BUSINESS AND COMMERCE CODE

TITLE 11.  PERSONAL IDENTITY INFORMATION

SUBTITLE A.  IDENTIFYING INFORMATION

CHAPTER 506.  REIDENTIFICATION OF DEIDENTIFIED INFORMATION

Sec. 506.001.  DEFINITIONS.  In this chapter:
(1)  "Covered information" means deidentified information released by a board, commission, department, or other agency of this state, including an institution of higher education as defined by Section 61.003, Education Code, or a hospital that is maintained or operated by the state.
(2)  "Deidentified information" means information with respect to which the holder of the information has made a good faith effort to remove all personal identifying information or other information that may be used by itself or in combination with other information to identify the subject of the information.  The term includes aggregate statistics, redacted information, information for which random or fictitious alternatives have been substituted for personal identifying information, and information for which personal identifying information has been encrypted and for which the encryption key is maintained by a person otherwise authorized to have access to the information in an identifiable format.
(3)  "Personal identifying information" has the meaning assigned by Section 521.002(a)(1).
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.

Sec. 506.002.  REQUIRED NOTICES.  (a)  An agency of this state shall provide written notice to a person to whom the agency releases deidentified information that the information is deidentified information.
(b)  A person who sells covered information or otherwise receives compensation for the transfer or disclosure of covered information shall provide written notice to the person to whom the information is sold, transferred, or disclosed that the information is deidentified information obtained from an agency of this state.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.

Sec. 506.003.  PROHIBITED ACTS.  (a)  A person may not:
(1)  reidentify or attempt to reidentify personal identifying information about an individual who is the subject of covered information; or
(2)  knowingly disclose or release covered information that was reidentified in violation of this section.
(b)  It is a defense to a civil action or prosecution for a violation of this section that:
(1)  the person:
(A)  was reidentifying the covered information for the purpose of a study or other scholarly research, including performing an evaluation or test of software intended to deidentify information; and
(B)  did not release or publish the names or other information identifying any subjects of the reidentified covered information; or
(2)  the person obtained informed, written consent from the individual who is the subject of the covered information that specifically referenced the information to be reidentified, disclosed, or released, and authorized the reidentification, disclosure, or release of that information.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.

Sec. 506.004.  OFFENSE.  (a)  A person who violates Section 506.003 commits an offense.
(b)  An offense under this section is a Class A misdemeanor.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.

Sec. 506.005.  PRIVATE CAUSE OF ACTION.  A person who violates Section 506.003 is liable to the individual who is the subject of the covered information for statutory damages in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.

Sec. 506.006.  CIVIL PENALTY.  (a)  In addition to other penalties and remedies assessed or recovered under this chapter, a person who violates Section 506.003 is liable to this state for a civil penalty in an amount of not less than $25 or more than $500 for each violation, not to exceed a total amount of $150,000.
(b)  The attorney general may bring an action to recover a civil penalty under this section.
(c)  The attorney general is entitled to recover reasonable expenses incurred in bringing an action under this section, including reasonable attorney's fees, court costs, and investigatory costs.
Added by Acts 2015, 84th Leg., R.S., Ch. 953 (S.B. 1213), Sec. 1, eff. September 1, 2015.