PART 4. OFFICE OF THE SECRETARY OF STATE
CHAPTER 106. REGISTRATION OF DATA BROKERS
The Office of the Secretary of State (Office) adopts new Chapter 106, §§106.1 - 106.5, concerning registration of data brokers. The Office adopts these rules to implement the new registration requirements for data brokers in Senate Bill 2105, enacted by the 88th Legislature, Regular Session, codified at Chapter 509 of the Texas Business and Commerce Code (SB 2105).
Section 106.1 is adopted without changes to the proposed text as published in the September 29, 2023, issue of the Texas Register (48 TexReg 5593). This rule will not be republished.
Sections 106.2, 106.3, 106.4, and 106.5 are adopted with changes to the proposed text as published in the September 29, 2023, issue of the Texas Register (48 TexReg 5593). These rules will be republished. The changes to §106.2 and §106.4 are similar in nature and primarily simplify the execution requirements for documents submitted under those respective sections. The change to §106.3 updates a defined term and is nonsubstantive. The changes to §106.5 alter the text of the associated figures in response to public comments received, as described below.
BACKGROUND INFORMATION AND JUSTIFICATION
The adoption implements SB 2105 (88th Legislature, Regular Session), which creates a comprehensive framework in Chapter 509 of the Texas Business and Commerce Code to regulate data brokers. The bill took effect on September 1, 2023.
As enacted by SB 2105, Chapter 509 of the Texas Business and Commerce Code requires a data broker (as defined in Texas Business and Commerce Code §509.001(4)) to register annually with the Office. Texas Business and Commerce Code §509.005 specifies the amount of the registration or renewal fee and identifies the information that must be included in a data broker's registration statement filed with the Office. Texas Business and Commerce Code §509.006 directs the Secretary of State to establish and maintain, on its Internet website, a searchable, central registry of data brokers registered under §509.005. Texas Business and Commerce Code §509.004 requires a data broker that maintains an Internet website or mobile application to post a conspicuous notice on the website or application that, in part, contains the language provided by rule of the Office for inclusion in the notice.
Section 2 of SB 2105 requires the Office, not later than December 1, 2023, to adopt rules necessary to facilitate registration by a data broker under Texas Business and Commerce Code §509.005. Section 2 also directs the Office to incorporate into the rules adequate time for a data broker to comply with Chapter 509 of the Texas Business and Commerce Code following the adoption of the rules.
The purpose of these new rules under Chapter 106 (Registration of Data Brokers) is to provide information regarding the procedures for data broker registration with the Office and the posting of a notice on the data broker's Internet website or mobile application, in accordance with SB 2105.
COMMENTS
The 30-day comment period ended on October 29, 2023. During this period, the Office received comments regarding the proposed rules from the Association of National Advertisers, the Coalition for Sensible Public Records Access, the Texas Council on Family Violence, and Texas Appleseed. A summary of the comments relating to the proposed rules and the Office's responses follows.
Comment: Two commenters suggested revising proposed §106.2(b)(1) to require contact information for the data broker, rather than for the individual submitting the registration statement or renewal application. The commenters maintained that requiring contact information for an individual submitter would obligate a data broker to submit a statement of correction under proposed §106.4 each time that information changed, such as the individual submitter's death or departure from employment by the data broker.
Response: The Office declines to revise §106.2(b)(1) as suggested. Texas Business and Commerce Code §509.005(b) already requires contact information for the data broker and such information for the individual submitter is necessary for administrative purposes. The Office also notes that a statement of correction is neither required nor appropriate under these rules if information was accurate at the time of registration or renewal, as applicable, but changed at a later date. Instead, a registered data broker would provide the desired contact information in its renewal application. The Office did not make changes in response to these comments.
Comment: Two commenters recommended revising proposed §106.2(b) to include either a requirement or request for a data broker to provide information related to its general opt-out policies, in addition to similar information otherwise required under Texas Business and Commerce Code §509.005(b)(5)(A).
Response: The Office declines to include the suggested revision because Texas Business and Commerce Code §509.005(c) already permits a data broker to provide such additional information in the registration statement or renewal application, as applicable. The Office did not make changes in response to these comments.
Comment: One commenter requested adding an amendment filing to address updates to information that was otherwise correct at the time of registration or renewal. Two commenters appeared to be under the impression that a statement of correction filed under proposed §106.4 could function to update information on an interim basis.
Response: The Office reiterates that a statement of correction is not appropriate under these rules if information was accurate at the time of registration or renewal, as applicable, but changed at a later date. Instead, a registered data broker would provide the desired contact information in its renewal application. The Office did not make changes in response to this comment.
Comment: Three commenters suggested revising proposed §106.5(1) and §106.5(2) to improve the clarity and accessibility of the notice language required by Texas Business and Commerce Code §509.004.
Response: The Office agrees with the comments. The required notice language in §106.5(1) and §106.5(2) has been revised accordingly.
Comment: Two commenters suggested revising proposed §106.5, concerning the notice requirements, so that a data broker's obligation to post the required notice is contingent upon the filing of its initial registration statement, rather than the effective date of the rules. One commenter appeared to be under the impression that the Office would be in a position to determine that a particular data broker is not required to register under Chapter 509 of the Texas Business and Commerce Code.
Response: The Office disagrees that a data broker's compliance with the notice requirement is or can be conditioned on filing its initial registration statement. Texas Business and Commerce Code §§509.004 and 509.005 relate to the notice and registration requirements, respectively. There is no indication in those sections or elsewhere in Chapter 509 of the Texas Business and Commerce Code that either requirement is dependent on or triggered by the other. Importantly, proposed §106.5 simply provides the required notice language pursuant to Texas Business and Commerce Code §509.004. The Office anticipates that relevant information about data brokers and the data broker registration process will be available on the Office's website prior to or on December 1, 2023, and this will be sufficient to address any potential confusion by the public. The Office also notes that the Office cannot determine whether a particular data broker is subject to Chapter 509 of the Texas Business and Commerce Code or is required to file either an initial registration statement or renewal application. The Office did not make changes in response to these comments.
Comment: One commenter requested an additional rule relating to the location in which the required notice would be published on the data broker's website or mobile application.
Response: The Office declines to add a rule relating to the placement of the required notice, as that decision should be at the discretion of each data broker. The Office did not make changes in response to this comment.
Comment: Two commenters offered recommendations relating to features of the central registry of registered data brokers that will be maintained on the Office's website pursuant to Texas Business and Commerce Code §509.006. The commenters suggested that the Office allow the public to access a complete list of registrants and their full registration statements on the registry. The commenters also asked the Office to prioritize the accessibility and usability of the registry.
Response: The Office acknowledges and appreciates these comments. Although the data broker registry is outside the scope of the proposed rules, the Office's development of the registry is ongoing and will include some of the suggested considerations and other features that are intended to make the registry functional and accessible to the public. The Office did not make changes in response to these comments.
SUBCHAPTER A. DEFINITIONS
STATUTORY AUTHORITY
The new rules are adopted as authorized by Texas Business and Commerce Code §509.010 and Texas Government Code §2001.004(1). Texas Business and Commerce Code §509.010 authorizes the Office to adopt rules as necessary to implement Chapter 509 of the Texas Business and Commerce Code. Texas Government Code §2001.004 requires a state agency to adopt rules of practice stating the nature and requirements of formal and informal procedures.
The agency certifies that legal counsel has reviewed the adoption and found it to be a valid exercise of the agency's legal authority.
Filed with the Office of the Secretary of State on November 14, 2023.
TRD-202304263
Adam Bitter
General Counsel
Office of the Secretary of State
Effective date: December 4, 2023
Proposal publication date: September 29, 2023
For further information, please call: (512) 463-5770
STATUTORY AUTHORITY
The new rules are adopted as authorized by Texas Business and Commerce Code §509.010 and Texas Government Code §2001.004(1). Texas Business and Commerce Code §509.010 authorizes the Office to adopt rules as necessary to implement Chapter 509 of the Texas Business and Commerce Code. Texas Government Code §2001.004 requires a state agency to adopt rules of practice stating the nature and requirements of formal and informal procedures.
§106.2.Registration and Renewal of Data Brokers.
(a) A complete initial registration statement or renewal application is comprised of:
(1) A completed registration statement or renewal application that is signed by a person authorized to act by or on behalf of the data broker, in the form promulgated by the secretary (See Form 4001); and
(2) Payment of the registration fee or renewal fee stated in Business and Commerce Code §509.005(a) or §509.005(d), as applicable.
(b) A registration statement or renewal application must comply with Business and Commerce Code §509.005, and also provide:
(1) For the individual submitting the registration statement or renewal application:
(A) The individual's legal name;
(B) The individual's telephone number;
(C) The individual's primary physical address;
(D) The individual's mailing address; and
(E) The individual's e-mail address.
(2) For all renewals, the renewal application must also:
(A) Specify that the submission is a renewal application related to an existing registration certificate; and
(B) Provide the registration number assigned to the data broker by the secretary.
§106.3.Timing of Registration.
(a) A registration certificate expires on the first anniversary of its date of issuance by the secretary.
(b) A data broker seeking to renew an existing registration certificate shall file a renewal application within ninety (90) days before the expiration of the registration certificate.
(c) The initial registration of a data broker to which Chapter 509 of the Business and Commerce Code applies must be filed on or before March 1, 2024.
The agency certifies that legal counsel has reviewed the adoption and found it to be a valid exercise of the agency's legal authority.
Filed with the Office of the Secretary of State on November 14, 2023.
TRD-202304264
Adam Bitter
General Counsel
Office of the Secretary of State
Effective date: December 4, 2023
Proposal publication date: September 29, 2023
For further information, please call: (512) 463-5770
STATUTORY AUTHORITY
The new rule is adopted as authorized by Texas Business and Commerce Code §509.010 and Texas Government Code §2001.004(1). Texas Business and Commerce Code §509.010 authorizes the Office to adopt rules as necessary to implement Chapter 509 of the Texas Business and Commerce Code. Texas Government Code §2001.004 requires a state agency to adopt rules of practice stating the nature and requirements of formal and informal procedures.
§106.4.Corrections.
(a) A data broker must submit a statement of correction if, during the year, it becomes known to the registrant that any information given at the time of registration or renewal, as applicable, was inaccurate.
(b) A statement of correction must include the following information:
(1) The legal name of the data broker;
(2) The date of the last filed registration statement or renewal application;
(3) The registration number assigned to the data broker by the secretary; and
(4) A statement that identifies the inaccuracy and provides the corrected information.
(c) The statement of correction must be signed by a person authorized to act by or on behalf of the data broker in the same manner as a registration statement or renewal application.
(d) There is no filing fee for a correction.
The agency certifies that legal counsel has reviewed the adoption and found it to be a valid exercise of the agency's legal authority.
Filed with the Office of the Secretary of State on November 14, 2023.
TRD-202304265
Adam Bitter
General Counsel
Office of the Secretary of State
Effective date: December 4, 2023
Proposal publication date: September 29, 2023
For further information, please call: (512) 463-5770
STATUTORY AUTHORITY
The new rule is adopted as authorized by Texas Business and Commerce Code §509.010 and Texas Government Code §2001.004(1). Texas Business and Commerce Code §509.010 authorizes the Office to adopt rules as necessary to implement Chapter 509 of the Texas Business and Commerce Code. Texas Government Code §2001.004 requires a state agency to adopt rules of practice stating the nature and requirements of formal and informal procedures.
§106.5.Notice Requirements.
A data broker that maintains an Internet website or mobile application shall post a conspicuous notice on the website or mobile application that states:
(1) For websites:
Figure: 1 TAC §106.5(1) (.pdf)
(2) For mobile applications:
Figure: 1 TAC §106.5(2) (.pdf)
The agency certifies that legal counsel has reviewed the adoption and found it to be a valid exercise of the agency's legal authority.
Filed with the Office of the Secretary of State on November 14, 2023.
TRD-202304266
Adam Bitter
General Counsel
Office of the Secretary of State
Effective date: December 4, 023
Proposal publication date: September 29, 2023
For further information, please call: (512) 463-5770