Relating to the protection of personal identifying information of certain persons in the judicial system; authorizing a civil right of action; creating criminal offenses.

89(R) SB 2459 - Senate Committee Report version - Bill Text

By: Creighton

S.B. No. 2459

(In the Senate - Filed March 13, 2025; March 25, 2025, read

first time and referred to Committee on State Affairs; May 7, 2025,

reported adversely, with favorable Committee Substitute by the

following vote: Yeas 11, Nays 0; May 7, 2025, sent to printer.)
Click here to see the committee vote

COMMITTEE SUBSTITUTE FOR S.B. No. 2459

By: Birdwell

A BILL TO BE ENTITLED

AN ACT

relating to the protection of personal identifying information of

certain persons in the judicial system; authorizing a civil right

of action; creating criminal offenses.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. The heading to Subtitle H, Title 2, Government

Code, is amended to read as follows:

SUBTITLE H. INFORMATION RESOURCES
AND PRIVACY

SECTION 2. Subtitle H, Title 2, Government Code, is amended

by adding Chapter 92 to read as follows:

CHAPTER 92.

PROTECTION OF PERSONAL IDENTIFYING INFORMATION OF

AT-RISK INDIVIDUALS COLLECTED AND STORED BY DATA BROKERS AND OTHER

PERSONS

Sec. 92.001. DEFINITIONS. In this chapter:

(1) "At-risk individual" means:

(A) a judge, as defined by Section 33.001;

(B) a court clerk; and

(C)

an employee of a state court, a court clerk,

the office, or another agency in the judicial branch of state

government.

(2)

"Court clerk" means the clerk of the supreme

court, the court of criminal appeals, a court of appeals, a district

court, a county court, a statutory county court, a statutory

probate court, a justice court, or a municipal court.

(3) "Covered information":

(A) means:

(i)

a home address, including primary and

secondary residences;

(ii)

a home or personal telephone number,

including a mobile telephone number;

(iii) an e-mail address;

(iv)

a social security number or driver's

license number;

(v)

bank account, credit card, or debit

card information;

(vi)

a license plate number or other unique

identifier of a vehicle owned, leased, or regularly used;

(vii)

the identity of a child younger than

18 years of age;

(viii) a person's date of birth;

(ix)

information regarding current or

future school or day care attendance, including the name or address

of the school or day care, schedules of attendance, or routes taken

to or from the school or day care;

(x)

employment information, including the

name or address of the employer, employment schedules, or routes

taken to or from the employer's location; and

(xi)

photographs or videos that reveal

information listed in Subparagraphs (i)-(x); and

(B)

does not include information regarding

employment with a state agency.

(4)

"Data broker" has the meaning assigned by Section

509.001, Business & Commerce Code, as added by Chapter 963

(S.B.

2105), Acts of the 88th Legislature, Regular Session, 2023.

The term does not include a commercial entity that:

(A) is engaged in the business of:

(i)

reporting, news-gathering, speaking,

or engaging in other activities intended to inform the public on

matters of public interest or public concern;

(ii)

providing 411 directory assistance or

directory information services, including name, address, and

telephone number, on behalf of or as a function of a

telecommunications carrier;

(iii)

using personal information

internally, by providing access to businesses under common

ownership or affiliated by corporate control, or selling or

providing data for a transaction or service requested by or

concerning the individual whose personal information is being

transferred;

(iv)

providing publicly available

information using real-time or near real-time alert services for

health or safety purposes; or

(v)

collecting and selling or licensing

covered information incidental to conducting the activities

described by this subdivision; or

(B) is engaged in business as:

(i)

a consumer reporting agency subject to

Chapter 20, Business & Commerce Code, and the Fair Credit Reporting

Act (15 U.S.C. Section 1681 et seq.);

(ii)

a financial institution subject to the

Gramm-Leach-Bliley Act (Pub. L. No. 106-102) and regulations

implementing that Act; or

(iii)

a covered entity for purposes of the

privacy regulations promulgated under Section 264(c), Health

Insurance Portability and Accountability Act of 1996 (42 U.S.C.

Section 1320d-2 note).

(5)

"Immediate family member" means a person related

to another person within the first degree by consanguinity or

affinity, as described by Subchapter B, Chapter 573.

The term

includes a foster child, ward, legal dependent, or individual

residing in the same household.

(6)

"Office" means the Office of Court Administration

of the Texas Judicial System.

(7)

"State agency" means a public entity in the

executive, judicial, or legislative branch of state government.

(8) "State court" means:

(A)

the supreme court or the court of criminal

appeals;

(B)

an appellate court, district court, or

division of the business court;

(C)

a county court, constitutional county court,

statutory county court, or statutory probate court;

(D) a justice court; or

(E) a municipal court.

Sec.

92.002.

DATA BROKER PROHIBITIONS. Notwithstanding any

other law, a data broker may not knowingly sell, license, trade for

consideration, transfer, or purchase covered information of an

at-risk individual or an immediate family member of the individual.

Sec.

92.003.

PROHIBITED DISPLAY OF COVERED INFORMATION.

(a)

Except as provided by Subsection (b), a person, including a

data broker, may not publicly post or display on a publicly

accessible Internet website covered information of an at-risk

individual or an immediate family member of the individual if the

at-risk individual, or the office, acting on the individual's

behalf, submits a written request to that person not to disclose or

acquire the covered information that is the subject of the request.

(b) Subsection (a) does not apply to:

(1)

covered information of an at-risk individual or an

immediate family member of the individual displayed on a publicly

accessible Internet website if the information is relevant to and

displayed as part of a news story, commentary, editorial, or other

speech on a matter of public concern;

(2)

covered information that an at-risk individual

voluntarily posts on the Internet; or

(3)

covered information received from a governmental

entity or an employee or agent of a governmental entity.

Sec.

92.004.

DUTY OF DATA BROKER TO REMOVE COVERED

INFORMATION. After receiving a written request under Section

92.003, a data broker shall:

(1)

not later than 72 hours after receipt of the

request:

(A)

remove from the Internet website the covered

information identified in the request;

(B)

ensure the information is not made available

on any other publicly accessible Internet website or subsidiary

website the data broker controls; and

(C)

identify any other instances of the

information that should be removed; and

(2)

assist the sender in locating the covered

information that may be posted on any publicly accessible Internet

website or subsidiary website controlled by the data broker.

Sec.

92.005.

OFFICE PROCEDURES. The judicial security

division of the office shall develop a process by which a judge can

file a written request with the director of the office to notify a

data broker or other person, on the judge's behalf, of a written

request submitted by the judge to remove covered information posted

or displayed by the person on a publicly accessible Internet

website.

Sec.

92.006.

TRANSFER. (a)

Except as provided by

Subsection (b), after receiving a written request under Section

92.003, the person may not transfer the covered information to any

other person through any medium.

(b) Subsection (a) does not apply to:

(1)

the transfer of the covered information that is

relevant to and displayed as part of a news story, commentary,

editorial, or other speech on a matter of public concern;

(2)

covered information the at-risk individual or the

immediate family member of the individual voluntarily posts on the

Internet; or

(3) a transfer of the covered information:

(A) at the request of the at-risk individual; or

(B)

as necessary to produce a request to the

person from the at-risk individual.

Sec.

92.007.

CIVIL REMEDIES. (a)

If the covered

information of an at-risk individual or an immediate family member

of the individual is made public as a result of a violation of this

chapter, the at-risk individual or the individual's designee may

bring an action in a court seeking injunctive or declaratory

relief.

(b)

If the plaintiff prevails in an action brought under

Subsection (a), the court, in addition to issuing an order for

injunctive or declaratory relief, may:

(1)

impose a fine of $500 for each day the covered

information remains public after the date on which the order for

injunctive or declaratory relief is issued; and

(2)

if the defendant is not a state agency, award to

the at-risk individual, or the individual's immediate family,

exemplary damages, court costs, and reasonable attorney's fees.

Sec.

92.008.

CRIMINAL OFFENSES. (a)

A person commits an

offense if:

(1)

the person intentionally posts covered

information of an at-risk individual or an immediate family member

of the individual on a publicly accessible Internet website without

first obtaining the consent of the individual whose information was

posted;

(2)

the information is posted with intent to cause or

threaten to cause harm to or harassment of an at-risk individual or

a member of the individual's immediate family; and

(3)

under the circumstances, harm to or harassment of

the at-risk individual or immediate family member is a probable

consequence of the posting of the information.

(b)

A person other than a data broker commits an offense if

the person does not remove from a publicly accessible Internet

website controlled by the person covered information identified in

a written request submitted under Section 92.003 within 48 hours of

receiving the request.

(c)

For purposes of Subsection (a), it is prima facie

evidence of the intent to cause or threaten to cause harm to or

harassment of an at-risk individual or a member of the individual's

immediate family if the person:

(1)

receives a written request not to disclose the

covered information for safety reasons; and

(2) either:

(A)

fails to remove the covered information from

the Internet website within 48 hours of receiving the request; or

(B)

before the fourth anniversary of the date the

business receives the request, reposts the covered information on

the same Internet website or another publicly accessible Internet

website or makes the information publicly available through another

medium.

(d)

An offense under this section is a Class B misdemeanor,

except that the offense is a Class A misdemeanor if the offense

results in the bodily injury of:

(1)

the at-risk individual whose covered information

was posted on the Internet website; or

(2) an immediate family member of the individual.

SECTION 3. (a) Chapter 92, Government Code, as added by

this Act, applies only to covered information posted on a publicly

accessible Internet website on or after the effective date of this

Act.

(b) Sections 92.003 and 92.004, Government Code, as added by

this Act, apply to covered information available on a publicly

accessible Internet website on or after the effective date of this

Act, regardless of the date on which the information was originally

posted.

(c) The Office of Court Administration of the Texas Judicial

System is required to implement Section 92.005, Government Code, as

added by this Act, only if the legislature appropriates money

specifically for that purpose. If the legislature does not

appropriate money specifically for that purpose, the office may,

but is not required to, implement Section 92.005 using other

appropriations available for that purpose.

(d) The Office of Court Administration of the Texas Judicial

System may develop or procure a statewide technology system to

automate the process described in Section 92.005, Government Code,

as added by this Act.

(e) Section 92.008, Government Code, as added by this Act,

applies only to an offense committed on or after the effective date

of this Act. For purposes of this section, an offense is committed

before the effective date of this Act if any element of the offense

occurs before that date.

SECTION 4. It is the intent of the 89th Legislature, Regular

Session, 2025, that the amendments made by this Act to Section

92.001(4), Government Code, be harmonized with another Act of the

89th Legislature, Regular Session, 2025, relating to

nonsubstantive additions to and corrections in enacted codes.

SECTION 5. This Act takes effect September 1, 2025.

* * * * *