This section says the chapter should not be read to limit a controller’s or processor’s ability to comply with laws, respond to legal/investigatory demands, defend legal claims, provide requested products or services, protect safety or security, handle illegal activity, preserve system integrity, assist others, use privileged communications, or protect trade secrets.
Sec. 541.201. CONSTRUCTION OF CHAPTER. (a) This chapter may not be construed to restrict a controller's or processor's ability to: (1) comply with federal, state, or local laws, rules, or regulations; (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities; (3) investigate, establish, exercise, prepare for, or defend legal claims; (4) provide a product or service specifically requested by a consumer or the parent or guardian of a child, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer before entering into a contract; (5) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another individual and in which the processing cannot be manifestly based on another legal basis; (6) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; (7) preserve the integrity or security of systems or investigate, report, or prosecute those responsible for breaches of system security; (8) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board or similar independent oversight entity that determines: (A) if the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller; (B) whether the expected benefits of the research outweigh the privacy risks; and (C) if the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification; or (9) assist another controller, processor, or third party with any of the requirements under this subsection. (b) This chapter may not be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication. (c) This chapter may not be construed as imposing a requirement on controllers and processors that adversely affects the rights or freedoms of any person, including the right of free speech. (d) This chapter may not be construed as requiring a controller, processor, third party, or consumer to disclose a trade secret. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.