Tex. Government Code § 92.002

(a) Except as provided by Subsection (b), a person may not knowingly sell, license, trade for consideration, transfer, purchase, or otherwise disseminate covered information of an at-risk individual or an immediate family member of the individual if the individual, or the office, acting on the individual's behalf, submits to the person a written request for the person not to sell, license, trade for consideration, transfer, purchase, or otherwise disseminate the information.

(b) Subsection (a) does not apply to:

(1) the dissemination of personal information as part of a news story, commentary, editorial, or other speech on a matter of public concern to which the information is relevant;

(2) personal information voluntarily published by the at-risk individual or family member of the individual to whom the information refers;

(3) the dissemination of personal information at the request of the individual or family member or as necessary to effectuate a request of the individual or family member;

(4) a business's internal use of the personal information of the individual or family member, including dissemination of the information to a business under common ownership or affiliated by corporate control, or for a transaction or service requested by or concerning the individual or family member;

(5) a business providing publicly available information through real-time or near real-time alert services for health or safety purposes;

(6) a business engaged in the collection, maintenance, disclosure, sale, communication, or use of personal information relating to a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living for use in a consumer credit report, or by a user of a consumer credit report to the extent the collection, maintenance, disclosure, sale, communication, or use is regulated by and authorized under the Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.);

(7) a consumer reporting agency subject to the Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.);

(8) a business using personal information collected, processed, sold, or disclosed in compliance with the Driver's Privacy Protection Act of 1994 (18 U.S.C. Section 2721 et seq.);

(9) a business using personal information to:

(A) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive acts, or any other illegal activity;

(B) preserve the integrity or security of computer systems; or

(C) investigate, report, or prosecute a person for engaging in conduct described by Paragraph (A);

(10) a financial institution, affiliate of a financial institution, or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.);

(11) a covered entity or business associate for purposes of the privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);

(12) an insurance or insurance support organization;

(13) a law enforcement agency, law enforcement support organization, or vendor that provides data support services to a law enforcement agency;

(14) the provision of information by 411 directory assistance or a directory information service, including the provision of a name, address, or telephone number, by or on behalf of a telecommunications carrier;

(15) personal information contained in:

(A) real property records;

(B) uniform commercial code filings and tax liens; or

(C) any other records maintained by a governmental entity evidencing title to, or any lien, judgment, or other encumbrance on, real or personal property; or

(16) the collection and sale or licensing of covered information incidental to conducting activities described in this subsection.