BUSINESS AND COMMERCE CODE

TITLE 11.  PERSONAL IDENTITY INFORMATION

SUBTITLE A.  IDENTIFYING INFORMATION

CHAPTER 501.  PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY NUMBERS

SUBCHAPTER A.  CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS

Sec. 501.001.  CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED.  (a)  A person, other than a government or a governmental subdivision or agency, may not:
(1)  intentionally communicate or otherwise make available to the public an individual's social security number;
(2)  display an individual's social security number on a card or other device required to access a product or service provided by the person;
(3)  require an individual to transmit the individual's social security number over the Internet unless:
(1)  the Internet connection is secure; or
(2)  the social security number is encrypted;
(4)  require an individual's social security number for access to an Internet website unless a password or unique personal identification number or other authentication device is also required for access; or
(5)  except as provided by Subsection (f), print an individual's social security number on any material sent by mail, unless state or federal law requires that social security number to be included in the material.
(b)  A person using an individual's social security number before January 1, 2005, in a manner prohibited by Subsection (a) may continue that use if:
(1)  the use is continuous; and
(2)  beginning January 1, 2006, the person provides to the individual an annual disclosure stating that, on written request from the individual, the person will stop using the individual's social security number in a manner prohibited by Subsection (a).
(c)  A person, other than a government or a governmental subdivision or agency, may not deny a service to an individual because the individual makes a written request under Subsection (b)(2).
(d)  If a person receives a written request from an individual directing the person to stop using the individual's social security number in a manner prohibited by Subsection (a), the person shall comply with the request not later than the 30th day after the date the request is received.  The person may not impose a fee for complying with the request.
(e)  This section does not apply to:
(1)  the collection, use, or release of a social security number required by state or federal law, including Chapter 552, Government Code;
(2)  the use of a social security number for internal verification or administrative purposes;
(3)  a document that is recorded or required to be open to the public under Chapter 552, Government Code;
(4)  a court record; or
(5)  an institution of higher education if the use of a social security number by the institution is regulated by Chapter 51, Education Code, or another provision of the Education Code.
(f)  Subsection (a)(5) does not apply to an application or form sent by mail, including a document sent:
(1)  as part of an application or enrollment process;
(2)  to establish, amend, or terminate an account, contract, or policy; or
(3)  to confirm the accuracy of a social security number.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 501.002.  CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED; REMEDIES.  (a)  A person may not print an individual's social security number on a card or other device required to access a product or service provided by the person unless the individual has requested in writing that printing.  The person may not require a request for that printing as a condition of receipt of or access to a product or service provided by the person.
(b)  A person who violates this section is liable to this state for a civil penalty in an amount not to exceed $500 for each violation.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this section.
(c)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating this section.
(d)  This section does not apply to:
(1)  the collection, use, or release of a social security number required by state or federal law, including Chapter 552, Government Code; or
(2)  the use of a social security number for internal verification or administrative purposes.
(e)  This section applies to a card or other device issued in connection with an insurance policy only if the policy is delivered, issued for delivery, or renewed on or after March 1, 2005.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

SUBCHAPTER B.  PRIVACY POLICY TO PROTECT SOCIAL SECURITY NUMBERS

Sec. 501.051.  INAPPLICABILITY OF SUBCHAPTER.  This subchapter does not apply to:
(1)  a person who is required to maintain and disseminate a privacy policy under:
(A)  the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6801 to 6809);
(B)  the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. Section 1232g); or
(C)  the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
(2)  a covered entity under rules adopted by the commissioner of insurance relating to insurance consumer health information privacy or insurance consumer financial information privacy;
(3)  a governmental body, as defined by Section 552.003, Government Code, other than a municipally owned utility;
(4)  a person with respect to a loan transaction, if the person is not engaged in the business of making loans; or
(5)  a person subject to Section 901.457, Occupations Code.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by: 
Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. 4.009(a), eff. September 1, 2009.

Sec. 501.052.  PRIVACY POLICY NECESSARY TO REQUIRE DISCLOSURE OF SOCIAL SECURITY NUMBER.  (a)  A person may not require an individual to disclose the individual's social security number to obtain goods or services from or enter into a business transaction with the person unless the person:
(1)  adopts a privacy policy as provided by Subsection (b);
(2)  makes the privacy policy available to the individual; and
(3)  maintains under the privacy policy the confidentiality and security of the social security number disclosed to the person.
(b)  A privacy policy adopted under this section must include:
(1)  how personal information is collected;
(2)  how and when the personal information is used;
(3)  how the personal information is protected;
(4)  who has access to the personal information; and
(5)  the method of disposal of the personal information.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 501.053.  CIVIL PENALTY; INJUNCTION.  (a)  A person who violates Section 501.052(a) is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month during which a violation occurs.  The civil penalty may not be imposed for more than one violation that occurs in a month.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this section.
(b)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating Section 501.052(a).
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

SUBCHAPTER C.  OTHER RESTRICTIONS TO PROTECT DRIVER'S LICENSE AND SOCIAL SECURITY NUMBERS

Sec. 501.101.  USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY.  (a)  A merchant or a third party under contract with a merchant who requires a consumer returning merchandise to provide the consumer's driver's license or social security number may use the number or numbers provided by the consumer solely for identification purposes if the consumer does not have a valid receipt for the item being returned and is seeking a cash, credit, or store credit refund.
(b)  A merchant or a third party under contract with a merchant may not disclose a consumer's driver's license or social security number to any other third party, including a merchant, not involved in the initial transaction.
(c)  A merchant or a third party under contract with a merchant may use a consumer's driver's license or social security number only to monitor, investigate, or prosecute fraudulent return of merchandise.
(d)  A merchant or a third party under contract with a merchant shall destroy or arrange for the destruction of records containing the consumer's driver's license or social security number at the expiration of six months from the date of the last transaction.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 501.1011.  SALES RECEIPT CONTAINING DRIVER'S LICENSE NUMBER PROHIBITED.  A person may not print an individual's driver's license number on a receipt that evidences payment for a sale of goods or services and is provided to the individual.
Added by Acts 2009, 81st Leg., R.S., Ch. 90 (H.B. 523), Sec. 1, eff. January 1, 2010.

Sec. 501.102.  CIVIL PENALTY; INJUNCTION.  (a)  A person who violates Section 501.101 is liable to this state for a civil penalty in an amount not to exceed $500 for each violation.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this subsection.
(a-1)  A person who violates Section 501.1011 is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month in which a violation occurs.  The civil penalty may not be imposed for more than one violation that occurs in a month.  The attorney general or the prosecuting attorney in the county in which the violation occurs may bring an action to recover the civil penalty imposed under this subsection.
(b)  The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating this subchapter.
Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.
Amended by: 
Acts 2009, 81st Leg., R.S., Ch. 90 (H.B. 523), Sec. 2, eff. January 1, 2010.