Identity Theft in Texas

Find a loan opened in your name and the first question is which Texas statute lets you sue whoever leaked the data. Chapter 521 of the Business and Commerce Code is where you get pointed, and it is not that statute. It writes duties for businesses, arms the attorney general, and gives a victim one court order that declares a fact instead of awarding money. The penalties it creates belong to the state, and the chapter awards a victim no damages of its own.

The prohibition has two halves

Section 521.051(a) bars obtaining, possessing, transferring, or using another person's personal identifying information without that person's consent or effective consent. The subsection joins that with "and" to an intent element: intent to obtain a good, a service, insurance, an extension of credit, or any other thing of value in the other person's name.

Under subsection (a-1) consent is not effective if induced by force, threat, fraud, or coercion, or if given by someone who by reason of youth, mental illness, or intellectual disability is known by the actor to be unable to make reasonable decisions. Consent from a person legally authorized to act for another does count. Subsection (c) lifts financial institutions and insurance covered entities out of the section entirely.

Two definitions that decide which duty applies

Section 521.002(a)(1) defines personal identifying information as information that alone or with other information identifies an individual, and lists name, social security number, date of birth, government-issued identification number, mother's maiden name, unique biometric data including fingerprint, voice print, and retina or iris image, unique electronic identification number, address, or routing code, and a telecommunication access device as defined by Penal Code section 32.51.

The prohibition uses that broad term. Both business duties use the narrow one. Sensitive personal information, at 521.002(a)(2), has two branches. The first is a first name or first initial and last name combined with a social security number, a driver's license or government-issued identification number, or an account, credit, or debit card number plus any required security code, access code, or password permitting access to a financial account, and only where the name and items are unencrypted. The second is information identifying an individual that relates to their physical or mental health or condition, to health care provided, or to payment for it, with no encryption qualifier. Subsection (b) excludes publicly available information lawfully made available to the public by federal, state, or local government.

What a business owes before anything goes wrong

Section 521.052(a) requires reasonable procedures, including any appropriate corrective action, to protect sensitive personal information a business collects or maintains in the regular course of business from unlawful use or disclosure. Subsection (b) handles the end of a record's life: customer records holding such information that the business will not retain must be destroyed, or their destruction arranged, by shredding, erasing, or otherwise modifying it to be unreadable or indecipherable. The section fixes no retention period and no destruction deadline, exempts financial institutions, and counts a nonprofit athletic or sports association as a business.

Breach notification, one deadline at a time

Section 521.053(a) defines a breach of system security as unauthorized acquisition of computerized data compromising the security, confidentiality, or integrity of sensitive personal information, encrypted data included where the intruder holds the decryption key. Good faith acquisition by an employee or agent for the person's own purposes is not a breach unless the information is then used or disclosed without authorization. Four duties follow, and they do not share a clock.

1. A data holder tells the data owner immediately after discovery

   Subsection (c) reaches a person maintaining computerized sensitive personal information owned by someone else, and requires notice to the owner or license holder immediately after discovering the breach. Discovery is the trigger, and this is the only one of the four deadlines that runs from it.

2. The owner tells individuals by the 60th day after determining a breach occurred

   Subsection (b) binds a person who conducts business in Texas and owns or licenses computerized data including sensitive personal information. Every individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person gets disclosure after the business discovers or receives notification of the breach. The disclosure is made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred. Not the breach date, and not the discovery date. A law enforcement delay under subsection (d) extends it, as does time needed to determine the breach's scope and restore the data system's reasonable integrity.

3. More than 10,000 notified at one time brings in the nationwide bureaus

   Subsection (h) adds a recipient where the section requires notice to more than 10,000 persons at one time: each consumer reporting agency maintaining files on consumers on a nationwide basis, told the timing, distribution, and content of the notices. This one carries a standard instead of a day count, without unreasonable delay.

4. At least 250 Texas residents brings in the attorney general by the 30th day

   Different threshold, different recipient. Under subsection (i), a breach involving at least 250 residents of Texas goes to the attorney general as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred. Same starting event as the individual notice, half the time. The report is filed electronically, on a form reached through the attorney general's website, and the same subsection fixes the six things it must contain.

Delivering the notice, and when substitute notice unlocks

Subsection (e) allows written notice at the individual's last known address, electronic notice given as the federal statute it cites requires, or substitute notice under subsection (f), which opens only on a showing that notice would cost more than $250,000, that affected persons exceed 500,000, or that contact information is insufficient, and which then runs by electronic mail, conspicuous website posting, or publication or broadcast in major statewide media. Locking down a credit file afterward is a separate chapter 20 mechanism, covered in the guide to security freezes on a Texas credit report.

What a victim can get from a district court

Section 521.101(a) opens two independent routes to a district court: injury from a violation of 521.051, or having filed a criminal complaint alleging commission of an offense under Penal Code section 32.51. Subsection (b) allows the application whether or not the applicant can name each person who used the information unlawfully.

Section 521.103(a) makes the order mandatory once the court is satisfied by a preponderance of the evidence, after notice and a hearing, and section 521.102 presumes victim status where the person charged under Penal Code section 32.51 is convicted. Section 521.103(b) requires the order to identify the violator so far as known, the specific information and documents used, and any affected account or transaction down to the institution or merchant name, account numbers, dollar amount, and date.

Section 521.104(a) seals the order for that reason and permits release in four situations, one of which is the victim's payoff and the place the chapter's record-correction remedy actually lives. Under 521.104(a)(2) the victim may present a copy to a governmental entity or private business, either to prove that a financial transaction or account was directly affected or to correct any record of that entity or business containing inaccurate or false information as a result of the violation or offense. The copy stays confidential under subsection (c).

The penalties run to the state

Section 521.151(a) makes a violator liable to this state for a civil penalty of at least $2,000 and not more than $50,000 for each violation, recovered only in an action the attorney general brings. Subsection (a-1) adds a second penalty on top for failing to take reasonable action on the individual notice duty: not more than $100 for each individual to whom notification is due, for each consecutive day of the failure, capped at $250,000 for all individuals owed notice after a single breach. Read liable to this state literally. Subsection (f) routes what the attorney general collects to the general revenue fund, spendable only on other cases under this chapter. None of it compensates the person whose information was taken.

Subsection (b) lets the attorney general sue to restrain violating conduct by restraining order or by temporary or permanent injunction. In an action under the section, subsection (e) lets the court grant any other equitable relief it considers appropriate to prevent additional harm to a victim or a further violation of the chapter, or to satisfy a judgment entered against the defendant, including an order to appoint a receiver, sequester assets, correct a public or private record, or prevent the dissipation of a victim's assets. Record correction therefore appears twice in this chapter, at 521.104(a)(2)(B) and at 521.151(e)(2), and the second exists only inside a case the attorney general chose to bring.

Where a private claim comes from

One sentence opens a private door, and it opens onto a different statute. Section 521.152 treats a violation of 521.051 as a deceptive trade practice, actionable under subchapter E of chapter 17. Any damages are the DTPA's to give, on that act's own elements, notice rules, and limits, which is the subject of what the Texas DTPA covers. Chapter 521 creates no private damages action of its own, and it has no section 521.054 either: it runs 521.001, 521.002, 521.051, 521.052, and 521.053, then resumes at 521.101. The neighboring statutes are indexed in the Texas consumer law guides, one silo of the full guide library.