The Texas Data Privacy and Security Act (TDPSA), What You Need to Know

Exactly what is the TDPSA?

Collection, use, processing, and handling of consumer personal data is governed under the Texas Data Privacy and Security Act. Law-abiding businesses who break its rules face civil penalties.

Taking cues from current legislation, the Virginia Consumer Data Protection Act is the cornerstone of the TDPSA. The purpose of the law was to hold companies responsible for how they utilize Texans' data while simultaneously safeguarding the privacy and personal data rights of the people living in the state.

Like other state privacy statutes, the Texas privacy act grants citizens a variety of well-known rights, including the ability to:  

• Verify and get access to personal data processed by a controller.
• Spot errors in their personal information.
• Remove personal information that the customer supplied or that you have learned about them.
• Get a portable, easily useable copy of their personal data, if it is available.
• Refuse to have personal data processed for profiling, targeted advertising, or data sales.  
• While the worldwide opt-out technology provision goes into force on January 1, 2025, enterprises will have a little longer grace period to comply with the TDPSA, which goes into force on July 1, 2024. Businesses will thereafter need to be able to identify universal opt-out signals, such the Global Privacy Control.

Who Has to Follow the TDPSA?

The applicability of the TDPSA is one of the main differences from other data privacy legislation. The law lays down new standards rather than applying to companies according to their yearly income, amount of data processed, or amount of money the company makes from the selling of such data.

Entities meeting the subsequent requirements are covered under TDPSA:  

• Transact commerce in Texas or provide goods and services that Texas citizens "consume." Since consumed replaces the word "targeted" that most such statutes have, it is a new word in this kind of legislation that has not gone unnoticed.  
• Process or sell personal information.
• The U.S. Small Business Administration (SBA) defines small businesses differently depending on industry; they are "usually stated in number of employees or average annual receipts."
• Being the first of its kind, the small business clause may affect most (if not all) businesses operating in the state.  

Texas Data Privacy Act Requirements

The TDPSA lists controllers' responsibilities for gathering personal data, including establishing data security procedures and restricting collection to what is reasonable, relevant, and adequate.  

Controllers are unable to:  

• Compile personal informationfor purposes not previously informed to the customer without their permission.
• Process data against thelegislation, both state and federal, that forbids unjustified discrimination oragainst a customer for using their rights.
• Process sensitive data withoutgetting permission or, unless permitted by the Children's Online PrivacyProtection Act of 1998 (COPPA), process sensitive data of a kid.
• Businesses must also obtain authorization before processing sensitive personal data and give notice if they sell sensitive or biometric data, according to the Texas privacy law.

A controller must react "without undue delay," but no later than 45 days after receiving a data subject access request (DSAR; such as the rights requests mentioned above). Furthermore, a controller may, if deemed logical, extend the response time by 45 days provided they tell the customer within the first 45-day window.  

According to the legislation, consumers must receive free information at least twice a year, unless their request is obviously baseless, exorbitant, or repetitious. Should the controller fail to respond within a reasonable amount of time, it must set up a procedure by which a consumer may appeal.

Other Items to Consider

While other states (such as Connecticut, Virginia, and California) have privacy laws that are seen to be more business-friendly than the TDPSA, there are several other noteworthy linguistic alterations in the statute.

For instance, the law mandates that businesses or organizations that sell sensitive or biometric data make further disclosures; it even goes so far as to mandate the notification, "notification: We may sell your sensitive (or biometric) personal data. ”Posting of the notice in the same manner and place as the privacy notice is required.

Companies which sell customer data for targeted advertising also have to offer more disclosures and give customers a means to stop having their data sold.

Although the measure more closely resembles Virginia's privacy statute, the Texas statute's definition of "sale of personal data" is more like the California Privacy Rights measure than Virginia's. It is defined in the act as "sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party."  

Every non-exempt company operating in the state and processing or selling personal data is covered by the definition of "controller."

Furthermore, the 30-day cure period—that is, a grace period during which offenders have the chance to "cure" a violation after notification—varies somewhat from those of other legislation. Should a violation be resolved after the attorney general issues a written notification, no further action will be taken against the offender. What is different is that the organization has to also submit a written declaration to the attorney general stating:

• Stopped the infraction.  
• Reported to the customer that their privacy violation was resolved (if their contact details were disclosed).  
• Changed internal policies as needed to prevent future infractions.  
• Moreover, unlike with previous legislation, the cure time never expires; companies covered by the TDPSA will always have a 30-day cure period.  

For every infraction, the attorney general has the authority to fine an organization $7,500.  

Ultimately, there is no private right of action, hence private citizens are powerless to take legal action against those who break the law.

How Can Data Sentinel Help?

We can help by automating a number of the processes required to comply with the new legislation, including:

• Automating the mapping of all your sensitive data
• Implementing an end-to-end DSAR fulfilment process
• Manage data retention to policies
• Manage consented data across your systems
• Semi-automate your privacy impact assessment processes.
• Generate ongoing compliance reporting

Please contact us for a consultation and demonstration at info@data-sentinel.com