Law / United States / 
Texas
Texas Data Privacy and Security Act, deidentified and pseudonymous data
Tex. Bus. & Com. Code sec. 541.106
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- Take reasonable measures to ensure that deidentified data you hold cannot be associated with an individual (Tex. Bus. & Com. Code sec. 541.106(a)(1)).
- Publicly commit to maintaining and using deidentified data without attempting to reidentify it (Tex. Bus. & Com. Code sec. 541.106(a)(2)).
- Contractually obligate any recipient of the deidentified data to comply with chapter 541 (Tex. Bus. & Com. Code sec. 541.106(a)(3)).
- If you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Tex. Bus. & Com. Code sec. 541.106(d)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 541.106 states the duties of a controller that holds or discloses deidentified or pseudonymous data. It states no log or record duty.
- Kind
- None
- As of
What this law does
Section 541.106(a) requires a controller in possession of deidentified data to take reasonable measures to ensure that the data cannot be associated with an individual, to publicly commit to maintaining and using the data without attempting to reidentify it, and to contractually obligate any recipient of the data to comply with chapter 541.
Section 541.106(d) requires a controller that discloses pseudonymous data or deidentified data to exercise reasonable oversight to monitor compliance with the contractual commitments to which the data is subject and to take appropriate steps to address any breach of those commitments.
Under section 541.106(c), the consumer rights in sections 541.051(b)(1) to (4) and the controller duties in section 541.101 do not apply to pseudonymous data where the controller can demonstrate that the information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing it.
Section 541.001(12) defines deidentified data as data that cannot reasonably be linked to an identified or identifiable individual, or a device linked to that individual.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .