Texas’s tough new Consumer Data Privacy law

Intro

Texas passed its tough Data Privacy legislation on May 28, 2023 called the Texas Data Privacy and Security Act (TDPSA). The law comes into effect on July 1, 2024. It takes its basics from the Virginia Consumer Data Protection Act (VCDPA), but the TDPSA has significant differences in scope, definitions, and obligations from the state controller.

Why is it “Tough”

The TDPSA is considered “tough” due to its comprehensive and rigorous approach to consumer data protection. It broadens the scope of applicability compared to previous laws by covering entities that process or sell personal data and either conduct business in Texas or produce products or services consumed by Texans, regardless of whether these entities specifically target Texas residents. It also avoids the ambiguity of data volume and revenue thresholds, instead focusing on well-defined categories of “small businesses.”

How does Texas define “Personal Data”?

The law includes broad definitions for terms like “personal data” and “sale of personal data,” capturing a wide range of data transactions. Moreover, the definition of “consent” is narrow and demands a clear, unambiguous agreement to process personal data from the consumer, setting a high standard for consumer agreement.

What is required of a business?

A business taking consumer data is called a “Data Controller” and the obligations are rigorous, requiring data protection assessments for high-risk processing activities, clearly defined privacy notices for consumers, and stringent measures to protect personal data. Controllers are required to respond to consumer rights requests within a specified timeframe, providing another layer of consumer protection.

Who is going to enforce the law?

Enforcement is vested in the Attorney General with potential penalties of up to $7,500 per violation, which can mount to significant sums for systemic or repeat offenses.

Bottom line

All these elements make the TDPSA a robust and comprehensive privacy law, demanding high standards of data protection and accountability from businesses. It aims to protect consumers’ data rights rigorously, making it a “tough” law in the realm of privacy legislation.