws?

1. Update your website’s privacy notice:

• Your privacy notice should be clear, concise, and easily accessible on your website. It should explain:
  • The types of personal data you collect from Texans (IP address, cookies, contact forms, etc.)
  • How you use and share that data (analytics, advertising, third-party services)
  • Texan user rights under the TDPSA (access, correction, deletion, opt-out)
  • How users can exercise their rights (dedicated web form, email address)
  • Your data retention policy (how long you store data)

2. Obtain consent for collecting sensitive data:

• For sensitive data like race, religion, health information, or precise geolocation, you need a clear and affirmative opt-in from Texan users. Pre-checked boxes or unclear language don’t constitute valid consent.

3. Implement reasonable data security measures:

• The TDPSA requires “reasonable” data security practices to protect user information. This depends on the type and amount of data you collect. Common measures include:
  • Secure passwords and access controls for your website and databases
  • Encryption of sensitive data
  • Regular security updates and vulnerability assessments for your website
  • Employee training on data privacy practices

4. Establish a process for handling user requests:

• Texan users have the right to access, correct, or delete their personal data. Set up a clear process for them to submit requests (web form, email address). You must respond within a reasonable timeframe (typically 45 days) and may request verification of the user’s identity.

5. Enable opt-out mechanisms for data sales and targeted advertising:

• Provide a clear and easy-to-use opt-out mechanism for Texan users who don’t want their data sold or used for targeted advertising. This could be a link, form, or email address. By January 1, 2025, you’ll also need to recognize universal opt-out mechanisms like the Global Privacy Control.

6. Stay informed and update your practices:

• The TDPSA is a new law, and regulations and interpretations may evolve. Stay informed about updates and adjust your website practices accordingly.

Additional Tips:

• Consider consulting with a lawyer experienced in data privacy laws, especially for complex situations. They can advise on specific compliance steps for your website.
• There are resources available from the Texas Attorney General’s office to help businesses understand the TDPSA.

The Road Ahead: Implications for Businesses

With Texas joining California as a major privacy enforcer, businesses handling consumer data nationwide should take notice. Here’s what it means for you:

• Compliance is Key: Ensure compliance with Texas privacy laws, especially the TDPSA, to avoid penalties.
• Increased Enforcement Activity: Expect more scrutiny from Texas on data practices.
• A Domino Effect? Texas’ stance might inspire other states to ramp up privacy enforcement.

By understanding the Texas privacy landscape and taking proactive steps towards compliance, businesses can navigate the road ahead smoothly and avoid getting pulled over for data privacy violations.

Frequently Asked Questions About The Texas Data Privacy and Security Act

Photo by Daniel Moises Magulado