Cure Period (Texas Data Privacy and Security Act)

Texas gives a business one clean shot at fixing a privacy violation before the attorney general can sue. Tex. Bus. & Com. Code § 541.154 requires the attorney general to notify the person in writing, not later than the 30th day before bringing an action, identifying the specific provisions of the chapter alleged to have been or to be violated.

What curing actually takes

Fixing the problem is only half of it. The attorney general may not bring the action if, within the 30-day period, the person cures the identified violation and provides the attorney general a written statement that the person cured the alleged violation, notified the consumer that the consumer's privacy violation was addressed if the consumer's contact information has been made available to the person, provided supportive documentation to show how the privacy violation was cured, and made changes to internal policies, if necessary, to ensure that no such further violations will occur.

Read that as a checklist, because the statute is written as one. A business that quietly rewrites its privacy notice and says nothing has not met the conditions of the safe harbor. The written statement is a condition of the safe harbor, and it becomes a document in the attorney general's file. The statement must cover internal-policy changes only if changes are necessary to prevent further violations.

It does not expire

Several states wrote expiration dates into their cure provisions, so the right lapsed after a transition period and enforcement went straight to suit. Texas did not do that. Section 541.154 stands with no sunset, no repeal date, and no limitation to violations occurring in an early window, so notice and cure remains part of Chapter 541 unless the legislature changes it.

When the cure fails

Section 541.155 reaches a person who violates the chapter following the cure period described by § 541.154 or who breaches a written statement provided to the attorney general under that section. The civil penalty runs up to $7,500 for each violation. The attorney general may bring an action in the name of the state to recover the penalty, to restrain or enjoin the person from violating the chapter, or both, and may recover reasonable attorney's fees and other reasonable expenses incurred in investigating and bringing the action. Penalties collected are deposited under Tex. Gov't Code § 402.007.

Enforcement authority is exclusive to the attorney general under § 541.151, and § 541.156 provides that the chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of the chapter or any other law. No private plaintiff can sue under Chapter 541. A private claim tied to a privacy notice would have to rest on a separate statute, such as the Deceptive Trade Practices Act, which has its own elements, consumer-status requirement and notice rules.

The investigative side deserves attention before any notice arrives. Section 541.153 gives the attorney general investigative authority, and the attorney general may request a relevant data protection assessment prepared under § 541.105 through a civil investigative demand.