(a) A person may not obtain, possess, transfer, or use personal identifying information of another person without the other person's consent or effective consent and with intent to obtain a good, a service, insurance, an extension of credit, or any other thing of value in the other person's name.
(a-1) For purposes of this section, "effective consent" includes consent given by a person legally authorized to act on behalf of the person from whom consent is required. Consent is not effective if:
(1) induced by force, threat, fraud, or coercion; or
(2) given by a person who by reason of youth, mental illness, or intellectual disability is known by the actor to be unable to make reasonable decisions.
(b) It is a defense to an action brought under this section that an act by a person:
(1) is covered by the Fair Credit Reporting Act (15 U.S.C. Section 1681 et seq.); and
(2) is in compliance with that Act and regulations adopted under that Act.
(c) This section does not apply to:
(1) a financial institution as defined by 15 U.S.C. Section 6809; or
(2) a covered entity as defined by Section 601.001 or 602.001, Insurance Code.