González Bill Bars State Vendors From Selling Your Personal Data

The text as introduced · 622 words

90R4483 LRM-D

By: González of El Paso
H.B. No. 384

A BILL TO BE ENTITLED

AN ACT

relating to a state agency contract authorizing the sharing of an

individual's personally identifiable information; authorizing a

civil penalty.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subchapter Z, Chapter 2252, Government Code, is

amended by adding Section 2252.911 to read as follows:

Sec. 2252.911. CONTRACTS AUTHORIZING SHARING OF PERSONALLY

IDENTIFIABLE INFORMATION; VERIFICATION; DEBARMENT; CIVIL PENALTY.

(a) In this section:

(1) "Personally identifiable information" means any

information used to identify an individual, including an

individual's:

(A) first name or initial and last name;

(B) driver's license number;

(C) social security number;

(D) taxpayer identification number;

(E) vendor identification number;

(F) passport number;

(G) state issued identification number;

(H) home or other physical address or street

name;

(I) telephone number;

(J) e-mail address;

(K) credit or debit card number;

(L) bank account number;

(M) password or access code associated with a

credit or debit card or bank account;

(N) family member information; and

(O) date of birth.

(2) "State agency" means a board, commission, office,

department, or other agency in the executive, judicial, or

legislative branch of state government. The term includes an

institution of higher education as defined by Section 61.003,

Education Code.

(3) "Vendor" means a person who submits a bid to

contract with a state agency, including a subcontractor hired by

the vendor or hired by a subcontractor of the vendor.

(b) A vendor submitting a bid to contract with a state

agency for the agency's release to the vendor of personally

identifiable information must include in the bid a written

verification that the vendor will not sell, license, share for

compensation, or otherwise monetize the personally identifiable

information the vendor obtains from the agency under the contract.

(c) A state agency may not contract for the agency's release

of personally identifiable information to a vendor that fails to

provide the verification required by Subsection (b).

(d) A state agency, on making a final determination that a

vendor violated this section, shall immediately terminate the

contract with the vendor without further obligation to the vendor.

(e) A vendor determined by a state agency to have violated

this section:

(1) may not respond to a solicitation for or be awarded

a state agency contract for goods or services until the first

anniversary of the date the vendor receives the state agency's

final determination;

(2) may be barred from participating in state

contracts using the procedures prescribed under Section 2155.077

for a period of one year and for any additional one-year period as

the comptroller determines appropriate; and

(3) is liable to this state for a civil penalty in the

amount of:

(A) $7,500 for each violation; or

(B) $10,000 for each violation if the personally

identifiable information is for an individual younger than 18 years

of age.

(f) The attorney general may bring an action to recover a

civil penalty imposed under this section. The attorney general may

recover reasonable attorney's fees and costs in bringing an action

under this section.

SECTION 2. Section 2252.911, Government Code, as added by

this Act, applies only to a state agency contract for which the

request for bids or proposals or other applicable expression of

interest is made public on or after the effective date of this Act.

A state agency contract for which the request for bids or proposals

or other applicable expression of interest is made public before

that date is governed by the law in effect on the date the request or

other expression of interest is made public, and the former law is

continued in effect for that purpose.

SECTION 3. This Act takes effect September 1, 2027.