What does Texas's data breach law ask a business to do?

Who does this law apply to?

The law says a person who does business in Texas and owns or licenses computerized sensitive personal information must tell each individual whose information was, or is reasonably believed to have been, acquired by an unauthorized person.

A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What counts as personal information?

Sensitive personal information is a person's name together with items such as a social security number, a driver's licence number or a government identification number, where the name and the items are not encrypted. The definition also covers account and card numbers with the code that opens the account, and health information.

(A) an individual's first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: (i) social security number; (ii) driver's license number or government-issued identification number;

How fast must people be told?

Notice goes out without unreasonable delay and no later than the 60th day after the business determines the breach occurred.

The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Who else must be told?

If the breach involves at least 250 Texas residents, the business must also tell the attorney general, no later than the 30th day after it determines the breach occurred.

If more than 10,000 people are notified at one time, the nationwide consumer reporting agencies must be told as well.

A person who is required to disclose or provide notification of a breach of system security under this section shall notify the attorney general of that breach as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state.

If a person is required by this section to notify at one time more than 10,000 persons of a breach of system security, the person shall also notify each consumer reporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices.

Is encrypted information treated differently?

Encrypted data still counts as breached when the person who took it also has the key to decrypt it.

In this section, "breach of system security" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.

What if a vendor holds the data?

A business that holds sensitive personal information it does not own must tell the owner immediately after it discovers a breach.

Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.