(a) Except as provided by Subsection (b), this chapter applies to personal data from an individual that is collected, transferred, or processed by a data broker.
(b) This chapter does not apply to the following data:
(1) deidentified data, if the data broker:
(A) takes reasonable technical measures to ensure that the data is not able to be used to identify an individual with whom the data is associated;
(B) publicly commits in a clear and conspicuous manner:
(i) to process and transfer the data solely in a deidentified form without any reasonable means for reidentification; and
(ii) to not attempt to identify the information to an individual with whom the data is associated; and
(C) contractually obligates a person that receives the information from the provider:
(i) to comply with this subsection with respect to the information; and
(ii) to require that those contractual obligations be included in any subsequent transfer of the data to another person;
(2) employee data;
(3) publicly available information;
(4) inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data with respect to an individual; or
(5) data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.).