Privacy law — federal vs. Texas

There is no comprehensive federal consumer-privacy statute — the FTC Act’s "unfair or deceptive practices" power (15 U.S.C. § 45) is the only general federal backstop. Texas enacted its own comprehensive law, the TDPSA. Notably it has no revenue threshold but exempts small businesses (by the U.S. SBA definition) — a Texas-specific twist. AG-enforced, with a 30-day cure period.

There is no general federal data-breach-notification statute — only sector fragments (e.g. the HIPAA Breach Notification Rule). Texas supplies the general rule through its Identity Theft Enforcement and Protection Act, which carries BOTH the data-safeguard duty (§ 521.052) and the breach-notice requirement (§ 521.053) in the same chapter.

HIPAA is the federal floor for protected health information. Texas goes further: its Medical Records Privacy Act defines "covered entity" far more broadly — essentially anyone who obtains, stores, or uses PHI, not just HIPAA-covered entities and their business associates — and adds training and stricter consent duties.

The federal Driver’s Privacy Protection Act restricts disclosure of motor-vehicle records. Texas mirrors it at the state level with its Motor Vehicle Records Disclosure Act — a parallel scheme rather than an expansion.

The Fair Credit Reporting Act governs consumer credit reporting — and it expressly PREEMPTS much state credit-reporting law, so Texas’s role here is limited (mainly security-freeze mechanics under Bus. & Com. Code Ch. 20). This is the teaching contrast to the topics above: sometimes federal law leaves room for the state, and sometimes it takes it away. To dispute a credit error, the FCRA path (and the CFPB) is usually the operative one.