Bill Text: TX SB1213 | 2015-2016 | 84th Legislature | Introduced

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Relating to prohibiting the reidentification of certain deidentified information and the release of reidentified information; creating a criminal offense; providing a civil penalty.

Sponsorship: Bipartisan Bill

Status: (Passed) 2015-06-18 - Effective on 9/1/15 [SB1213 Detail]

Download: Texas-2015-SB1213-Introduced.html

---

By: Kolkhorst S.B. No. 1213

A BILL TO BE ENTITLED
AN ACT
relating to prohibiting the reidentification of certain
deidentified information and the release of any reidentified
information; creating a criminal offense.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Subtitle A, Title 11, Business & Commerce Code,
is amended by adding Chapter 506 to read as follows:
CHAPTER 506. REIDENTIFICATION OF DEIDENTIFIED INFORMATION
Sec. 506.001. DEFINITIONS. In this chapter:
(1) "Deidentified information" means information with
respect to which the holder of the information has made a good faith
effort to remove all personal identifying information or other
information that may be used by itself or in combination with other
information to identify the subject of the information. The term
includes aggregate statistics, redacted information, information
for which random or fictitious alternatives have been substituted
for personal identifying information, and information for which
personal identifying information has been encrypted and for which
the encryption key is maintained by a person otherwise authorized
to have access to the information in an identifiable format.
(2) "Personal identifying information" has the
meaning assigned by Section 521.002(a)(1).
Sec. 506.0015. APPLICABILITY. This chapter applies only to
the release of deidentified information by a board, commission,
department, or other agency of this state, including an institution
of higher education defined by Section 61.003 or a hospital
maintained or operated by the state.
Sec. 506.002. PROHIBITED ACTS. (a) A person may not:
(1) reidentify or attempt to reidentify an individual
who is the subject of deidentified information; or
(2) disclose or release information the person knows
was reidentified in violation of this section.
(b) It is a defense to prosecution under this section that
the person:
(1) was reidentifying the information for the purpose
of a study or other scholarly research, including performing an
evaluation or test of software intended to deidentify information;
and
(2) did not release or publish the names or other
information identifying any subjects of the reidentified
information.
Sec. 506.003. OFFENSE. (a) A person who violates Section
506.002 commits an offense.
(b) An offense under this section is a Class A misdemeanor.
Sec. 506.004. PRIVATE CAUSE OF ACTION. A person who
violates Section 506.002 is liable to the individual who is the
subject of the information for any damages caused by the
reidentification or release of the information.
SECTION 2. The change in law made by this Act applies to
conduct that occurs on or after the effective date of this Act.
Conduct that occurs before the effective date of this Act is
governed by the law in effect on the date the conduct occurred, and
the former law is continued in effect for that purpose.
SECTION 3. This Act takes effect September 1, 2015.