Data Privacy Enforcement Tracker

As part of implementing the Texas Data Privacy and Security Act (TDPSA), the Texas Department of Information Resources (DIR) is mandated to prepare and publish a report on the law’s implementation, including recommendations for potential changes. On December 30, 2024, the DIR released its report, incorporating valuable insights from two primary stakeholders: the Texas Attorney General and consumers.

Key Findings from the Texas Attorney General

The Texas Attorney General’s contributions underscored a strong commitment to addressing consumer privacy concerns. Within the first four and a half months of the TDPSA’s enforcement, 660 privacy complaints were filed across a wide range of industries—a significantly higher volume compared to other states with similar programs.

These complaints were primarily categorized into two areas:

1. Data Practices: Issues related to the collection, storage, use, sharing, and sale of consumer data.
2. Data Breaches: Incidents involving unauthorized access or exposure of personal information.

As of the report’s publication, the Texas Attorney General’s office had initiated 29 active investigations, many of which are expected to result in the issuance of notice-of-violation letters.

Consumer Engagement and Feedback

Consumer feedback highlighted a notable increase in public awareness and engagement regarding privacy issues. Compared to previous years, consumers are taking a more active role in understanding how their personal data is collected and used. Key areas of focus for consumers included:

• Education: A desire for greater resources and guidance on understanding the TDPSA and exercising their rights under the law.
• Streamlined Opt-Out Processes: A strong push for consistent and user-friendly methods for opting out of data collection and sharing practices across all data controllers.

Implications for Businesses

Although the TDPSA has been in effect for less than seven months, the combination of increased consumer engagement and active enforcement efforts by the Texas Attorney General signals a clear warning for businesses: data privacy must be a top priority.

The report highlights several critical points for companies to consider:

• Regulatory Risks: The Texas Attorney General’s focus on leveraging consumer complaints to initiate investigations, combined with a well-resourced consumer protection team, significantly heightens the risk of enforcement actions.
• Transparency: Businesses should proactively update their privacy notices to ensure clarity and transparency in their data collection and usage practices.
• Proactive Compliance: While the TDPSA provides a 30-day cure period for addressing violations, companies that delay compliance efforts until they receive a notice-of-violation letter will likely find it too late to respond effectively.

Recommendations for Businesses

To mitigate regulatory risks and enhance consumer trust, companies should take steps to:

1. Review and Update Privacy Policies: Ensure that privacy notices are comprehensive, transparent, and in full compliance with TDPSA requirements.
2. Streamline Opt-Out Mechanisms: Implement standardized and user-friendly processes to facilitate consumer requests.
3. Invest in Privacy Training and Education: Equip teams with the knowledge and tools necessary to uphold data privacy standards and respond promptly to consumer inquiries or complaints.

Conclusion

The TDPSA’s early enforcement activities highlight a shifting landscape where both regulators and consumers are placing heightened scrutiny on data privacy practices. Companies that take proactive steps to prioritize transparency, compliance, and consumer engagement will not only reduce their regulatory exposure but also strengthen their reputation in an increasingly privacy-conscious market.