Unlawful disclosure of confidential information in Texas can lead to civil penalties starting at $2,000 per violation and criminal charges as serious as a second-degree felony carrying up to 20 years in prison. The exact exposure depends on what was disclosed, who disclosed it, and whether the disclosure was intentional. Texas has no single “unlawful disclosure” statute; instead, several laws apply depending on whether the information was a government record, personal identifying data, medical information, a trade secret, or a private communication.
What Counts as Unlawful Disclosure
Texas treats different categories of protected information under different statutes. The category usually determines everything else about the case.
Nonpublic government information. Texas Penal Code Section 39.06 makes it an offense for a public servant to disclose or use information obtained through a government role when the purpose is personal benefit or harm to someone else. “Nonpublic information” means information the general public cannot access and that is protected from disclosure under the Texas Public Information Act.1State of Texas. Texas Penal Code Section 39.06 – Misuse of Official Information Typical fact patterns include an officer leaking investigation details, a tax office employee sharing someone’s financial records, or an official using inside knowledge of a pending land deal to buy property ahead of the announcement.
Personal identifying information. Business and Commerce Code Section 521.051 prohibits obtaining, possessing, transferring, or using another person’s identifying information without consent when the purpose is to get goods, services, credit, or anything of value in that person’s name.2State of Texas. Texas Business and Commerce Code Section 521.051 – Unauthorized Use or Possession of Personal Identifying Information This is the civil track. When the misuse rises to identity theft, criminal charges follow under Penal Code Section 32.51.
Medical records. Texas Health and Safety Code Chapter 181 creates a state privacy framework that mirrors HIPAA and extends to any entity that collects, stores, or transmits protected health information for commercial or professional purposes.3State of Texas. Texas Health and Safety Code Section 181.001 – Definitions Entities that fall outside federal HIPAA can still face state enforcement.
Trade secrets. The Texas Uniform Trade Secrets Act, Civil Practice and Remedies Code Chapter 134A, protects formulas, processes, customer lists, financial data, and similar information that has economic value because it is not publicly known, provided the owner takes reasonable steps to keep it secret.4Justia Law. Texas Civil Practice and Remedies Code Chapter 134A – Trade Secrets The most common violation is a departing employee taking customer lists or proprietary information to a competitor, but even casually discussing protected information with an unauthorized person can qualify as misappropriation if the employee knew it was confidential.
Private communications. Penal Code Section 16.02 criminalizes intercepting or disclosing wire, oral, or electronic communications without consent. That covers unauthorized recording of calls, employer monitoring without notice, and sharing the contents of intercepted messages.5State of Texas. Texas Penal Code Section 16.02 – Unlawful Interception, Use, or Disclosure of Wire, Oral, or Electronic Communications Nonconsensual distribution of intimate images is a separate offense under Section 21.16, punishable as a state jail felony.
Criminal Penalties by Type of Information
Criminal exposure varies sharply depending on the statute charged.
Misuse of Official Information
A public servant convicted under Section 39.06 faces a third-degree felony as the baseline, punishable by 2 to 10 years in prison and a fine up to $10,000. When the disclosure produces financial gain, the charge scales with the amount. Gains under $150,000 stay a third-degree felony. Gains between $150,000 and $300,000 become a second-degree felony, carrying 2 to 20 years. Gains of $300,000 or more become a first-degree felony.6State of Texas. Texas Penal Code Chapter 39 – Abuse of Office
Fraudulent Use of Identifying Information
When unlawful disclosure of personal data leads to identity theft, Penal Code Section 32.51 controls. The base offense is a state jail felony, punishable by 180 days to 2 years in state jail and a fine up to $10,000. The charge increases with the number of identifying items involved, and offenses against elderly victims are automatically enhanced by one level.7State of Texas. Texas Penal Code Section 32.51 – Fraudulent Use or Possession of Identifying Information8Texas Attorney General. Penal Code Offenses by Punishment Range
Interception or Disclosure of Communications
A violation of Section 16.02 is a second-degree felony, punishable by 2 to 20 years in prison and a fine up to $10,000. A narrow exception drops the charge to a state jail felony for conduct involving the manufacture or sale of interception devices, or for tipping off a target about an authorized law enforcement wiretap.5State of Texas. Texas Penal Code Section 16.02 – Unlawful Interception, Use, or Disclosure of Wire, Oral, or Electronic Communications That places recording a phone call without consent in the same felony tier as aggravated assault.
Stacked Charges
A single course of conduct often violates multiple statutes. A government employee who leaks a citizen’s personal data may face both Section 39.06 for misuse of official information and Section 32.51 if the leak facilitates identity theft. Someone who intercepts a private communication and then uses the contents to extort money faces the interception charge plus whatever offense the extortion constitutes. Sentences can run consecutively.
Civil Damages a Victim Can Recover
Criminal prosecution is one track. Victims can also sue, and the civil exposure can outstrip the criminal fines.
Civil Penalties for Personal Data Violations
Violations of the personal identifying information protections in Business and Commerce Code Chapter 521 carry state-enforced civil penalties between $2,000 and $50,000 per violation. A violation also counts as a deceptive trade practice, which can open the door to treble damages in some cases.9Texas Legislature Online. Texas Business and Commerce Code Chapter 521 – Unauthorized Use of Identifying Information
Trade Secret Misappropriation
Under TUTSA, a business can recover actual damages, including lost profits and the diminished market value of the secret, plus damages measured by the unjust enrichment the misappropriator gained. If the misappropriation was willful and malicious, the court may award exemplary damages up to twice the compensatory award.10State of Texas. Texas Civil Practice and Remedies Code Section 134A.004 – Damages Courts can also enjoin further use or disclosure, which is often the more valuable remedy because it preserves the secret’s economic value.
Breach of a Non-Disclosure Agreement
NDAs create a separate contractual basis for liability. When an NDA contains a liquidated damages clause, the breaching party owes the specified amount regardless of actual harm. Texas courts generally enforce NDAs when the restrictions are reasonable in scope, duration, and geographic reach. Even without a liquidated damages provision, an NDA breach supports actual damages and injunctive relief.
Privacy Torts
Texas recognizes a common-law claim for public disclosure of private facts. The claim applies when someone widely shares another person’s private information in a way that would be highly offensive to a reasonable person. Truth is not a defense: accurate information can still be actionable if the disclosure was unjustified and offensive. Texas applies a two-year statute of limitations to most personal injury and tort claims, so victims should act quickly.
Data Breach Notification Duties
Any business operating in Texas that owns or licenses computerized data containing sensitive personal information must notify affected individuals after discovering a breach. Notification must go out without unreasonable delay and no later than 60 days after the business determines the breach occurred. If the breach affects 250 or more Texas residents, the business must also notify the Texas Attorney General within 30 days.9Texas Legislature Online. Texas Business and Commerce Code Chapter 521 – Unauthorized Use of Identifying Information
A business that only maintains someone else’s data must notify the data owner immediately upon discovering a breach. Law enforcement can request a delay if notification would interfere with a criminal investigation, but the notice must go out once the agency clears it. Failing to comply carries the same civil penalties and deceptive trade practice liability described above.
Defenses That Can Defeat a Charge or Claim
Not every disclosure of sensitive information leads to liability. Several defenses recur across both criminal and civil cases.
No Culpable Intent
Most Texas disclosure statutes require proof that the person acted knowingly or intentionally. Section 39.06 requires intent to obtain a benefit or harm another. Section 521.051 requires intent to use the information for an unauthorized purpose. A genuinely accidental disclosure, such as an email misdirected to the wrong recipient or a breach caused by a third party, can defeat the mental state element. In a trade secret case, a defendant may argue they did not know the information was confidential or reasonably believed they had permission to share it.
Consent
If the person whose information was disclosed gave permission, there is generally no violation. Consent may be explicit through a signed authorization or implied through a contract. In the electronic communications context, Section 16.02 permits interception when at least one party to the communication consents, so Texas is a one-party consent state for recording.5State of Texas. Texas Penal Code Section 16.02 – Unlawful Interception, Use, or Disclosure of Wire, Oral, or Electronic Communications
Whistleblower Protection
Texas Government Code Section 554.002 protects public employees who report violations of law by their employer or another public employee to an appropriate law enforcement authority, and it prohibits retaliation as long as the report was made in good faith.11State of Texas. Texas Government Code Section 554.002 – Retaliation Prohibited Two limits matter. The statute covers only public employees, and only reports to law enforcement authorities. It does not provide blanket immunity from prosecution, and it does not extend to private-sector employees.
Legally Required Disclosures
Some disclosures are mandatory. Healthcare providers must report suspected child abuse, certain communicable diseases, and gunshot wounds regardless of patient confidentiality. Financial institutions must comply with court orders, subpoenas, and regulatory investigations. Public servants may be required to release records under the Texas Public Information Act. These obligations override the confidentiality rules that would otherwise apply.
How Cases Get Started
Criminal cases typically begin with a complaint to local law enforcement or to the Texas Attorney General’s Office. Investigators use digital forensics, subpoenas, and witness interviews to build a case. The Attorney General’s office handles many data breach and identity theft matters, and local district attorneys prosecute misuse of official information and interception offenses. Convictions can carry prison time, fines, and court-ordered restitution.
Civil cases move on a parallel track. Plaintiffs often seek a temporary restraining order or preliminary injunction early in the case to stop further sharing of the information while the suit proceeds. In trade secret disputes, that speed often determines whether the secret retains any value at all.
One boundary worth noting: federal laws such as HIPAA, the Defend Trade Secrets Act, and the Gramm-Leach-Bliley Act can apply on top of Texas law, and a plaintiff may pursue both state and federal claims from the same conduct. Federal exposure is a separate analysis with its own penalties and procedures.