What Does New Data Privacy Act Mean for Businesses?

Last week, the state’s Legislature passed the Texas Data Privacy and Security Act, bringing the bill one step closer to being enacted. All that’s left is for Gov. Greg Abbott to sign the legislation. Once signed, the law will begin regulating business entities’ collection of consumers’ data on March 1, 2024.

But what exactly does that mean?

For businesses, the law applies to any company that does business in the state or produces a product or service consumed by Texans. The law also applies to those that process and sell personal data and are not considered small businesses by the U.S. Small Business Administration.

Meanwhile, a consumer is defined as “an individual who is a resident of the state acting only in an individual or household context. The term does not include an individual acting in a commercial or employment context.”

As for protecting personal data, HB 4 offers consumers the following protections:

• The right to know when data is being collected
• Access to data from companies in an easy-to-read format
• The ability to correct and delete data
• The ability to opt out of personal data being processed for targeted advertising, the sale of personal data or profiling to further a legal decision
• Prohibits retaliation or discrimination for exercising these rights

So, what happens if a business violates the law?

According to the bill, the state’s attorney general will oversee all violations and punishments under the law.

In this case, the attorney general can enforce a 30-day cure period and require the company that violated consumers’ privacy to provide a written statement detailing how the issue was addressed.

If that doesn’t happen, civil penalties, including a $7,500 fee for each ‎violation, can occur, and the company would have to pay for consumers’ attorney’s fees and other expenses incurred from investigating and bringing an action under the law.