Distributes a software product, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Consumer Protection Against Computer Spyware Act, Tex. Bus. & Com. Code ch. 324 · Read the law's page

• If you are not the owner or operator of a computer (its owner or lessee, or an individual using it with the owner's or lessee's authorization), do not knowingly cause software to be copied to a computer in Texas and use it to do any of the acts below; you act knowingly if you have actual knowledge of the facts that constitute the violation or consciously avoid information that would establish that knowledge, and causing software to be copied means distributing or transferring it or a component of it, not merely transmitting, routing, caching, hosting through a website or giving a link to it.
• Do not use that software to collect personally identifiable information (a name, home address, e-mail address, card or bank account number, password or access code, government identification number, or account balances, overdraft history or payment history that identify the person) through intentionally deceptive means by a keystroke-logging function that records all keystrokes and transfers them to another person, or in a manner that correlates it with all or substantially all of the websites the owner or operator visits other than your own.
• Do not use that software to cull, through intentionally deceptive means, a card number, bank account number, password or access code for a card or bank account, social security number, account balance or overdraft history from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the owner or operator.
• Do not use that software to modify, through intentionally deceptive means, the page that appears when an Internet browser is launched, the default provider or web proxy used to access or search the Internet, or the list of bookmarks.
• Do not use that software to take control of the computer by using its modem or Internet service to cause damage or to make the owner, operator or a third party incur financial charges for a service not previously authorized, or by opening, without the owner's or operator's consent, advertisements in multiple, sequential or stand-alone form that an ordinarily reasonable person cannot close without closing the browser or shutting down the computer.
• Do not use that software to modify settings that relate to access to or use of the Internet and the protection of information for the purpose of stealing the owner's or operator's personally identifiable information, or security settings for the purpose of causing damage to one or more computers.
• Do not use that software to prevent, through intentionally deceptive means, the owner's reasonable efforts to block or disable software by making software the owner has properly removed or disabled reinstall or reactivate itself; do not misrepresent to another that software will be uninstalled or disabled by the owner's actions; do not remove, disable or render inoperative, through intentionally deceptive means, security, antispyware or antivirus software; do not offer an option to decline installation knowing the installation will proceed anyway, or misrepresent that software has been disabled; and do not change the software's name, location or other designation, or create randomized or deceptive file names, folders, formats or registry entries, to keep the owner from locating or removing it.
• Do not induce the owner or operator of a computer in Texas to install a software component by intentionally misrepresenting the extent to which installation is necessary for security or privacy reasons, to open or view text, or to play musical or other content, and do not copy and execute, or cause the copying and execution of, a software component in a deceptive manner with the intent that the owner or operator use it in a way that violates the chapter.
• Do not knowingly cause or offer to cause a computer you do not own or operate to become a zombie or part of a botnet (a computer compromised without the owner's or operator's knowledge and consent so that a program or person other than the owner or operator has access or control); do not knowingly create, have created, use or offer to use a zombie or botnet to send unsolicited commercial electronic mail, cause a loss of service, send data from a computer without the owner's or operator's authorization, forward software designed to damage or disrupt another computer or system, collect personally identifiable information, or perform an act for another purpose the owner or operator has not authorized; and do not purchase, rent or otherwise gain control of a zombie or botnet created by another person, or sell, lease or otherwise provide another person access to or use of one.
• Section 324.052 other than its subdivision (1), section 324.053(4), section 324.054 and section 324.055 do not apply to a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service that monitors or interacts with a subscriber's Internet or other network connection or service, or a protected computer, for a network or computer security purpose, diagnostics, technical support or repair, an authorized update of software or system firmware, authorized remote system management, or detection or prevention of unauthorized use or of fraudulent or other illegal activity, including scanning for and removing software the chapter proscribes.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.