Texas AG Privacy Director: Company Response Can Dictate Enforcement Outcome

Bridegan and Massachusetts Assistant Attorney General Jared Rinehimer discussed how their respective offices initiate potential enforcement action, advance legal theories and reach resolution with companies.

State enforcers will consider how early and often a company communicates about an issue and the compliance plan it puts in place, said Bridegan: “From there, it’s within our discretion whether that’s sufficient, and oftentimes if the company addresses the underlying concern from a regulator, a public or formal settlement does not necessarily have to be the end result from an enforcement action,” he said. “There’s just a lot of discretion.”

Problematic conduct might form the basis of an investigation, but the proceeding will depend on the legal theory, particularly when it comes to AI-related investigations, Bridegan added.

Regarding compliance issues with Texas’ comprehensive privacy law, it’s common for companies not to be able to cure the possible violation within the required 30 days, he said. Again, enforcers have discretion concerning how to proceed based on how the company responds and the action it takes to address the compliance issue.

Larger investigations usually begin with a civil investigative demand (CID), which allows the AG to exercise pre-suit subpoena authority, said Bridegan. Enforcers try to keep them narrow, but they can result in substantial document production, he added.

The steps after a CID, said Rinehimer, are similar to litigation discovery, in which the AG seeks documents and potential testimony. That can draw company objections and questions about easing the production burden, he said. The AG will occasionally need to go to court to get a company to comply with a CID, he said. There’s only been one instance in the past decade where the office took it to court, and it involved Facebook, he said. An investigation is a confidential process, and usually companies “like to keep it that way,” he said.

It’s not unusual for companies to provide briefings in an effort to reach a resolution, he continued. Most enforcement agencies will expect the resolution to be public, either through an assurance of discontinuance, assurance of voluntary compliance or consent decrees, he said.

How the AG initiates enforcement action is largely dependent on the statute, said Bridegan. The state could issue a pre-suit deposition in order to talk to a company executive or high-ranking official under oath, he said. Regarding the Texas comprehensive AI law, that “happens more” when the technology has been deployed in a high-risk scenario, he said.

For Texas’ data broker law, enforcers “crib” from the FCC and its framework in issuing a notice of alleged violation, he said: “We’re not saying you’re for sure in violation. It looks like you are. We want data broker companies to register quickly.” It’s an alert to show the AG is “watching” and expects the company to respond accordingly, he said.

Bridegan said enforcers are often monitoring the news, particularly when it comes to AI-related enforcement. He noted AI technology has drawn a lot of lawsuits from private plaintiffs, particularly regarding child safety. Those theories are often advanced on the basis of product liability or negligence, he said: That’s been a “unique” source of investigations. As more companies launch broad-based, public-facing AI technology, the AG is keeping tabs on how attorneys are advancing legal theories, he said.