TEXASDATA LAW

Topic

Sensitive and Sector Data

This hub keeps distinct regimes apart when they govern the same dataset. It compares the TDPSA's sensitive-data category with the Capture or Use of Biometric Identifier Act's biometric identifiers under § 503.001, including the HB 149 amendments, consent and retention rules, publicly available images, fraud and security uses, data repurposing, precise geolocation, generated sensitive inferences, and biometric-enforcement allegations. It covers the Texas Genomic Act (HB 130) with its foreign-adversary sequencing and software restrictions, security and transfer duties, bankruptcy-sale restrictions, the annual December 31 certification under § 174.008, and the particular private right under § 174.011, with the 23andMe bankruptcy as the standing information-asset and consent scenario. Health data gets two layers: the Texas Medical Records Privacy Act in Business and Commerce Code chapter 181, with its unusually broad covered-entity definition, training and authorization requirements, HB 4224 notices, SB 1188 physical-storage rules for electronic health records, and its relation to HIPAA; and consumer health data held outside HIPAA, under the TDPSA, the FTC Health Breach Notification Rule in 16 C.F.R. part 318, and other states' health-data laws. Financial, insurance, education, employment, geolocation, connected-vehicle, and device data each get regime-specific treatment: GLBA privacy and the Safeguards Rule with FTC breach reporting, the FCRA, SEC Regulation S-P, FERPA and Texas Education Code duties, the TDPSA employment context without an overbroad exemption, and the cases involving General Motors with OnStar and Allstate with Arity.

Key questions

  • When is sensitive-data consent required, and which statute's definition controls
  • Which duties apply to biometric identifiers under Texas law
  • What does the Texas Genomic Act require of holders of genetic data
  • When may health or genomic data cross a border
  • Which rules govern financial, insurance, education, workplace, and vehicle data

Controlling authorities

TDPSA sensitive-data provisions; CUBI § 503.001; Texas Genomic Act (HB 130), §§ 174.008 and 174.011; Business and Commerce Code chapter 181 (Medical Records Privacy Act); SB 1188; HB 4224; 45 C.F.R. parts 160 and 164 (HIPAA); 42 C.F.R. part 2; 16 C.F.R. part 318 (FTC Health Breach Notification Rule); GLBA and the FTC Safeguards Rule, 16 C.F.R. part 314; FCRA; FERPA.

Guides in this hub

Planned insights

  • I05 Texas Health Records and Foreign Cloud Access (SB 1188, covered records, physical location, authorized access, and vendor diligence)
  • I15 An Employee Exclusion Does Not Resolve All Workplace Privacy Duties (the TDPSA definition alongside biometrics, credit, health, monitoring, and multistate law); candidates from the bank: genomic certification and private claims; smart-TV consent and ACR.

Tracker records

  • K04 Texas CUBI and current AI-related amendments
  • K34 FTC Health Breach Notification Rule amendments
  • K35 FTC GLBA Safeguards Rule including notification duty
  • K36 SEC Regulation S-P amendments and phased compliance
  • K37 HIPAA privacy security and breach requirements
  • K38 42 CFR part 2 substance-use confidentiality amendments
  • K39 FERPA and school disclosure regulations
  • K40 FCRA consumer-reporting data duties
  • K50 Washington and Nevada consumer-health-data regimes
  • K51 Illinois BIPA amendments and controlling decisions
  • RK003 Capture or Use of Biometric Identifier Act (CUBI)
  • RK009 Texas Medical Records Privacy Act
  • RK010 SB 1188 (2025)
  • RK011 Texas Genomic Act of 2025
  • RK016 Social Security number and identity data rules
  • RK018 education data
  • RK019 insurance
  • RK023 General Motors and OnStar
  • RK024 Allstate and Arity
  • RK030 PowerSchool
  • RK042 Texas AG TP-Link privacy notice
  • RK043 Texas AG Alibaba privacy notice
  • RK044 Texas AG CapCut privacy notice
  • RK046 23andMe bankruptcy (consumer privacy ombudsman and genetic-data sale)
  • RK048 Texas v. HHS dismissal and docket
  • RK049 Purl v. HHS reproductive-health privacy ruling and current appeal status
  • RK055 HIPAA Privacy, Security, and Breach Notification Rules
  • RK056 GLBA Privacy Rule and FTC Safeguards Rule
  • RK061 FTC Health Breach Notification Rule (16 C.F.R. part 318).

Companion links