As used in this section:
(1) “Personal information” means data capable of being associated with a particular natural person, including gender identification, birth information, marital status, citizenship and nationality, biometric records, government identification designations, and personal, educational, and financial histories.
(2) “Personal information protection company” means a business that is organized for the primary purpose of providing personal information protection services to individual consumers.
(3) “Personal information protection services” means receiving, holding, and managing the disclosure or use of personal information concerning an individual consumer:
(A) pursuant to a written agreement, in which the person receiving the individual consumer’s information agrees to serve as a personal information protection company, and which specifies the types of personal information to be held and the scope of services to be provided on behalf of the consumer; and
(B) in the best interests and for the protection and benefit of the consumer.