BUSINESS & COMMERCE CODE TITLE 11. PERSONAL IDENTITY INFORMATION CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY NUMBERS
BUSINESS & COMMERCE CODE
TITLE 11. PERSONAL IDENTITY INFORMATION
SUBTITLE A. IDENTIFYING INFORMATION
CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY
NUMBERS
SUBCHAPTER A. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS
Text of section effective on April 1, 2009
§ 501.001. CERTAIN USES OF SOCIAL SECURITY NUMBER
PROHIBITED. (a) A person, other than a government or a
governmental subdivision or agency, may not:
(1) intentionally communicate or otherwise make
available to the public an individual's social security number;
(2) display an individual's social security number on
a card or other device required to access a product or service
provided by the person;
(3) require an individual to transmit the individual's
social security number over the Internet unless:
(1) the Internet connection is secure; or
(2) the social security number is encrypted;
(4) require an individual's social security number for
access to an Internet website unless a password or unique personal
identification number or other authentication device is also
required for access; or
(5) except as provided by Subsection (f), print an
individual's social security number on any material sent by mail,
unless state or federal law requires that social security number to
be included in the material.
(b) A person using an individual's social security number
before January 1, 2005, in a manner prohibited by Subsection (a) may
continue that use if:
(1) the use is continuous; and
(2) beginning January 1, 2006, the person provides to
the individual an annual disclosure stating that, on written
request from the individual, the person will stop using the
individual's social security number in a manner prohibited by
Subsection (a).
(c) A person, other than a government or a governmental
subdivision or agency, may not deny a service to an individual
because the individual makes a written request under Subsection
(b)(2).
(d) If a person receives a written request from an
individual directing the person to stop using the individual's
social security number in a manner prohibited by Subsection (a),
the person shall comply with the request not later than the 30th day
after the date the request is received. The person may not impose a
fee for complying with the request.
(e) This section does not apply to:
(1) the collection, use, or release of a social
security number required by state or federal law, including Chapter
552, Government Code;
(2) the use of a social security number for internal
verification or administrative purposes;
(3) a document that is recorded or required to be open
to the public under Chapter 552, Government Code;
(4) a court record; or
(5) an institution of higher education if the use of a
social security number by the institution is regulated by Chapter
51, Education Code, or another provision of the Education Code.
(f) Subsection (a)(5) does not apply to an application or
form sent by mail, including a document sent:
(1) as part of an application or enrollment process;
(2) to establish, amend, or terminate an account,
contract, or policy; or
(3) to confirm the accuracy of a social security
number.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
Text of section effective on April 1, 2009
§ 501.002. CERTAIN USES OF SOCIAL SECURITY NUMBER
PROHIBITED; REMEDIES. (a) A person may not print an individual's
social security number on a card or other device required to access
a product or service provided by the person unless the individual
has requested in writing that printing. The person may not require
a request for that printing as a condition of receipt of or access
to a product or service provided by the person.
(b) A person who violates this section is liable to this
state for a civil penalty in an amount not to exceed $500 for each
violation. The attorney general or the prosecuting attorney in the
county in which the violation occurs may bring an action to recover
the civil penalty imposed under this section.
(c) The attorney general may bring an action in the name of
the state to restrain or enjoin a person from violating this
section.
(d) This section does not apply to:
(1) the collection, use, or release of a social
security number required by state or federal law, including Chapter
552, Government Code; or
(2) the use of a social security number for internal
verification or administrative purposes.
(e) This section applies to a card or other device issued in
connection with an insurance policy only if the policy is
delivered, issued for delivery, or renewed on or after March 1,
2005.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
SUBCHAPTER B. PRIVACY POLICY TO PROTECT SOCIAL SECURITY NUMBERS
Text of section effective on April 1, 2009
§ 501.051. INAPPLICABILITY OF SUBCHAPTER. This
subchapter does not apply to:
(1) a person who is required to maintain and
disseminate a privacy policy under:
(A) the Gramm-Leach-Bliley Act (15 U.S.C.
Sections 6801 to 6809);
(B) the Family Educational Rights and Privacy Act
of 1974 (20 U.S.C. Section 1232g); or
(C) the Health Insurance Portability and
Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
(2) a covered entity under rules adopted by the
commissioner of insurance relating to insurance consumer health
information privacy or insurance consumer financial information
privacy;
(3) a governmental body, as defined by Section
552.003, Government Code, other than a municipally owned utility;
or
(4) a person with respect to a loan transaction, if the
person is not engaged in the business of making loans.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
Text of section effective on April 1, 2009
§ 501.052. PRIVACY POLICY NECESSARY TO REQUIRE
DISCLOSURE OF SOCIAL SECURITY NUMBER. (a) A person may not
require an individual to disclose the individual's social security
number to obtain goods or services from or enter into a business
transaction with the person unless the person:
(1) adopts a privacy policy as provided by Subsection
(b);
(2) makes the privacy policy available to the
individual; and
(3) maintains under the privacy policy the
confidentiality and security of the social security number
disclosed to the person.
(b) A privacy policy adopted under this section must
include:
(1) how personal information is collected;
(2) how and when the personal information is used;
(3) how the personal information is protected;
(4) who has access to the personal information; and
(5) the method of disposal of the personal
information.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
Text of section effective on April 1, 2009
§ 501.053. CIVIL PENALTY; INJUNCTION. (a) A person who
violates Section 501.052(a) is liable to this state for a civil
penalty in an amount not to exceed $500 for each calendar month
during which a violation occurs. The civil penalty may not be
imposed for more than one violation that occurs in a month. The
attorney general or the prosecuting attorney in the county in which
the violation occurs may bring an action to recover the civil
penalty imposed under this section.
(b) The attorney general may bring an action in the name of
the state to restrain or enjoin a person from violating Section
501.052(a).
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
SUBCHAPTER C. OTHER RESTRICTIONS TO PROTECT DRIVER'S LICENSE AND
SOCIAL SECURITY NUMBERS
Text of section effective on April 1, 2009
§ 501.101. USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL
SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY. (a) A
merchant or a third party under contract with a merchant who
requires a consumer returning merchandise to provide the consumer's
driver's license or social security number may use the number or
numbers provided by the consumer solely for identification purposes
if the consumer does not have a valid receipt for the item being
returned and is seeking a cash, credit, or store credit refund.
(b) A merchant or a third party under contract with a
merchant may not disclose a consumer's driver's license or social
security number to any other third party, including a merchant, not
involved in the initial transaction.
(c) A merchant or a third party under contract with a
merchant may use a consumer's driver's license or social security
number only to monitor, investigate, or prosecute fraudulent return
of merchandise.
(d) A merchant or a third party under contract with a
merchant shall destroy or arrange for the destruction of records
containing the consumer's driver's license or social security
number at the expiration of six months from the date of the last
transaction.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.
Text of section effective on April 1, 2009
§ 501.102. CIVIL PENALTY; INJUNCTION. (a) A person who
violates this subchapter is liable to this state for a civil penalty
in an amount not to exceed $500 for each violation. The attorney
general or the prosecuting attorney in the county in which the
violation occurs may bring an action to recover the civil penalty
imposed under this section.
(b) The attorney general may bring an action in the name of
the state to restrain or enjoin a person from violating this
subchapter.
Added by Acts 2007, 80th Leg., R.S., Ch. 885, § 2.01, eff. April
1, 2009.