Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/heading

Consumer Data Privacy and Online Monitoring

core/paragraph

Available at: <a href="https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm">https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm</a>

Data Breach Requirements: Texas Bus. &amp; Com. Code §§ 521.002, 521.053, 521.151.

The numbering and internal citations herein are derived from the applicable state statute.

The term “sensitive personal information” means

(A) An individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: (i) Social Security number; (ii) Driver’s license number or government-issued identification number; or (iii) Account, credit, or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or

(B) Information that identifies an individual and relates to: (i) The physical or mental health or condition of the individual; (ii) The provision of health care to the individual; or (iii) Payment for the provision of health care to the individual.

core/separator

The term “breach of system security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.

Good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.

The breach notification shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by subsection (d) (law enforcement exception) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

A person may delay providing a breach notice at the request of a law enforcement agency that determines that the notification will impede a criminal investigation. The notification shall be made as soon as the law enforcement agency determines that the notification will not compromise the investigation.

A breach notice may be provided by one of the following methods: (1) Written notice at the last known address of the individual; (2) Electronic notice, if the notice is provided in accordance with 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or (3) Substitute notice if the person required to give notice demonstrates that the cost of providing notice would exceed $250,000, the number of affected persons exceeds 500,000, or the person does not have sufficient contact information,

Substitute notice shall consist of the following: (1) Electronic mail, if the person has electronic mail addresses for the affected persons; (2) Conspicuous posting of the notice on the person’s website; or (3) Notice published in or broadcast on major statewide media.

A person who is required to disclose or provide notification of a breach of system security shall notify the attorney general of that breach as soon as reasonably practicable and later than the 30th day after the date on which the person determines that the breach occurred if it involves at least 250 residents of this state. The notification must be submitted electronically using a form accessed through the attorney general's Internet website and must include: (1) A detailed description of the nature and circumstances of the breach or the use of sensitive personal information acquired as a result of the breach; (2) The number of residents of this state affected by the breach at the time of notification; (3) The number of affected residents that have been sent a disclosure of the breach by mail or other direct method of communication at the time of notification; (4) The measures taken by the person regarding the breach; (5) Any measures the person intends to take regarding the breach after the notification under this subsection; and (6) Information regarding whether law enforcement is engaged in investigating the breach.

If a person is required to notify, at one time, more than 10,000 persons of a breach, the person shall also notify each consumer reporting agency that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices. The person shall provide the notice required by this subsection without unreasonable delay.

Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

If the individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person is a resident of a state that requires an organization to provide a breach notice, the notice under Texas law may be provided under that state’s law or under Texas law.

The attorney general shall post on its publicly accessible Internet website a listing of the notifications it received pursuant to this law, excluding any sensitive personal information, any information that may compromise a data system’s security, and any other information reported to the attorney general that is made confidential by law. The attorney general shall: (1) Update the listing not later than the 30th day after the date the attorney general receives notification of a new breach of system security; (2) Remove a notification from the listing not later than the first anniversary of the date the attorney general added the notification to the listing if the person who provided the notification has not notified the attorney general of any additional breaches; and (3) Maintain only the most recently updated listing on the attorney general’s website.

Data Disposal and Security: Texas Bus. &amp; Com. Code. §§ 521.002, 521.052.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal identifying information” means information that alone or in conjunction with other information identifies an individual, including an individual’s: (A) Name, social security number, date of birth, or government-issued identification number; (B) Mother’s maiden name; (C) Unique biometric data, including the individual’s fingerprint, voice print, and retina or iris image; (D) Unique electronic identification number, address, or routing code; and (E) Telecommunication access device as defined by Section 32.51, Penal Code.

The term “sensitive personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted: (i) Social Security number; (ii) Driver’s license number or government-issued identification number; or (iii) Account, credit, or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or (B) Information that identifies an individual and relates to: (i) The physical or mental health or condition of the individual; (ii) The provision of health care to the individual; or (iii) Payment for the provision of health care to the individual.

The term “sensitive personal information” does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government.

A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business in the regular course of business.

A business shall destroy or arrange for the destruction of customer records containing sensitive personal information within the business’s custody or control that are not to be retained by the business by: (1) Shredding; (2) Erasing; or (3) Otherwise modifying the sensitive personal information in the records to make the information unreadable or indecipherable through any means.