Texas PUC Sues Paxton to Keep Data Center Locations Confidential

Estimated Time to Read: 10 minutes

The Public Utility Commission of Texas (PUC) has sued Attorney General Ken Paxton (R) to block the release of two pieces of location information collected from data centers and cryptocurrency mining facilities: the county where each facility operates and its state regional water planning area.

The lawsuit was filed October 5, 2026, in Travis County’s 200th District Court. It challenges two open records rulings in which the attorney general’s office concluded the PUC had not shown the information was confidential under the Texas Public Information Act (PIA). The agency argues that pairing those location fields with operational data on energy and water use could expose critical infrastructure to attack.

The case comes as state officials are pressing data centers for more information about their water use, not less. It raises a question those efforts have not answered: once the state collects this information, how much of it should the public be able to see?

What the Texas Data Center Records Lawsuit Covers

The survey at the center of the dispute traces back to the state budget. Rider 6 of the General Appropriations Act (GAA), adopted in the 89th Legislative Session (2025), directed the PUC to collect data on the water use of industries with an “inverse relationship” between energy and water consumption. The PUC explains the relationship through cooling. Facilities that rely more on water for cooling may use less electricity, while those that rely on air may need more. The rider also requires the PUC to report its findings to the Legislative Budget Board (LBB) and the governor by December 31, 2026.

Working with the Texas Water Development Board (TWDB), the PUC built its Energy and Water Use Survey around data centers and virtual currency mining facilities that are operating, or plan to operate, in Texas by 2030. The survey was open from April 2 to May 28, 2026. It collected each facility’s contracted and actual electrical load, total energy consumption, projected peak load, cooling technology, water intake and sources, water service provider, and interconnecting electric utility. The PUC told respondents that its final report would not identify individual facilities, but that all survey data would remain subject to the PIA. The agency said the data would inform TWDB’s statewide water plan.

Participation was limited. TWDB’s annual Water Use Survey is mandatory: the Texas Water Code requires recipients to return it, and the governor and the attorney general are now pursuing enforcement actions. The PUC’s survey, by contrast, is voluntary. At a June 23 hearing of the House Committee on Natural Resources, the PUC reported responses from 28 companies representing 92 facilities. At the committee’s direction, the agency reopened the survey for a second window in July. The records in dispute therefore describe only a fraction of the industry.

Between May and June, the PUC received six public information requests from five requestors. Four were journalists, including reporters at the Texas Tribune, the Texas Observer, and the Fort Worth Star-Telegram; the Tribune reporter filed two requests. The fifth was a McLennan County resident. The requests varied in scope. One Tribune request asked only for aggregated or anonymized data. Another expressly excluded facility identifiers and county information.

The PUC’s position has narrowed since then. It released some information to one requestor and withheld everything from the others. In its briefs to the attorney general, the agency argued that the survey responses should be withheld in their entirety, even in aggregated form. As a fallback, it asked that any release be limited to de-identified data, with the PUC deciding which categories were safe to disclose. The lawsuit now seeks a declaration covering only the two location fields.

Paxton is named in his official capacity because the PIA requires a governmental body challenging a ruling to sue the attorney general. The requestors are not defendants, but they were notified of the suit and may intervene.

This is not the first such dispute. A separate PUC lawsuit against Paxton, filed in 2025, challenges an earlier ruling on registration and application information for cryptocurrency mining facilities. That case is still pending in Travis County’s 353rd District Court, and the attorney general deferred to that court on overlapping information in the current dispute.

Why the PUC Says Location Data Poses a Security Risk

The commission’s argument rests on what location reveals when combined with the operational data. According to the petition, the released fields alone describe an unidentified facility somewhere in Texas. Adding the facility’s county and regional water planning area, the PUC contends, would identify a specific site. It would also tie that site to the transmission and distribution infrastructure serving it, the size of its load, and the water systems it depends on. The agency argues this combination could help someone select targets for physical or cyberattacks affecting the ERCOT grid or regional water supplies. ERCOT, the Electric Reliability Council of Texas, operates the grid serving most of the state. These are the PUC’s allegations; the court has made no findings.

The PUC invokes Government Code Section 552.101, which covers information made confidential by other laws, together with Section 418.181 of the Texas Homeland Security Act. Section 418.181 protects documents that identify technical details of particular vulnerabilities of critical infrastructure to an act of terrorism. Since the passage of House Bill 132 (HB 132) in the 89th Legislative Session (2025), it also covers a hostile act by a foreign adversary of the United States. When Texas Policy Research (TPR) supported HB 132, it cautioned that its expanded confidentiality provisions should be applied narrowly and should not limit public transparency. The statute does not make all information about critical infrastructure confidential; it requires a connection to particular vulnerabilities. The PUC points to earlier attorney general rulings that protected details of the state’s transmission network and a city’s water supply.

The petition also shows what the PUC is not contesting. It acknowledges that the rulings order release of each facility’s load, cooling infrastructure, water sources, water provider, and interconnecting utility. In some responses, that includes the specific substations and transmission lines serving the facility. The suit leaves those fields alone. The dispute is whether location is the piece that turns otherwise releasable data into a map of targets.

Why the Attorney General Ordered Data Center Records Released

In its September 2 ruling, the attorney general’s Open Records Division concluded that the PUC had not shown the disputed information identified technical details of particular vulnerabilities. The same was true of four companies that raised the security argument: Aligned Data Centers, Compass Datacenters, CyrusOne, and Rowan Temple. The ruling said security concerns do not make information confidential on their own, and that reciting a statute’s key terms does not demonstrate that it applies. It also rejected the argument that information becomes confidential because a company submitted it expecting confidentiality.

The ruling did not order everything released. Eight companies, including Oracle and Riot Platforms, submitted comments. The attorney general required marked commercial or financial information to be withheld because its release would cause substantial competitive harm. Qualifying personal email addresses were also protected. A September 11 ruling covering the remaining three requests instructed the PUC to apply the earlier decision to identical information. Both rulings are available in the attorney general’s open records letter ruling database as OR2026-038988 and OR2026-040171.

The disagreement before the court is therefore narrow. It concerns whether the security exception justifies withholding two additional fields, not whether every survey response must be released without redaction.

Texas Data Center Transparency and Water Planning Implications

The lawsuit lands amid a broader state push for information about data center water use. On September 14, Gov. Greg Abbott (R) directed TWDB to enforce existing reporting requirements against major water users, including data centers. Ten days later, Paxton opened an investigation into data center developments that had not returned TWDB’s survey, saying he wanted to ensure they are transparent about their water usage. The governor’s August 3 directive also requires data centers seeking grid interconnection to give ERCOT and the PUC information on water consumption, among other things. The state is about to hold far more facility-level data than it does now, and this case may shape how much of it the public sees.

Geographic information is what makes resource-use data useful to the public. Statewide totals show overall consumption, but they say little about where demand is concentrated or which communities face added pressure. One of the two fields the PUC wants withheld is the regional water planning area, the unit Texas uses to plan its water supply. That is the same plan the PUC said this survey was meant to inform.

In testimony to the Senate Committee on Water, Agriculture and Rural Affairs in September, TPR argued that local governments, groundwater conservation districts, river authorities, and water providers need timely information on projected industrial demand. Withholding location data would limit their ability to evaluate local demands on electricity and water infrastructure. It would limit residents, journalists, and researchers in the same way.

The small number of respondents cuts both ways. With 92 facilities spread across 254 counties, many counties may contain only one or two. That supports the PUC’s concern that county-level data could identify individual sites. It also suggests a practical answer: publish data at a level where no single facility can be singled out, without withholding the geography entirely.

The court’s reasoning could influence future disputes over infrastructure records. Accepting the PUC’s argument could strengthen claims that ordinary information becomes confidential when combined with other datasets. Rejecting it could reinforce the requirement that agencies demonstrate a specific vulnerability before withholding records. Neither outcome would settle every future request, since each would still depend on the information and evidence presented.

Texas Public Records Policy Choices for the Legislature

The PUC’s Rider 6 report is due before the 90th Legislature convenes in January. That gives lawmakers an opportunity to clarify how the state collects sensitive operational information while preserving meaningful public reporting.

One approach would require regular publication of energy and water use data by county or regional water planning area. Suppression rules would apply where too few facilities would make individual sites identifiable. Another would draw a clearer statutory line between technical security information and the geographic and resource-use information needed to evaluate infrastructure planning.

Any broader confidentiality proposal would carry a tradeoff. It could protect information that presents a demonstrated security risk, but it could also reduce scrutiny of how regulators assess industrial demands on shared infrastructure. The Texas Liberty Compact starts from the premise that government information belongs to the public unless there is a specific, demonstrated reason to withhold it.

The central challenge is to protect specific vulnerabilities while giving Texans enough information to judge the effects of data center and cryptocurrency mining development. This lawsuit will test where existing law draws that line.

---

---