Breach of Privacy

A wiretap clipped onto a telephone pole in Harris County in 1967 became the reason Texas now recognizes breach of privacy as a legal claim at all. Before Lloyd Billings sued Norman Atkinson, a Southwestern Bell repairman, for tapping his home phone line, Texas courts had no standalone cause of action for invading someone's personal life. The Texas Supreme Court changed that in Billings v. Atkinson, 489 S.W.2d 858 (Tex. 1973), holding that an unwarranted invasion of privacy causes real legal injury. Breach of privacy now covers unauthorized access to, use of, or disclosure of personal or sensitive information, and it reaches conduct ranging from a hacked payment system to a hidden bedroom camera.

What is Breach of Privacy?

Picture two very different scenes. In one, an employee downloads a spreadsheet of 40,000 customer Social Security numbers and sells it. In the other, a landlord drills a peephole into a shared bathroom wall. Texas law treats both as a breach of privacy, defined as the violation of a person's private information or private space by someone who had no right to access it. The reach of this definition matters because it does not stop at data. A camera, a locked drawer, a phone call, or a database can each become the subject of a privacy claim depending on what was taken and how.

What Qualifies as Misuse of Personal Information?

Not every use of someone's data is misuse, so the line matters. Misuse means collecting, sharing, or applying personal information beyond what the person agreed to, or without any legal basis for the activity in the first place. A personal data breach is one version of this problem, where sensitive details are pulled out of a system by someone who was never authorized to touch them. Unauthorized processing of personal information describes a wider category, covering everything from selling a customer list to a third party without disclosure to storing medical records past the point consent expired.

Does Breach of Privacy Always Involve Personal Data?

Not even close. Long before Texas businesses stored anything on a server, the state's courts were already punishing privacy invasions that involved nothing but a telephone wire. Billings v. Atkinson turned on a physical device attached to a residential phone line, not a database or a spreadsheet. Modern claims still follow that pattern in situations such as trespass, hidden recording, or physical surveillance, where the violation is entirely about intrusion into a person's space rather than the handling of stored information.

Is Breach of Privacy a Civil or Criminal Issue?

Both, and the two tracks can run at the same time against the same defendant. A person harmed by an intrusion or a public disclosure can sue for damages under the common law torts established in Billings v. Atkinson and Industrial Foundation of the South v. Texas Industrial Accident Board, 540 S.W.2d 668 (Tex. 1976). Separately, the same underlying conduct can trigger a criminal offense charge if it involves unauthorized computer access, since Texas Penal Code Section 33.02 classifies that conduct as a Class B misdemeanor, or a state jail felony when government or critical infrastructure systems are involved.

What are the Different Types of Breach of Privacy?

Texas separates privacy violations into distinct legal categories, and the label attached to the conduct changes what a plaintiff has to prove.

1. Intrusion. An intentional invasion into a person's solitude, private affairs, or physical space that would strike a reasonable person as highly offensive, the same theory that carried Lloyd Billings to victory in 1973.

2. Public Disclosure of Private Facts. Publishing private, non newsworthy details about a person in a way that embarrasses them and serves no legitimate public interest, as recognized in Industrial Foundation of the South, 540 S.W.2d at 682.

3. False Light. Several states allow claims for publicity that casts someone in a misleading light, but the Texas Supreme Court in Cain v. Hearst Corp., 878 S.W.2d 577 (Tex. 1994), refused to adopt false light as an actionable claim in Texas.

4. Appropriation. Using a person's name or likeness for someone else's commercial benefit without consent, a theory Texas courts applied in Doggett v. Travis Law Firm, P.C., 555 S.W.3d 127 (Tex. App. Houston 1st Dist. 2018).

What is the Difference Between Data Breach and Privacy Breach?

Every data breach is a privacy breach, but the reverse is not true. A data breach is narrowly defined under Texas Business and Commerce Code Section 521.053 as the unauthorized acquisition of computerized data that compromises the security of sensitive personal information such as a Social Security number or a driver's license number. Privacy breach is the umbrella term, and it stretches to cover conduct that never touches a keyboard, including a physical intrusion into someone's home, a wiretap on a landline, or a camera pointed into a private space. A company can suffer a data breach without ever committing a broader privacy violation against a specific individual, and a person can suffer a privacy violation without any data ever being copied or transmitted.

Is Unauthorized Disclosure Considered a Privacy Breach?

Sharing someone's private information without permission counts as a privacy breach once the disclosure reaches beyond a small, private audience and touches facts that are not of legitimate public concern. Texas courts require the disclosed matter to relate directly to the plaintiff's private life and to be the kind of publication a reasonable person would find highly offensive, a standard applied in Robinson v. Brannon, 313 S.W.3d 860 (Tex. App. Houston 14th Dist. 2010). This claim is known as public disclosure of private facts, and it fails if the same information was already sitting in a public record or already known within the community.

What are the Causes of Privacy Breaches?

Three recurring failure points show up again and again in Texas privacy litigation and regulatory reports.

1. Cyberattacks. An outside actor exploits a weak password or an unpatched server to pull sensitive personal information out of a business network.

2. Human Error. An employee emails a file to the wrong address or leaves an unencrypted laptop in a parked car, exposing records with no malicious intent at all.

3. Weak Security Systems. A company skips encryption, multi factor authentication, or routine software patching, leaving an open door that attackers eventually walk through.

How Do Cyberattacks Lead to Breaches of Privacy?

An attacker rarely needs to break down a digital wall when a single stolen password will do. Cyberattacks lead to privacy breaches once an outside party bypasses a company's protections and reaches sensitive personal information without consent, and Texas Business and Commerce Code Section 521.053 treats that acquisition as a breach of system security whenever it compromises data such as account numbers or health information.

Can Human Error Cause a Privacy Breach?

Yes, and it happens more often than most businesses admit. A misaddressed email, a misplaced flash drive, or an unlocked filing cabinet can expose the same volume of sensitive data as a coordinated hacking operation. Texas law does not require proof of malicious intent before the notification duties under Section 521.053 apply, so a careless mistake carries the same legal weight as an intentional theft once unauthorized eyes reach the information.

What are Examples of Breach of Privacy?

These situations recur often enough in Texas that courts and regulators have built established rules around each one.

1. Leaked Customer Data. A retailer's payment system is compromised, exposing thousands of stored credit card numbers to unauthorized buyers on the dark web.

2. Unauthorized Surveillance. A landlord installs a hidden camera inside a tenant's bedroom without any notice or consent from the person living there.

3. Sharing Personal Details Publicly. A former partner posts someone's private medical diagnosis on social media purely to embarrass them.

Are Workplace Data Leaks Considered Privacy Breaches?

Sometimes, and the outcome often depends on whether the employee had a genuinely private space to begin with. In K-Mart Corp. v. Trotti, 677 S.W.2d 632 (Tex. App. Houston 1st Dist. 1984), a Houston court held that an employee kept a reasonable expectation of privacy in a company locker secured with her own personal lock, and that searching it without consent supported an invasion of privacy claim. The result shifts when the space in question is shared, unlocked, or openly monitored, since Texas courts look for a designated area the employee controlled before finding liability.

Is Accessing Someone's Phone without Permission a Breach of Privacy?

Reading through another person's texts without asking crosses a line Texas courts have already drawn. Fawcett v. Grosu, 490 S.W.3d 650 (Tex. App. Houston 14th Dist. 2016), applies the same two part test used for any intrusion claim, asking whether the access was intentional and whether it would strike a reasonable person as highly offensive. Private messages, photos, and call logs stored on a personal device generally satisfy both parts of that test once someone opens the phone without consent.

What Legal Obligations Do Businesses Have to Prevent Breaches?

Texas law does not leave data protection to a company's discretion once sensitive personal information enters its systems. Businesses that collect this information must implement reasonable safeguards and comply with the notification duties written into Texas Business and Commerce Code Chapter 521. The Texas Data Privacy and Security Act, codified at Chapter 541, layers additional obligations on top of that baseline for companies processing personal data at scale, including data protection assessments for higher risk activities such as targeted advertising or the sale of personal data.

What Happens if Customer Data is Exposed?

The clock starts running the moment a Texas business confirms that customer data has been exposed. Section 521.053 requires notice to affected residents without unreasonable delay and no later than 60 days after the business determines a breach occurred. If 250 or more Texas residents are affected, the company must also notify the Texas Attorney General within 30 days, and breaches touching 10,000 or more people at once trigger an additional duty to alert the nationwide consumer reporting agencies. Businesses that skip these steps face civil penalties that can reach tens of thousands of dollars per violation.

What Must Be Proven in a Breach of Privacy Case?

Three building blocks hold up every Texas breach of privacy claim, though the details shift depending on which specific tort applies.

1. Unauthorized Access or Disclosure. The plaintiff has to show the defendant intruded on private affairs or disclosed private facts without any legal right to do so.

2. Expectation of Privacy. The plaintiff has to prove a reasonable expectation of privacy existed in the space, the communication, or the information at issue.

3. Harm. The plaintiff has to connect the intrusion or disclosure to a real injury, whether that means mental anguish, financial loss, or damage to reputation.

What Evidence is Used in Privacy Breach Claims?

Proof in these cases rarely comes from a single document, so attorneys build a record from several directions at once.

1. Digital Forensic Records. Server logs, login timestamps, and file access history establish exactly when and how the unauthorized access occurred.

2. Witness Testimony. Statements from the plaintiff, coworkers, or neighbors describe the intrusion and help a jury judge how offensive it really was.

3. Correspondence. Emails, texts, and letters frequently show that a defendant obtained or shared private information without ever asking for consent.

What Damages Can Be Claimed in a Privacy Breach Case?

Once liability is established, Texas courts open the door to several categories of compensation.

1. Financial Loss. Plaintiffs recover costs tied directly to the breach, including credit monitoring fees and losses connected to identity theft.

2. Emotional Distress. Courts treat mental anguish as compensable, and the $10,000 mental anguish award upheld in Billings v. Atkinson remains the state's foundational example.

3. Reputational Harm. Plaintiffs recover damages when a public disclosure of private facts damages how they are viewed by family, coworkers, or their broader community.

Are Punitive Damages Available for Serious Breaches?

They are, but only when the facts go beyond ordinary carelessness. Punitive damages, called exemplary damages under Texas law, apply when a defendant's conduct was willful or malicious rather than merely negligent. The jury in Billings v. Atkinson awarded $15,000 in exemplary damages on top of the mental anguish award because Atkinson placed the wiretap intentionally, with the specific purpose of intercepting private conversations. Texas Civil Practice and Remedies Code Chapter 41 sets the standards and caps that govern these awards, which exist to punish serious misconduct and discourage others from repeating it.

What Defenses Exist Against Breach of Privacy Claims?

A defendant facing a Texas privacy claim is not without options, and three defenses come up more than any others.

1. Consent. A defendant who obtained permission before entering a private space or accessing private information generally defeats an intrusion claim outright.

2. Legal Authority. Officers and other parties acting under a valid warrant or statutory authority are shielded from privacy liability for that specific, authorized conduct.

3. Lack of Harm. A defendant can defeat a claim by showing the plaintiff never suffered any measurable injury connected to the alleged intrusion or disclosure.

How Can Individuals Prevent Breaches of Privacy?

To prevent breaches, start with the accounts that would hurt the most if compromised, financial and medical logins first, and give each one its own unique password rather than a recycled one. Turn on multi factor authentication anywhere it is offered, since that single step blocks a large share of account takeovers even after a password leaks. Trim the personal details posted on public social media profiles, review app permissions on a phone every few months, and shred paper records that carry account numbers or medical information before throwing them away.

When Should You Consult a Lawyer for a Privacy Breach?

The moment someone discovers their private information was accessed, used, or shared without consent, the deadline clock is already running. Texas privacy claims carry statutory and common law time limits that can bar recovery entirely if a person waits too long to act. Early legal review also protects evidence such as server logs, screenshots, and written correspondence before it disappears, and it helps determine whether the facts support an intrusion claim, a public disclosure claim, or a statutory data breach claim, since each theory demands different proof and opens the door to different damages.

Can a Personal Injury Attorney Handle Breach of Privacy Cases?

Some personal injury attorneys take on breach of privacy cases, particularly when the intrusion caused the same kind of measurable emotional distress or financial harm seen in other personal injury claims. Because Texas privacy law spans common law torts, criminal statutes, and data protection codes all at once, a personal injury attorney who regularly handles these claims can identify which legal theory actually fits the facts and pursue the compensation you're entitled to under Texas law.