SB2459 - Relating to the protection of personal identifying information of certain persons in the judicial system; authorizing a civil right of action; creating criminal offenses.

      By: Creighton  S.B. No. 2459          (In the Senate - Filed March 13, 2025; March 25, 2025, read   first time and referred to Committee on State Affairs; May 7, 2025,   reported adversely, with favorable Committee Substitute by the   following vote:  Yeas 11, Nays 0; May 7, 2025, sent to printer.) Click here to see the committee vote     COMMITTEE SUBSTITUTE FOR S.B. No. 2459 By:  Birdwell     A BILL TO BE ENTITLED   AN ACT     relating to the protection of personal identifying information of   certain persons in the judicial system; authorizing a civil right   of action; creating criminal offenses.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  The heading to Subtitle H, Title 2, Government   Code, is amended to read as follows:   SUBTITLE H.  INFORMATION RESOURCES AND PRIVACY          SECTION 2.  Subtitle H, Title 2, Government Code, is amended   by adding Chapter 92 to read as follows:   CHAPTER 92.   PROTECTION OF PERSONAL IDENTIFYING INFORMATION OF   AT-RISK INDIVIDUALS COLLECTED AND STORED BY DATA BROKERS AND OTHER   PERSONS           Sec. 92.001.  DEFINITIONS. In this chapter:                 (1)  "At-risk individual" means:                       (A)  a judge, as defined by Section 33.001;                       (B)  a court clerk; and                       (C)     an employee of a state court, a court clerk,   the office, or another agency in the judicial branch of state   government.                 (2)     "Court clerk" means the clerk of the supreme   court, the court of criminal appeals, a court of appeals, a district   court, a county court, a statutory county court, a statutory   probate court, a justice court, or a municipal court.                 (3)  "Covered information":                       (A)  means:                             (i)     a home address, including primary and   secondary residences;                             (ii)     a home or personal telephone number,   including a mobile telephone number;                             (iii)  an e-mail address;                             (iv)     a social security number or driver's   license number;                             (v)     bank account, credit card, or debit   card information;                             (vi)     a license plate number or other unique   identifier of a vehicle owned, leased, or regularly used;                             (vii)     the identity of a child younger than   18 years of age;                             (viii)  a person's date of birth;                             (ix)     information regarding current or   future school or day care attendance, including the name or address   of the school or day care, schedules of attendance, or routes taken   to or from the school or day care;                             (x)     employment information, including the   name or address of the employer, employment schedules, or routes   taken to or from the employer's location; and                             (xi)     photographs or videos that reveal   information listed in Subparagraphs (i)-(x); and                       (B)     does not include information regarding   employment with a state agency.                 (4)     "Data broker" has the meaning assigned by Section   509.001, Business & Commerce Code, as added by Chapter 963   (S.B.   2105), Acts of the 88th Legislature, Regular Session, 2023.     The term does not include a commercial entity that:                       (A)  is engaged in the business of:                             (i)     reporting, news-gathering, speaking,   or engaging in other activities intended to inform the public on   matters of public interest or public concern;                             (ii)     providing 411 directory assistance or   directory information services, including name, address, and   telephone number, on behalf of or as a function of a   telecommunications carrier;                             (iii)     using personal information   internally, by providing access to businesses under common   ownership or affiliated by corporate control, or selling or   providing data for a transaction or service requested by or   concerning the individual whose personal information is being   transferred;                             (iv)     providing publicly available   information using real-time or near real-time alert services for   health or safety purposes; or                             (v)     collecting and selling or licensing   covered information incidental to conducting the activities   described by this subdivision; or                       (B)  is engaged in business as:                             (i)     a consumer reporting agency subject to   Chapter 20, Business & Commerce Code, and the Fair Credit Reporting   Act (15 U.S.C. Section 1681 et seq.);                             (ii)     a financial institution subject to the   Gramm-Leach-Bliley Act (Pub. L. No. 106-102) and regulations   implementing that Act; or                             (iii)     a covered entity for purposes of the   privacy regulations promulgated under Section 264(c), Health   Insurance Portability and Accountability Act of 1996 (42 U.S.C.   Section 1320d-2 note).                 (5)     "Immediate family member" means a person related   to another person within the first degree by consanguinity or   affinity, as described by Subchapter B, Chapter 573.   The term   includes a foster child, ward, legal dependent, or individual   residing in the same household.                 (6)     "Office" means the Office of Court Administration   of the Texas Judicial System.                 (7)     "State agency" means a public entity in the   executive, judicial, or legislative branch of state government.                 (8)  "State court" means:                       (A)     the supreme court or the court of criminal   appeals;                       (B)     an appellate court, district court, or   division of the business court;                       (C)     a county court, constitutional county court,   statutory county court, or statutory probate court;                       (D)  a justice court; or                       (E)  a municipal court.           Sec.   92.002.     DATA BROKER PROHIBITIONS. Notwithstanding any   other law, a data broker may not knowingly sell, license, trade for   consideration, transfer, or purchase covered information of an   at-risk individual or an immediate family member of the individual.           Sec.   92.003.     PROHIBITED DISPLAY OF COVERED INFORMATION.   (a)   Except as provided by Subsection (b), a person, including a   data broker, may not publicly post or display on a publicly   accessible Internet website covered information of an at-risk   individual or an immediate family member of the individual if the   at-risk individual, or the office, acting on the individual's   behalf, submits a written request to that person not to disclose or   acquire the covered information that is the subject of the request.           (b)  Subsection (a) does not apply to:                 (1)     covered information of an at-risk individual or an   immediate family member of the individual displayed on a publicly   accessible Internet website if the information is relevant to and   displayed as part of a news story, commentary, editorial, or other   speech on a matter of public concern;                 (2)     covered information that an at-risk individual   voluntarily posts on the Internet; or                 (3)     covered information received from a governmental   entity or an employee or agent of a governmental entity.           Sec.   92.004.     DUTY OF DATA BROKER TO REMOVE COVERED   INFORMATION. After receiving a written request under Section   92.003, a data broker shall:                 (1)     not later than 72 hours after receipt of the   request:                       (A)     remove from the Internet website the covered   information identified in the request;                       (B)     ensure the information is not made available   on any other publicly accessible Internet website or subsidiary   website the data broker controls; and                       (C)     identify any other instances of the   information that should be removed; and                 (2)     assist the sender in locating the covered   information that may be posted on any publicly accessible Internet   website or subsidiary website controlled by the data broker.           Sec.   92.005.   &#x [Text truncated for display. Full text available on LegiScan.]