Agencies may adopt rules, but when they give bulk access to motor vehicle records they must put specific controls in the contract, including bond, insurance, security, reporting, and breach-notice requirements.
Sec. 730.014. AGENCY RULES, RECORDS, AND CONTRACTS. (a) Each agency may adopt rules to implement and administer this chapter. (b) An agency that maintains motor vehicle records in relation to motor vehicles is not required to also maintain those records in relation to the individuals named in those records. (c) An agency that provides a requestor access to personal information in motor vehicle records in bulk under a contract under Section 730.007 shall include in the contract: (1) a requirement that the requestor post a performance bond in an amount of not more than $1 million; (2) a prohibition on the sale or redisclosure of the personal information for the purpose of marketing extended vehicle warranties by telephone; (3) a requirement that the requestor provide proof of general liability and cyber-threat insurance coverage in an amount specified by the contracting agency that is: (A) at least $3 million; and (B) reasonably related to the risks associated with unauthorized access and use of the records; (4) a requirement that if a requestor experiences a breach of system security, as defined by Section 521.053, Business & Commerce Code, that includes data obtained under Section 730.007, the requestor must notify the agency of the breach not later than 48 hours after the discovery of the breach; (5) a requirement that the requestor include in each contract with a third party that receives the personal information from the requestor that the third party must comply with federal and state laws regarding the records; (6) a requirement that the requestor and any third party receiving the personal information from the requestor protect the personal information with appropriate and accepted industry standard security measures for the type of information and the known risks from unauthorized access and use of the information; and (7) a requirement that the requestor annually provide to the agency a report of all third parties to which the personal information was disclosed under this section and the purpose of the disclosure. (d) The bond and insurance requirements in Subsections (c)(1) and (3) do not apply to a contract under Section 730.007 between a government agency and another government agency, including a court or law enforcement agency. (e) An agency that discloses any motor vehicle records in bulk under Section 730.007 shall include in the records at least two records that are created solely for the purpose of monitoring compliance with this chapter and detecting, by receipt of certain forms of communications or actions directed at the subjects of the created records, potential violations of this chapter or contract terms required by this section. (f) An agency that discloses motor vehicle records shall designate an employee to be responsible for: (1) monitoring compliance with this chapter and contract terms required by this section; (2) referring potential violations of this chapter to law enforcement agencies; and (3) making recommendations to the administrative head of the agency or the designee of the administrative head of the agency on the eligibility of a person under Section 730.016 to receive personal information. (g) This subsection does not affect any rights or remedies available under a contract or any other law. If an agency determines that a person has violated a term of a contract with the agency for the disclosure under this chapter of personal information obtained by the agency in connection with a motor vehicle record, the agency may: (1) cease disclosing personal information to that person; and (2) allow the person to remedy the violation and resume receiving personal information. Added by Acts 1997, 75th Leg., ch. 1187, Sec. 1, eff. Sept. 1, 1997. Amended by: Acts 2021, 87th Leg., R.S., Ch. 935 (S.B. 15), Sec. 11, eff. June 18, 2021. Acts 2021, 87th Leg., R.S., Ch. 935 (S.B. 15), Sec. 12, eff. June 18, 2021.