(a) Each agency may adopt rules to implement and administer this chapter.
(b) An agency that maintains motor vehicle records in relation to motor vehicles is not required to also maintain those records in relation to the individuals named in those records.

(c) An agency that provides a requestor access to personal information in motor vehicle records in bulk under a contract under § 730.007 shall include in the contract:
(1) a requirement that the requestor post a performance bond in an amount of not more than $1 million;
(2) a prohibition on the sale or redisclosure of the personal information for the purpose of marketing extended vehicle warranties by telephone;
(3) a requirement that the requestor provide proof of general liability and cyber-threat insurance coverage in an amount specified by the contracting agency that is:
(A) at least $3 million; and
(B) reasonably related to the risks associated with unauthorized access and use of the records;
(4) a requirement that if a requestor experiences a breach of system security, as defined by § 521.053, Business & Commerce Code, that includes data obtained under § 730.007, the requestor must notify the agency of the breach not later than 48 hours after the discovery of the breach;
(5) a requirement that the requestor include in each contract with a third party that receives the personal information from the requestor that the third party must comply with federal and state laws regarding the records;
(6) a requirement that the requestor and any third party receiving the personal information from the requestor protect the personal information with appropriate and accepted industry standard security measures for the type of information and the known risks from unauthorized access and use of the information; and
(7) a requirement that the requestor annually provide to the agency a report of all third parties to which the personal information was disclosed under this section and the purpose of the disclosure.
(d) The bond and insurance requirements in Subsections (c)(1) and (3) do not apply to a contract under § 730.007 between a government agency and another government agency, including a court or law enforcement agency.
(e) An agency that discloses any motor vehicle records in bulk under § 730.007 shall include in the records at least two records that are created solely for the purpose of monitoring compliance with this chapter and detecting, by receipt of certain forms of communications or actions directed at the subjects of the created records, potential violations of this chapter or contract terms required by this section.
(f) An agency that discloses motor vehicle records shall designate an employee to be responsible for:
(1) monitoring compliance with this chapter and contract terms required by this section;
(2) referring potential violations of this chapter to law enforcement agencies; and
(3) making recommendations to the administrative head of the agency or the designee of the administrative head of the agency on the eligibility of a person under § 730.016 to receive personal information.
(g) This subsection does not affect any rights or remedies available under a contract or any other law. If an agency determines that a person has violated a term of a contract with the agency for the disclosure under this chapter of personal information obtained by the agency in connection with a motor vehicle record, the agency may:
(1) cease disclosing personal information to that person; and
(2) allow the person to remedy the violation and resume receiving personal information.