1. (a) A person may not require an individual to disclose the individual's social security number to obtain goods or services from or enter into a business transaction with the person unless the person:

   1. (1) adopts a privacy policy as provided by Subsection (b);
   2. (2) makes the privacy policy available to the individual; and
   3. (3) maintains under the privacy policy the confidentiality and security of the social security number disclosed to the person.

2. (b) A privacy policy adopted under this section must include:

   1. (1) how personal information is collected;
   2. (2) how and when the personal information is used;
   3. (3) how the personal information is protected;
   4. (4) who has access to the personal information; and
   5. (5) the method of disposal of the personal information.

Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.