CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY NUMBERS
BUSINESS AND COMMERCE CODE
TITLE 11. PERSONAL IDENTITY INFORMATION
SUBTITLE A. IDENTIFYING INFORMATION
CHAPTER 501. PROTECTION OF DRIVER'S LICENSE AND SOCIAL SECURITY
NUMBERS
SUBCHAPTER A. CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS
Sec. 501.001. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED.
(a) A person, other than a government or a governmental
subdivision or agency, may not:
(1) intentionally communicate or otherwise make available to the
public an individual's social security number;
(2) display an individual's social security number on a card or
other device required to access a product or service provided by
the person;
(3) require an individual to transmit the individual's social
security number over the Internet unless:
(1) the Internet connection is secure; or
(2) the social security number is encrypted;
(4) require an individual's social security number for access to
an Internet website unless a password or unique personal
identification number or other authentication device is also
required for access; or
(5) except as provided by Subsection (f), print an individual's
social security number on any material sent by mail, unless state
or federal law requires that social security number to be
included in the material.
(b) A person using an individual's social security number before
January 1, 2005, in a manner prohibited by Subsection (a) may
continue that use if:
(1) the use is continuous; and
(2) beginning January 1, 2006, the person provides to the
individual an annual disclosure stating that, on written request
from the individual, the person will stop using the individual's
social security number in a manner prohibited by Subsection (a).
(c) A person, other than a government or a governmental
subdivision or agency, may not deny a service to an individual
because the individual makes a written request under Subsection
(b)(2).
(d) If a person receives a written request from an individual
directing the person to stop using the individual's social
security number in a manner prohibited by Subsection (a), the
person shall comply with the request not later than the 30th day
after the date the request is received. The person may not
impose a fee for complying with the request.
(e) This section does not apply to:
(1) the collection, use, or release of a social security number
required by state or federal law, including Chapter 552,
Government Code;
(2) the use of a social security number for internal
verification or administrative purposes;
(3) a document that is recorded or required to be open to the
public under Chapter 552, Government Code;
(4) a court record; or
(5) an institution of higher education if the use of a social
security number by the institution is regulated by Chapter 51,
Education Code, or another provision of the Education Code.
(f) Subsection (a)(5) does not apply to an application or form
sent by mail, including a document sent:
(1) as part of an application or enrollment process;
(2) to establish, amend, or terminate an account, contract, or
policy; or
(3) to confirm the accuracy of a social security number.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
Sec. 501.002. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED;
REMEDIES. (a) A person may not print an individual's social
security number on a card or other device required to access a
product or service provided by the person unless the individual
has requested in writing that printing. The person may not
require a request for that printing as a condition of receipt of
or access to a product or service provided by the person.
(b) A person who violates this section is liable to this state
for a civil penalty in an amount not to exceed $500 for each
violation. The attorney general or the prosecuting attorney in
the county in which the violation occurs may bring an action to
recover the civil penalty imposed under this section.
(c) The attorney general may bring an action in the name of the
state to restrain or enjoin a person from violating this section.
(d) This section does not apply to:
(1) the collection, use, or release of a social security number
required by state or federal law, including Chapter 552,
Government Code; or
(2) the use of a social security number for internal
verification or administrative purposes.
(e) This section applies to a card or other device issued in
connection with an insurance policy only if the policy is
delivered, issued for delivery, or renewed on or after March 1,
2005.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
SUBCHAPTER B. PRIVACY POLICY TO PROTECT SOCIAL SECURITY NUMBERS
Sec. 501.051. INAPPLICABILITY OF SUBCHAPTER. This subchapter
does not apply to:
(1) a person who is required to maintain and disseminate a
privacy policy under:
(A) the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6801 to
6809);
(B) the Family Educational Rights and Privacy Act of 1974 (20
U.S.C. Section 1232g); or
(C) the Health Insurance Portability and Accountability Act of
1996 (42 U.S.C. Section 1320d et seq.);
(2) a covered entity under rules adopted by the commissioner of
insurance relating to insurance consumer health information
privacy or insurance consumer financial information privacy;
(3) a governmental body, as defined by Section 552.003,
Government Code, other than a municipally owned utility;
(4) a person with respect to a loan transaction, if the person
is not engaged in the business of making loans; or
(5) a person subject to Section 901.457, Occupations Code.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch.
87, Sec. 4.009(a), eff. September 1, 2009.
Sec. 501.052. PRIVACY POLICY NECESSARY TO REQUIRE DISCLOSURE OF
SOCIAL SECURITY NUMBER. (a) A person may not require an
individual to disclose the individual's social security number to
obtain goods or services from or enter into a business
transaction with the person unless the person:
(1) adopts a privacy policy as provided by Subsection (b);
(2) makes the privacy policy available to the individual; and
(3) maintains under the privacy policy the confidentiality and
security of the social security number disclosed to the person.
(b) A privacy policy adopted under this section must include:
(1) how personal information is collected;
(2) how and when the personal information is used;
(3) how the personal information is protected;
(4) who has access to the personal information; and
(5) the method of disposal of the personal information.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
Sec. 501.053. CIVIL PENALTY; INJUNCTION. (a) A person who
violates Section 501.052(a) is liable to this state for a civil
penalty in an amount not to exceed $500 for each calendar month
during which a violation occurs. The civil penalty may not be
imposed for more than one violation that occurs in a month. The
attorney general or the prosecuting attorney in the county in
which the violation occurs may bring an action to recover the
civil penalty imposed under this section.
(b) The attorney general may bring an action in the name of the
state to restrain or enjoin a person from violating Section
501.052(a).
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
SUBCHAPTER C. OTHER RESTRICTIONS TO PROTECT DRIVER'S LICENSE AND
SOCIAL SECURITY NUMBERS
Sec. 501.101. USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL
SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY. (a) A
merchant or a third party under contract with a merchant who
requires a consumer returning merchandise to provide the
consumer's driver's license or social security number may use the
number or numbers provided by the consumer solely for
identification purposes if the consumer does not have a valid
receipt for the item being returned and is seeking a cash,
credit, or store credit refund.
(b) A merchant or a third party under contract with a merchant
may not disclose a consumer's driver's license or social security
number to any other third party, including a merchant, not
involved in the initial transaction.
(c) A merchant or a third party under contract with a merchant
may use a consumer's driver's license or social security number
only to monitor, investigate, or prosecute fraudulent return of
merchandise.
(d) A merchant or a third party under contract with a merchant
shall destroy or arrange for the destruction of records
containing the consumer's driver's license or social security
number at the expiration of six months from the date of the last
transaction.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
Sec. 501.1011. SALES RECEIPT CONTAINING DRIVER'S LICENSE NUMBER
PROHIBITED. A person may not print an individual's driver's
license number on a receipt that evidences payment for a sale of
goods or services and is provided to the individual.
Added by Acts 2009, 81st Leg., R.S., Ch.
90, Sec. 1, eff. January 1, 2010.
Sec. 501.102. CIVIL PENALTY; INJUNCTION. (a) A person who
violates Section 501.101 is liable to this state for a civil
penalty in an amount not to exceed $500 for each violation. The
attorney general or the prosecuting attorney in the county in
which the violation occurs may bring an action to recover the
civil penalty imposed under this subsection.
(a-1) A person who violates Section 501.1011 is liable to this
state for a civil penalty in an amount not to exceed $500 for
each calendar month in which a violation occurs. The civil
penalty may not be imposed for more than one violation that
occurs in a month. The attorney general or the prosecuting
attorney in the county in which the violation occurs may bring an
action to recover the civil penalty imposed under this
subsection.
(b) The attorney general may bring an action in the name of the
state to restrain or enjoin a person from violating this
subchapter.
Added by Acts 2007, 80th Leg., R.S., Ch.
885, Sec. 2.01, eff. April 1, 2009.
Amended by:
Acts 2009, 81st Leg., R.S., Ch.
90, Sec. 2, eff. January 1, 2010.