LexLint.ioBeta

Know the law your code answers to.

Law / United States / Texas

Identity Theft Enforcement and Protection Act, business duty to protect sensitive personal information

Tex. Bus. & Com. Code sec. 521.052

In force since .

A security baseline statutes rule binding private bodies.

Obligation class
Security

What it requires

  • This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
  • Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.NIST CSF 2.0PR.DS-01
  • Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.NIST CSF 2.0ID.AM-08
  • There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.DM-P5Data are destroyed according to policy.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
CIS Controls
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
FINOS AIGF
1 more
ENISA NIS2 guidance
  • 2.1Risk management framework
  • 3.1Incident handling policy
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
2 more
  • 9.1Cryptography
  • 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Civil penalty under Section 521.151(a) for a violation of this chapter generally, recoverable only by the attorney general; the statute names no aggregate cap for this per-violation penalty. Section 521.151(a-1)'s separate penalty of up to $100 per individual, capped at $250,000 per breach, punishes a failure to comply with the breach-notification duty at Section 521.053(b), which is this jurisdiction's privacy row, not this one.

Rule
Per violation only
As of
Minimum
2,000
Currency
USD
Per violation unit
Violation
Per violation amount
50,000

Who enforces it

Enforcement body

The attorney general may bring an action to recover the civil penalty and to enjoin a violation of this chapter under Section 521.151. Section 521.152's deceptive-trade-practice private action reaches only a violation of Section 521.051, a different duty, not this section.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A business must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information it collects or maintains in the regular course of business. A business must also destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise rendering it unreadable or indecipherable.

A financial institution as defined by 15 U.S.C. § 6809 is exempt from the destruction duty, and the section states no further content for what 'reasonable' requires beyond the general standard.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .