FOLLOW US

Texas Attorney General Ken Paxton is intensifying efforts to curb the misuse of residents' personal information by establishing a new team dedicated to enforcing the state's data protection laws, including a comprehensive consumer data privacy law set to take effect next month.

In what the attorney general billed as "a major data privacy and security initiative," Paxton revealed Tuesday that he has moved to create a team focused on the "aggressive enforcement" of the state's privacy laws. This includes the new Data Privacy and Security Act and the Biometric Identifier Act, as well as federal laws safeguarding health and children's data.

The team is "poised to become among the largest in the country focused on enforcing privacy laws," according to Paxton. This initiative, which will be housed in his office's consumer protection division, aims to ensure companies "respect Texans' privacy rights and safeguard their personal data."

"As many companies seek more and more ways to exploit data they collect about consumers, I am doubling down to protect privacy rights," Paxton said in a statement. "With companies able to collect, aggregate, and use sensitive data on an unprecedented scale, we are strengthening our enforcement of privacy laws to protect our citizens."

The new initiative comes as the state readies to roll out the Texas Data Privacy and Security Act, which is slated to go live on July 1.

Like the more than dozen other comprehensive state data privacy statutes currently on the books, the Texas law, enacted in June 2023, requires companies to give consumers the ability to access, delete, correct, and opt out of the sale and sharing of their personal information, including for targeted advertising purposes.

The law also contains nuances that set it apart from other state frameworks, including its broad reach. Rather than setting a minimum resident or data processing threshold, the Texas statute excludes small businesses as defined by the U.S. Small Business Administration from the law, except for the obligation to obtain consumer consent before selling sensitive data. This means that many companies not covered by other state regimes are likely to be swept up by the Texas law if they do business in the state.

The Texas measure also expands the definition of personal data to include pseudonymous data and bans the use of manipulative, coercive, or deceptive user-interface designs known as dark patterns to trick consumers into making unintended decisions, such as purchasing services or staying on a platform longer.

While California has moved to establish a new agency dedicated to enforcing its comprehensive data privacy laws, other states, including Texas, have left this task up to their attorneys general, whose offices are broadly tasked with policing an array of consumer protection laws.

The Texas statute requires the attorney general to notify companies of alleged violations and give them 30 days to remedy these issues. If the company fails to do so, Paxton's office can initiate an enforcement action to collect civil penalties of up to $7,500 per violation and injunctive relief, as well as attorney fees and other expenses incurred in investigating and bringing the matter.

Aside from enforcing the consumer data privacy law, the new team will also spearhead efforts to enforce the state's Biometric Identifier Act, one of only three state biometric data privacy laws in the nation. The other two are on the books in Illinois and Washington.

The Biometric Identifier Act, enacted in 2009, prevents a person from capturing biometric data, such as fingerprints and face scans, from an individual without that individual's informed consent. It further prohibits the distribution or disclosure of that data to third parties and requires any data to be destroyed within a year of its collection.

Paxton brought the first major action under the statute in February 2022, accusing Facebook's parent company Meta Platforms Inc. of collecting users' biometric information without their consent to fuel its now-discontinued photo- and video-tagging feature, which used facial recognition technology to identify users.

Meta and the attorney general disclosed in a court filing late last week that they had reached an "agreement in principle" to resolve the dispute, although they didn't specify the terms of the deal. The state judge overseeing the case put the matter on hold for 30 days to give the parties time to finalize and formalize the settlement.

Other statutes that the attorney general's new team will be tasked with enforcing include the state's Identity Theft Enforcement and Protection Act, Data Broker Law, and Deceptive Trade Practices Act, along with relevant federal laws such as the Children's Online Privacy Protection Act and the Health Insurance Portability and Accountability Act.

"Any entity abusing or exploiting Texans' sensitive data will be met with the full force of the law," Paxton added in his statement Tuesday. "Companies that collect and sell data in an unauthorized manner, harm consumers financially, or use artificial intelligence irresponsibly present risks to our citizens that we take very seriously."