[co-author: Lena Zinner*]
Under the banner of strengthening consumer data protection, Texas is ramping up enforcement of its comprehensive data privacy act, sending a nationwide signal that Texas is serious about safeguarding the personal data of consumers.
Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act (the “Act”), effective as of July 1, 2024, adds protections for consumer personal data, which includes any information that is linked or reasonably linkable to an identified or identifiable individual.[1] Specifically, the Act grants consumers with a set of rights, including to access, correct, delete, and obtain copies of their personal data.[2] It also requires businesses to implement data security measures, limit data collection to necessary information, and provide clear notices about data processing, sales, and targeted advertising, with the ability for consumers to opt out of these activities, among other measures.[3] You can read more about the full scope and requirements of the Act in one of our previous blogs.
Recent Enforcement Activities
Pursuant to the Act, the Texas Attorney General has recently issued violation notices alleging the sharing of sensitive user data without proper notice or consent. These allegations reveal common areas of concern which the Attorney General is targeting, such as:
- Inappropriate Data Sharing: The Texas Attorney General leveled accusations that inappropriate sharing of sensitive user data, such as location and vehicle information, had occurred without sufficiently clear consent from consumers in place. In particular, the Texas Attorney General indicated that such practices could expose consumers to privacy risks without their informed consent.
- Lack of Adequate Consumer Consent: The Texas Attorney General alleged failures to provide consumers with “reasonably clear notice” or processes to obtain a “clear affirmative act” of consumer consent, as required by the Act.
- Deficiencies in Privacy Notice as to Collection of Personal Data: The Texas Attorney General cited failures to inform consumers about the categories of personal data that would be collected, purportedly leaving consumers unaware of the scope and nature of personal information being gathered.
- Deficiencies in Privacy Notices as to Consumer Rights: The Texas Attorney General cited concerns that regulated parties were not providing adequate notice to consumers of their rights under the Act, indirectly limiting consumer control over their personal information.
These enforcement actions underscore the importance of strict compliance with the Act, even if data collection practices are transparently disclosed to consumers, among other measures. Businesses operating in Texas should assess whether the Act applies to their activities, ensure their operations align with the Act’s limitations, and consider whether they are participating in practices similar to those under scrutiny.
*Lena Zinner is a law clerk in the firm’s New York office.
FOOTNOTES
[1] Tex. Bus. & Com. Code § 541.001(d).
[2] Tex. Bus. & Com. Code § 541.051.
[3] Tex. Bus. & Com. Code § 541.101, et seq.
