| |
| |
|
|
A BILL TO BE ENTITLED
|
|
|
AN ACT
|
|
|
relating to the notice requirements of a data broker registration |
|
|
statement and Internet website. |
|
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
|
SECTION 1. Section 509.004, Business & Commerce Code, as |
|
|
added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature, |
|
|
Regular Session, 2023, is amended to read as follows: |
|
|
Sec. 509.004. NOTICE ON WEBSITE OR MOBILE APPLICATION. A |
|
|
data broker that maintains an Internet website or mobile |
|
|
application shall post a conspicuous notice on the website or |
|
|
application that: |
|
|
(1) states that the entity maintaining the website or |
|
|
application is a data broker; |
|
|
(2) is clear, not misleading, and readily accessible |
|
|
by the general public, including individuals with a disability; |
|
|
[and] |
|
|
(3) contains language provided by rule of the |
|
|
secretary of state for inclusion in the notice; and |
|
|
(4) informs a consumer how to exercise any consumer |
|
|
rights the consumer may have under Chapter 541. |
|
|
SECTION 2. Section 509.005(b), Business & Commerce Code, as |
|
|
added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature, |
|
|
Regular Session, 2023, is amended to read as follows: |
|
|
(b) The registration statement must include: |
|
|
(1) the legal name of the data broker; |
|
|
(2) a contact person and the primary physical address, |
|
|
e-mail address, telephone number, and Internet website address for |
|
|
the data broker; |
|
|
(2-a) a link to a page on the data broker's Internet |
|
|
website that provides consumers with specific instructions, which |
|
|
must be prominently displayed, on how to exercise their consumer |
|
|
rights under Section 541.051, and any other applicable data privacy |
|
|
rights under Chapter 541; |
|
|
(3) a description of the categories of data the data |
|
|
broker processes and transfers; |
|
|
(4) a statement of whether or not the data broker |
|
|
implements a purchaser credentialing process; |
|
|
(5) if the data broker has actual knowledge that the |
|
|
data broker possesses personal data of a known child: |
|
|
(A) a statement detailing the data collection |
|
|
practices, databases, sales activities, and opt-out policies that |
|
|
are applicable to the personal data of a known child; and |
|
|
(B) a statement on how the data broker complies |
|
|
with applicable federal and state law regarding the collection, |
|
|
use, or disclosure of personal data from and about a child on the |
|
|
Internet; and |
|
|
(6) the number of security breaches the data broker |
|
|
has experienced during the year immediately preceding the year in |
|
|
which the registration is filed, and if known, the total number of |
|
|
consumers affected by each breach. |
|
|
SECTION 3. Section 509.005(b), Business & Commerce Code, as |
|
|
amended by this Act, applies only to a registration statement |
|
|
submitted on or after the effective date of this Act. |
|
|
SECTION 4. It is the intent of the 89th Legislature, Regular |
|
|
Session, 2025, that the amendments made by this Act to Sections |
|
|
509.004 and 509.005(b), Business & Commerce Code, be harmonized |
|
|
with another Act of the 89th Legislature, Regular Session, 2025, |
|
|
relating to nonsubstantive additions to and corrections in enacted |
|
|
codes. |
|
|
SECTION 5. This Act takes effect September 1, 2025. |