CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY NUMBERS

BUSINESS AND COMMERCE CODE

TITLE 11. PERSONAL IDENTITY INFORMATION

SUBTITLE A. IDENTIFYING INFORMATION

CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY

NUMBERS

SUBCHAPTER A. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS

Sec. 501.001. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED.

(a) A person, other than a government or a governmental

subdivision or agency, may not:

(1) intentionally communicate or otherwise make available to the

public an individual's social security number;

(2) display an individual's social security number on a card or

other device required to access a product or service provided by

the person;

(3) require an individual to transmit the individual's social

security number over the Internet unless:

(1) the Internet connection is secure; or

(2) the social security number is encrypted;

(4) require an individual's social security number for access to

an Internet website unless a password or unique personal

identification number or other authentication device is also

required for access; or

(5) except as provided by Subsection (f), print an individual's

social security number on any material sent by mail, unless state

or federal law requires that social security number to be

included in the material.

(b) A person using an individual's social security number before

January 1, 2005, in a manner prohibited by Subsection (a) may

continue that use if:

(1) the use is continuous; and

(2) beginning January 1, 2006, the person provides to the

individual an annual disclosure stating that, on written request

from the individual, the person will stop using the individual's

social security number in a manner prohibited by Subsection (a).

(c) A person, other than a government or a governmental

subdivision or agency, may not deny a service to an individual

because the individual makes a written request under Subsection

(b)(2).

(d) If a person receives a written request from an individual

directing the person to stop using the individual's social

security number in a manner prohibited by Subsection (a), the

person shall comply with the request not later than the 30th day

after the date the request is received. The person may not

impose a fee for complying with the request.

(e) This section does not apply to:

(1) the collection, use, or release of a social security number

required by state or federal law, including Chapter 552,

Government Code;

(2) the use of a social security number for internal

verification or administrative purposes;

(3) a document that is recorded or required to be open to the

public under Chapter 552, Government Code;

(4) a court record; or

(5) an institution of higher education if the use of a social

security number by the institution is regulated by Chapter 51,

Education Code, or another provision of the Education Code.

(f) Subsection (a)(5) does not apply to an application or form

sent by mail, including a document sent:

(1) as part of an application or enrollment process;

(2) to establish, amend, or terminate an account, contract, or

policy; or

(3) to confirm the accuracy of a social security number.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Sec. 501.002. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED;

REMEDIES. (a) A person may not print an individual's social

security number on a card or other device required to access a

product or service provided by the person unless the individual

has requested in writing that printing. The person may not

require a request for that printing as a condition of receipt of

or access to a product or service provided by the person.

(b) A person who violates this section is liable to this state

for a civil penalty in an amount not to exceed $500 for each

violation. The attorney general or the prosecuting attorney in

the county in which the violation occurs may bring an action to

recover the civil penalty imposed under this section.

(c) The attorney general may bring an action in the name of the

state to restrain or enjoin a person from violating this section.

(d) This section does not apply to:

(1) the collection, use, or release of a social security number

required by state or federal law, including Chapter 552,

Government Code; or

(2) the use of a social security number for internal

verification or administrative purposes.

(e) This section applies to a card or other device issued in

connection with an insurance policy only if the policy is

delivered, issued for delivery, or renewed on or after March 1,

2005.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

SUBCHAPTER B. PRIVACY POLICY TO PROTECT SOCIAL SECURITY NUMBERS

Sec. 501.051. INAPPLICABILITY OF SUBCHAPTER. This subchapter

does not apply to:

(1) a person who is required to maintain and disseminate a

privacy policy under:

(A) the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6801 to

6809);

(B) the Family Educational Rights and Privacy Act of 1974 (20

U.S.C. Section 1232g); or

(C) the Health Insurance Portability and Accountability Act of

1996 (42 U.S.C. Section 1320d et seq.);

(2) a covered entity under rules adopted by the commissioner of

insurance relating to insurance consumer health information

privacy or insurance consumer financial information privacy;

(3) a governmental body, as defined by Section 552.003,

Government Code, other than a municipally owned utility;

(4) a person with respect to a loan transaction, if the person

is not engaged in the business of making loans; or

(5) a person subject to Section 901.457, Occupations Code.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Amended by:

Acts 2009, 81st Leg., R.S., Ch.

87, Sec. 4.009(a), eff. September 1, 2009.

Sec. 501.052. PRIVACY POLICY NECESSARY TO REQUIRE DISCLOSURE OF

SOCIAL SECURITY NUMBER. (a) A person may not require an

individual to disclose the individual's social security number to

obtain goods or services from or enter into a business

transaction with the person unless the person:

(1) adopts a privacy policy as provided by Subsection (b);

(2) makes the privacy policy available to the individual; and

(3) maintains under the privacy policy the confidentiality and

security of the social security number disclosed to the person.

(b) A privacy policy adopted under this section must include:

(1) how personal information is collected;

(2) how and when the personal information is used;

(3) how the personal information is protected;

(4) who has access to the personal information; and

(5) the method of disposal of the personal information.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Sec. 501.053. CIVIL PENALTY; INJUNCTION. (a) A person who

violates Section 501.052(a) is liable to this state for a civil

penalty in an amount not to exceed $500 for each calendar month

during which a violation occurs. The civil penalty may not be

imposed for more than one violation that occurs in a month. The

attorney general or the prosecuting attorney in the county in

which the violation occurs may bring an action to recover the

civil penalty imposed under this section.

(b) The attorney general may bring an action in the name of the

state to restrain or enjoin a person from violating Section

501.052(a).

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

SUBCHAPTER C. OTHER RESTRICTIONS TO PROTECT DRIVER'S LICENSE AND

SOCIAL SECURITY NUMBERS

Sec. 501.101. USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL

SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY. (a) A

merchant or a third party under contract with a merchant who

requires a consumer returning merchandise to provide the

consumer's driver's license or social security number may use the

number or numbers provided by the consumer solely for

identification purposes if the consumer does not have a valid

receipt for the item being returned and is seeking a cash,

credit, or store credit refund.

(b) A merchant or a third party under contract with a merchant

may not disclose a consumer's driver's license or social security

number to any other third party, including a merchant, not

involved in the initial transaction.

(c) A merchant or a third party under contract with a merchant

may use a consumer's driver's license or social security number

only to monitor, investigate, or prosecute fraudulent return of

merchandise.

(d) A merchant or a third party under contract with a merchant

shall destroy or arrange for the destruction of records

containing the consumer's driver's license or social security

number at the expiration of six months from the date of the last

transaction.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Sec. 501.1011. SALES RECEIPT CONTAINING DRIVER'S LICENSE NUMBER

PROHIBITED. A person may not print an individual's driver's

license number on a receipt that evidences payment for a sale of

goods or services and is provided to the individual.

Added by Acts 2009, 81st Leg., R.S., Ch.

90, Sec. 1, eff. January 1, 2010.

Sec. 501.102. CIVIL PENALTY; INJUNCTION. (a) A person who

violates Section 501.101 is liable to this state for a civil

penalty in an amount not to exceed $500 for each violation. The

attorney general or the prosecuting attorney in the county in

which the violation occurs may bring an action to recover the

civil penalty imposed under this subsection.

(a-1) A person who violates Section 501.1011 is liable to this

state for a civil penalty in an amount not to exceed $500 for

each calendar month in which a violation occurs. The civil

penalty may not be imposed for more than one violation that

occurs in a month. The attorney general or the prosecuting

attorney in the county in which the violation occurs may bring an

action to recover the civil penalty imposed under this

subsection.

(b) The attorney general may bring an action in the name of the

state to restrain or enjoin a person from violating this

subchapter.

Added by Acts 2007, 80th Leg., R.S., Ch.

885, Sec. 2.01, eff. April 1, 2009.

Amended by:

Acts 2009, 81st Leg., R.S., Ch.

90, Sec. 2, eff. January 1, 2010.