Makes insurance decisions, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code secs. 541.051-541.053, 541.105 · Read the law's page

• Give a Texas consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Texas consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.
• Conduct and document a data protection assessment before targeted advertising, sale of personal data, certain profiling, or sensitive-data processing.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 · Read the law's page

• Do not develop or deploy an AI system that intentionally aims to incite or encourage physical self-harm, harm to another person, or criminal activity.
• Do not develop or deploy an AI system with the sole intent of infringing, restricting, or impairing a constitutional right.
• Do not develop or deploy an AI system with intent to unlawfully discriminate against a protected class; a disparate impact alone is not enough to show that intent.
• Do not develop or distribute an AI system with the sole intent of producing or distributing AI-generated child pornography or deepfake sexually explicit media, or that engages in text-based sexual conversation while impersonating a child younger than 18.
• The Attorney General has exclusive enforcement authority and must give 60 days' notice and a chance to cure before suing; there is no private right of action.
• Civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day of a continuing violation.

Tex. Bus. & Com. Code §§ 552.101-552.106 · Read the law's page

• If the Attorney General notifies you in writing of a violation, cure it within 60 days of the notice and give the Attorney General a written statement that you have cured the violation, supporting documentation showing the manner in which you cured it, and a statement that you have made any necessary changes to internal policies to reasonably prevent further violation (s. 552.104(b)).
• Respond to a civil investigative demand from the Attorney General, which may ask for a high-level description of your system's purpose, intended use, deployment context and benefits, the type of data used to program or train it, the categories of input data, its outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards (s. 552.103).
• To rely on the defense that you found the violation yourself, discover it through feedback from a developer, deployer or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or through an internal review process while you substantially comply with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized AI risk management framework (s. 552.105(e)(2)).
• You may not be found liable where another person uses your AI system in a manner the chapter prohibits (s. 552.105(e)(1)).