FOLLOW US

While California has moved to establish a new agency dedicated to enforcing its comprehensive data privacy laws, other states, including Texas, have left this task up to their attorneys general, whose offices are broadly tasked with policing an array of consumer protection laws.

The Texas statute requires the attorney general to notify companies of alleged violations and give them 30 days to remedy these issues. If the company fails to do so, Paxton's office can initiate an enforcement action to collect civil penalties of up to $7,500 per violation and injunctive relief, as well as attorney fees and other expenses incurred in investigating and bringing the matter.

Aside from enforcing the consumer data privacy law, the new team will also spearhead efforts to enforce the state's Biometric Identifier Act, one of only three state biometric data privacy laws in the nation. The other two are on the books in Illinois and Washington.

The Biometric Identifier Act, enacted in 2009, prevents a person from capturing biometric data, such as fingerprints and face scans, from an individual without that individual's informed consent. It further prohibits the distribution or disclosure of that data to third parties and requires any data to be destroyed within a year of its collection.

Paxton brought the first major action under the statute in February 2022, accusing Facebook's parent company Meta Platforms Inc. of collecting users' biometric information without their consent to fuel its now-discontinued photo- and video-tagging feature, which used facial recognition technology to identify users.

Meta and the attorney general disclosed in a court filing late last week that they had reached an "agreement in principle" to resolve the dispute, although they didn't specify the terms of the deal. The state judge overseeing the case put the matter on hold for 30 days to give the parties time to finalize and formalize the settlement.

Other statutes that the attorney general's new team will be tasked with enforcing include the state's Identity Theft Enforcement and Protection Act, Data Broker Law, and Deceptive Trade Practices Act, along with relevant federal laws such as the Children's Online Privacy Protection Act and the Health Insurance Portability and Accountability Act.

"Any entity abusing or exploiting Texans' sensitive data will be met with the full force of the law," Paxton added in his statement Tuesday. "Companies that collect and sell data in an unauthorized manner, harm consumers financially, or use artificial intelligence irresponsibly present risks to our citizens that we take very seriously."