Many privacy professionals focused on the state of Texas and its potential to be the next state to pass a privacy law expected September 2020. That was to be thanks to the work of the Texas Privacy Protection Advisory Council. There was much anticipation over council's forthcoming report and recommendations to the Texas Legislature.
Some say, however, the council's final submission left a lot to be desired in the way of meaningful suggestions that would help state lawmakers draw up a workable bill to introduce to the Legislature when it convenes January 2021.
"The charge from the legislation establishing the council was to come up with specific statutory changes," Husch Blackwell Partner David Stauss, CIPP/US, CIPT, FIP, PLS, said. "I think we can all agree that that's not in the report, and I don't know if we were expecting a draft bill at the end of this, but we were expecting something close to it."
The 12-page report focused on state government practices for protecting the personal data it holds, provided an overview of the EU General Data Protection Regulation, the California Consumer Privacy Act and bills proposed in other states. Based on its research and analysis, along with more than 30 responses to a three-question survey, the council, comprising legislative and public members, offered six recommendations. The majority of those suggestions were broad in nature and did not suggest specific provisions beyond including a "right to know," which allows data subjects the ability to know how an organization is using their data.
"The content of the report is simplistic and recommendations are vacuous," said marketing research consultant Steve Perkins, formerly the vice president of client services at Burke. "The council has met the letter of the law but has not moved closer to developing a privacy law for Texas, much less a law that protects consumers."
On its surface, the report reflects oversights by a council that began working soon after it made its appointments in November 2019, leaving close to a year to develop a well-thought report. However, Perkins, who has closely followed the council and kept contact with some of its members since its creation, and other members of the Texas privacy community (many of whom wouldn't speak on record) said the public nature of the council's work actually only began when it sent out its survey Aug. 13, just 18 days before the report was due. In his correspondence with council members and fellow stakeholders, Perkins learned the council did not hold official meetings before August.
"There was a hearing scheduled for March 25 in Austin, and I certainly understand why they couldn't do that with COVID-19, but other parts of the state government have been meeting on Zoom," Perkins said. "(Zoom is) being used to keep things moving, and it's hard to think they couldn't find the in the last six months for a Zoom call or some kind of communication."
Perkins added he offered to connect with council co-chairs Sen. Jane Nelson, R-Texas, and Rep. Giovanni Capriglione, R-Texas, and other members to progress the group's efforts, but he received few to no responses. Nelson and Capriglione did not respond to The Privacy Advisor's attempts to confirm details of the council's work leading up to the publishing of the report.
"I don't know if there's any malfeasance going on here, but there certainly hasn't been a lot of effort to do as much as they can with this council," Perkins said. "I certainly wanted to hear their recommendations with a hope of there being hearings, meetings and ideally a website where people from around the state could put in their opinions, focusing on balancing consumer and industry perspectives. It's disappointing to see this opportunity they had for the better part of a year really just sit there and not be used."
Besides the COVID-19 pandemic, the reason to abstain from holding any sort of meetings is unclear. One possibility, said Stauss, was that meetings may have been set aside in favor of more meaningful discussions on reworking either of the two privacy bills introduced to the Legislature in 2019. Only one of those bills, House Bill 4390, made it to the end of the legislative session following amendments that watered it down to updates for data breach requirement and the creation of the council.
"There could very well be things that we're unaware of that have been done with respect to those two bills," Stauss said. "They could be negotiating them, unbeknownst to us. This could be part of a larger story, which means part of this is waiting to see what happens when the Legislature opens in January."
It remains to be seen what the Legislature will do with the report and how it might shape Texas privacy legislation. Stauss agrees with Perkins that the report "doesn't move the needle" but added that it's "not mutually exclusive to what comes next."
The best comparison for Texas that Stauss could think of was the situation unfolding once again in Washington, where the Washington Privacy Act is slated to land on the Legislature's agenda for a third consecutive session. The manner in which WaPA has failed to hit the finish line thus far may set a standard that Texas and other states may have to follow to land a comprehensive law.
As far as a model for a Texas privacy law, Perkins believes the CCPA is an easy foundation for lawmakers to open with and build from.
"I realize there are problems with the CCPA, but it's what you have to start with when it's the law of the land right now without federal legislation," Perkins said.
From Stauss' perspective, the question is whether Texas wants an opt-in or opt-out model. There are commonalities between many state law proposals, especially with provisions on transparency, but consumer rights can be a challenge. Maybe more challenging, though, is drawing a consensus on how to enforce a law.
"We're talking about a lot of solvable issues, but the big issue seems to be enforcement. It's what doomed (WaPA) two years in a row," Stauss said. "So I wonder if the (California Privacy Rights Act's) proposed creation of a state agency that is dedicated and has the resources in place to enforce the laws could create the model that states like Texas and Washington can seize upon to progress privacy legislation."
Photo by Alec Mason on Unsplash
