Most Texas businesses know they must protect customer data while they are using it. Fewer realize that Texas law also regulates what happens when the data, or the device holding it, is thrown away, sold or recycled. Two provisions of the Texas Business and Commerce Code apply: Section 72.004 and Chapter 521, the Identity Theft Enforcement and Protection Act.

This article is general information, not legal advice. Consult your attorney about how these laws apply to your organization.

Section 72.004: disposal of business records

Texas Business and Commerce Code §72.004(b) provides that when a business disposes of a business record that contains personal identifying information of a customer, it must modify that information, by shredding, erasing or other means, so as to make it unreadable or undecipherable.

Key points:

• Electronic records are included. Chapter 72 defines a business record to include information recorded electronically and by digital imaging, so data on hard drives, laptops, servers and backup media is covered, not only paper.
• Personal identifying information under §72.001 means an individual's first name or initial and last name combined with other identifiers such as date of birth, Social Security number or financial account numbers.
• Using a disposal vendor counts. Under §72.004(c), a business complies by contracting with a person engaged in the business of disposing of records for the modification of the personal identifying information on its behalf.
• Good-faith protection. Under §72.004(e), a business that modified a record in good faith is not liable for a civil penalty if the record is later reconstructed through extraordinary means.
• Exceptions. The requirement does not apply to records the business must retain under another law, or to certain historically significant records. Financial institutions as defined by 15 U.S.C. §6809 and certain covered entities under the Texas Insurance Code are excluded.

Penalty: under §72.004(d), a business that disposes of a record without complying is liable for a civil penalty of up to $500 for each business record. The Texas Attorney General may bring the action and recover costs and reasonable attorney's fees. A single unwiped server can hold thousands of customer records.

Chapter 521: the Identity Theft Enforcement and Protection Act

Chapter 521 is broader. Section 521.052(a) requires a business to implement and maintain reasonable procedures, including appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information it collects or maintains in the regular course of business.

Section 521.052(b) then addresses disposal directly: a business must destroy, or arrange for the destruction of, customer records containing sensitive personal information that it is not going to retain, by:

1. shredding;
2. erasing; or
3. otherwise modifying the sensitive personal information in the records to make it unreadable or indecipherable through any means.

Sensitive personal information under §521.002 includes an individual's first name or initial and last name combined with an unencrypted Social Security number, driver's license or government ID number, or a financial account or card number with its access code. It also includes information that identifies an individual and relates to their physical or mental health, the provision of health care, or payment for health care. That second category reaches many employers and service businesses, not only medical providers.

Section 521.052 does not apply to financial institutions as defined by 15 U.S.C. §6809, and the statute specifies that "business" includes a nonprofit athletic or sports association.

Penalty: under §521.151(a), a person who violates Chapter 521 is liable to the state for a civil penalty of at least $2,000 and not more than $50,000 for each violation. The Attorney General may also seek injunctive relief and recover reasonable expenses, including attorney's fees and court costs.

When disposal goes wrong: breach notification

If a device leaves your control with readable sensitive personal information and it is acquired by someone unauthorized, the breach notification rules in §521.053 may apply. Affected individuals must be notified without unreasonable delay and no later than 60 days after you determine a breach occurred. If at least 250 Texas residents are affected, the Attorney General must be notified as soon as practicable and no later than 30 days after that determination. Section 521.151(a-1) sets separate penalties for failing to notify.

A practical compliance approach

1. Define the standard. The statutes say "unreadable or undecipherable" but do not name a method. Adopting NIST SP 800-88 for electronic media gives you a recognized, defensible benchmark.
2. Inventory before disposal. Record serial numbers of every computer, drive, phone and copier leaving service.
3. Contract with a qualified vendor. Section 72.004(c) recognizes contracting with a record disposal business. Your agreement should describe the method, the custody process and the documentation you will receive.
4. Keep the evidence. Retain a certificate per device with serial number, method and date, plus chain-of-custody records. If the Attorney General ever asks, documentation is how you show "reasonable procedures."
5. Remember other laws. Healthcare organizations also have HIPAA obligations, and financial institutions have federal rules. Texas law adds to these; it does not replace them.

How AVM helps Texas businesses document disposal

Asset Value Management Services (AVM) is based in Houston and erases drives with WipeOS certified erasure following NIST SP 800-88, with DoD 5220.22-M available on request. Drives that cannot be erased are physically destroyed. Each project includes a serial-level audit, chain of custody and a certificate of destruction per serial number, available in a private client portal.

If you have equipment to retire and want documentation you can hand to counsel or an auditor, feel free to request a quote. Call 713-869-0200 or visit us at 4647 Pine Timbers St., Houston, TX 77041.