The 86th Texas Legislature passed several bills related to cybersecurity during its regular session, which came to a close on May 27, 2019.
Texas Privacy Protection Advisory Council
HB 4390, which creates a Texas Privacy Protection Advisory Council to study privacy laws in Texas, other states, and relevant foreign jurisdictions, has been sent to the Governor for signature. Composed of members of the Texas House of Representatives, Texas Senate, and relevant industry members appointed by the Governor, the Council will be charged with recommending statutory changes regarding privacy and protection of information to the Legislature. The Council will expire on December 31, 2020.
We previously covered the evolution of this bill here and here. It was originally modeled after the California Consumer Privacy Act and would have granted significant privacy rights to Texas residents. Ultimately, Texas—like many other states considering similar legislation this legislative session—decided not to move forward with enacting consumer privacy legislation (for now).
Updates to Data Beach Notification Statute
HB 4390 also amends the state’s pre-existing data breach notification statute to require disclosure of a breach of certain computerized personal data to be made “not later than the 60th day after the date on which the person determines the breach occurred.” The statute defines “breach of system security” as the “unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.”
The bill also requires the person or entity that owns or licenses the compromised data to notify the Texas Attorney General if the breach involved 250 or more state residents. That notice will need to be provided within the same 60-day timeframe for providing notice to residents and must describe the nature of the breach, identify the number of affected residents, explain the measures taken to resolve the breach, and state whether law enforcement is investigating. The breach notification statute already provides the Attorney General’s office with the ability to seek substantial damages for violations of its provisions. Therefore, covered entities will need to ensure that they strictly comply with the statute’s requirements.
If it becomes law, the bill will take effect on September 1, 2019, with the exception of the portion that modifies Section 521.053 of the Texas Business & Commerce Code concerning disclosure requirements, which will take effect on January 1, 2020.
PUC Cybersecurity Monitor
SB 936, which requires the PUC and the Electric Reliability Council of Texas (ERCOT) to contract with an entity to act as the PUC’s cybersecurity monitor (Monitor), has been sent to the Governor for signature. The Monitor manages a cybersecurity outreach program for utilities, including transmission and distribution utilities, wholesale retailers of electric energy on behalf of river authorities, and certain municipally owned utilities or electric cooperatives that operate inside the ERCOT power region, or operate solely outside of the ERCOT power region and elect to participate in the program. The Monitor is to meet regularly with utilities to discuss emerging threats, best business practices, and training opportunities, and would review self-assessments of cybersecurity efforts voluntarily disclosed by utilities. The bill also amends Section 35.213 of the Texas Utilities Code to allow electric utilities to recover reasonable and necessary costs incurred in connection with activities under Section 39.1516. Upon becoming law, the bill will take effect on September 1, 2019.
Texas Electric Grid Security Council
SB 475, also sent to the Governor for signature and set to take effect immediately upon becoming law, establishes the Texas Electric Grid Security Council as an advisory body to facilitate the development and dissemination of best security practices for the electric industry composed of the PUC Commissioner, the CEO of ERCOT, and the Governor (or the Governor’s representative). This bill was one of the PUC’s recommendations in its Scope of Competition Report to the Legislature.
PUC Program to Monitor Cybersecurity Efforts
SB 64, revising cybersecurity requirements for state agency information resources, including oversight of cybersecurity practices and the state’s electric grid, has also been sent to the Governor for signature. The bill requires the PUC to establish a program to monitor cybersecurity efforts among utilities in Texas, defining utilities as electric co-ops, electric utilities, municipally owned electric utilities, retail electric providers, and transmission and distribution utilities. It also requires ERCOT to conduct an internal cybersecurity risk assessment, vulnerability testing, and employee training, and to submit an annual report to the PUC on compliance with applicable cybersecurity and information security laws. If it becomes law, the bill would take effect on September 1, 2019.