The Texas Data Privacy and Security Act (TDPSA), which was signed into law on June 19, is unusual in some ways. Perhaps most notably, instead of setting revenue cutoffs or customer record thresholds, it references the Small Business Administration’s (SBA) definition of “small business” in exempting small businesses from many of its requirements. Though that might seem straightforward, it actually introduces a lot of complexity and uncertainty into the law. There are three main reasons for this:
-
Congress gave the SBA significant leeway in defining “small business.” That means that the SBA can change the definition on its own without needing authorization from Congress. Because of that, the definition shifts more often than if it were entirely determined by federal statute.
-
It puts the Texas Attorney General in the position of interpreting regulations that are defined and enforced by a completely different entity. If a company thinks it qualifies as a small business but has never applied for an SBA loan or otherwise dealt with the SBA, then it seems that Texas would need to interpret the SBA regulations itself to determine whether the data privacy law applies to that company. Even if the company has qualified for small business status with the SBA, it’s an open question whether Texas would defer to the SBA’s determination or apply its own interpretation of the SBA regulations.
-
The SBA’s definition of “small business” isn’t necessarily straightforward. In fact, practically speaking, the SBA doesn’t really have a single unitary definition of “small business.” The SBA uses different revenue and employee headcount numbers for determining small business status in different industries. The SBA also considers a company’s affiliates and whether or not an affiliate controls the company in determining whether the company qualifies as a small business. That alone can be a complex analysis.
The take-home is that small businesses need to be careful in determining whether the law applies to them. A company might consider itself a small business and might even be considered a small business by the SBA, but that may not necessarily mean that it qualifies as a small business under the TDPSA.
