Sec. 509.002.  APPLICABILITY TO CERTAIN DATA.  (a)  Except as provided by Subsection (b), this chapter applies to personal data from an individual that is collected, transferred, or processed by a data broker.
(b)  This chapter does not apply to the following data:
(1)  deidentified data, if the data broker:
(A)  takes reasonable technical measures to ensure that the data is not able to be used to identify an individual with whom the data is associated;
(B)  publicly commits in a clear and conspicuous manner:
(i)  to process and transfer the data solely in a deidentified form without any reasonable means for reidentification; and
(ii)  to not attempt to identify the information to an individual with whom the data is associated; and
(C)  contractually obligates a person that receives the information from the provider:
(i)  to comply with this subsection with respect to the information; and
(ii)  to require that those contractual obligations be included in any subsequent transfer of the data to another person;
(2)  employee data;
(3)  publicly available information;
(4)  inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data with respect to an individual; or
(5)  data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.).
Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023.