Texas 2017 - 85th Regular

Texas Senate Bill SB1279 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	85R12590 CAE-F
2	2	By: Taylor of Galveston S.B. No. 1279
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to restricting the use of covered information, including
8	8	student personally identifiable information, by an operator of a
9	9	website, online service, online application, or mobile application
10	10	for a school purpose.
11	11	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
12	12	SECTION 1. The heading to Chapter 32, Education Code, is
13	13	amended to read as follows:
14	14	CHAPTER 32. COMPUTERS, [AND] COMPUTER-RELATED EQUIPMENT, AND
15	15	STUDENT INFORMATION PROTECTION
16	16	SECTION 2. Chapter 32, Education Code, is amended by adding
17	17	Subchapter D to read as follows:
18	18	SUBCHAPTER D. STUDENT INFORMATION
19	19	Sec. 32.151. DEFINITIONS. In this subchapter:
20	20	(1) "Covered information" means personally
21	21	identifiable information or information that is linked to
22	22	personally identifiable information, in any media or format, that
23	23	is not publicly available and is:
24	24	(A) created by or provided to an operator by a
25	25	student or the student's parent in the course of the student's or
26	26	parent's use of the operator's website, online service, online
27	27	application, or mobile application for a school purpose;
28	28	(B) created by or provided to an operator by an
29	29	employee of a school district or school campus for a school purpose;
30	30	or
31	31	(C) gathered by an operator through the operation
32	32	of the operator's website, online service, online application, or
33	33	mobile application for a school purpose and personally identifies a
34	34	student, including the student's educational record, electronic
35	35	mail, first and last name, home address, telephone number,
36	36	electronic mail address, information that allows physical or online
37	37	contact, discipline records, test results, special education data,
38	38	juvenile delinquency records, grades, evaluations, criminal
39	39	records, medical records, health records, social security number,
40	40	biometric information, disabilities, socioeconomic information,
41	41	food purchases, political affiliations, religious information,
42	42	text messages, student identifiers, search activity, photograph,
43	43	voice recordings, or geolocation information.
44	44	(2) "Interactive computer service" has the meaning
45	45	assigned by 47 U.S.C. Section 230.
46	46	(3) "Operator" means, to the extent operating in this
47	47	capacity, the operator of a website, online service, online
48	48	application, or mobile application who has actual knowledge that
49	49	the website, online service, online application, or mobile
50	50	application is used primarily for a school purpose and was designed
51	51	and marketed for a school purpose.
52	52	(4) "Parent" includes a person standing in parental
53	53	relation.
54	54	(5) "School purpose" means a purpose that is directed
55	55	by or customarily takes place at the direction of a school district,
56	56	school campus, or teacher or assists in the administration of
57	57	school activities, including instruction in the classroom or at
58	58	home, administrative activities, and collaboration between
59	59	students, school personnel, or parents, or is otherwise for the use
60	60	and benefit of the school.
61	61	(6) "Targeted advertising" means presenting an
62	62	advertisement to a student in which the advertisement is selected
63	63	for the student based on information obtained or inferred over time
64	64	from the student's online behavior, usage of applications, or
65	65	covered information. The term does not include advertising to a
66	66	student at an online location based on the student's visit to that
67	67	location at that time, or in response to the student's request for
68	68	information or feedback, without the retention of the student's
69	69	online activities or requests over time for the purpose of
70	70	targeting subsequent advertisements.
71	71	Sec. 32.152. PROHIBITED USE OF COVERED INFORMATION. (a) An
72	72	operator may not knowingly:
73	73	(1) engage in targeted advertising on any website,
74	74	online service, online application, or mobile application if the
75	75	target of the advertising is based on any information, including
76	76	covered information and persistent unique identifiers, that the
77	77	operator has acquired through the use of the operator's website,
78	78	online service, online application, or mobile application for a
79	79	school purpose;
80	80	(2) use information, including persistent unique
81	81	identifiers, created or gathered by the operator's website, online
82	82	service, online application, or mobile application, to create a
83	83	profile about a student unless the profile is created for a school
84	84	purpose; or
85	85	(3) except as provided by Subsection (c), sell or rent
86	86	any student's covered information.
87	87	(b) For purposes of Subsection (a)(2), the collection and
88	88	retention of account information by an operator that remains under
89	89	the control of the student, the student's parent, or the campus or
90	90	district is not an attempt to create a profile by the operator.
91	91	(c) Subsection (a)(3) does not apply to:
92	92	(1) the purchase, merger, or any other type of
93	93	acquisition of an operator by another entity, if the operator or
94	94	successor entity complies with this subchapter regarding
95	95	previously acquired student information; or
96	96	(2) a national assessment provider if the provider
97	97	secures the express written consent of the student if the student is
98	98	18 years of age or older or the student's parent if the student is 17
99	99	years of age or younger, given in response to clear and conspicuous
100	100	notice, if the information is used solely to provide access to
101	101	employment, educational scholarships, financial aid, or
102	102	postsecondary educational opportunities.
103	103	Sec. 32.153. ALLOWED DISCLOSURE OF COVERED INFORMATION.
104	104	(a) An operator may use or disclose covered information if the
105	105	disclosure is:
106	106	(1) to further a school purpose of the website, online
107	107	service, online application, or mobile application and the
108	108	recipient of the covered information disclosed under this
109	109	subsection does not further disclose the information unless the
110	110	disclosure is to allow or improve operability and functionality of
111	111	the operator's website, online service, online application, or
112	112	mobile application;
113	113	(2) to ensure legal and regulatory compliance;
114	114	(3) to protect against liability;
115	115	(4) to respond to or participate in the judicial
116	116	process;
117	117	(5) to protect:
118	118	(A) the safety or integrity of users of the
119	119	website, online service, online application, or mobile
120	120	application; or
121	121	(B) the security of the website, online service,
122	122	online application, or mobile application;
123	123	(6) for a school, education, or employment purpose
124	124	requested by the student or the student's parent and the
125	125	information is not used or disclosed for any other purpose;
126	126	(7) to use the covered information for:
127	127	(A) a legitimate research purpose; or
128	128	(B) a school purpose or postsecondary
129	129	educational purpose; or
130	130	(8) requested by the agency or the school district for
131	131	a school purpose.
132	132	(b) An operator may disclose covered information if a
133	133	provision of federal or state law requires the operator to disclose
134	134	the information. The operator must comply with the requirements of
135	135	federal and state law to protect the information being disclosed.
136	136	(c) An operator may disclose covered information to a third
137	137	party if the operator has contracted with the third party to provide
138	138	a service for a school purpose for or on behalf of the operator. The
139	139	contract must prohibit the third party from using any covered
140	140	information for any purpose other than providing the contracted
141	141	service. The operator must require the third party to implement and
142	142	maintain reasonable procedures and practices designed to prevent
143	143	disclosure of covered information.
144	144	(d) Nothing in this subchapter prohibits the operator's use
145	145	of covered information for maintaining, developing, supporting,
146	146	improving, or diagnosing the operator's website, online service,
147	147	online application, or mobile application.
148	148	Sec. 32.154. ALLOWED USE OF COVERED INFORMATION. This
149	149	subchapter does not prohibit an operator from:
150	150	(1) using covered information:
151	151	(A) to improve educational products if that
152	152	information is not associated with an identified student using the
153	153	operator's website, online service, online application, or mobile
154	154	application; and
155	155	(B) that is not associated with an identified
156	156	student to demonstrate the effectiveness of the operator's products
157	157	or services and to market the operator's services;
158	158	(2) sharing covered information that is not associated
159	159	with an identified student for the development and improvement of
160	160	educational websites, online services, online applications, or
161	161	mobile applications;
162	162	(3) recommending to a student additional services or
163	163	content relating to an educational, learning, or employment
164	164	opportunity within a website, online service, online application,
165	165	or mobile application if the recommendation is not determined by
166	166	payment or other consideration from a third party;
167	167	(4) responding to a student's request for information
168	168	or for feedback without the information or response being
169	169	determined by payment or other consideration from a third party; or
170	170	(5) identifying for a student, with the express
171	171	affirmative consent of the student if the student is 18 years of age
172	172	or older or the student's parent if the student is 17 years of age or
173	173	younger, institutions of higher education or scholarship providers
174	174	that are seeking students who meet specific criteria, regardless of
175	175	whether the identified institution of higher education or
176	176	scholarship provider provides consideration to the operator.
177	177	Sec. 32.155. PROTECTION OF COVERED INFORMATION. An
178	178	operator must implement and maintain reasonable security
179	179	procedures and practices designed to protect any covered
180	180	information from unauthorized access, deletion, use, modification,
181	181	or disclosure.
182	182	Sec. 32.156. DELETION OF COVERED INFORMATION. If a school
183	183	district requests the deletion of a student's covered information
184	184	under the control of the school district and maintained by the
185	185	operator, the operator shall delete the information not later than
186	186	the 60th day after the date of the request, or as otherwise
187	187	specified in the contract or terms of service, unless the student or
188	188	the student's parent consents to the operator's maintenance of the
189	189	covered information.
190	190	Sec. 32.157. APPLICABILITY. This subchapter does not:
191	191	(1) limit the authority of a law enforcement agency to
192	192	obtain any information from an operator as authorized by law or
193	193	under a court order;
194	194	(2) limit the ability of an operator to use student
195	195	data, including covered information, for adaptive learning or
196	196	customized student learning purposes;
197	197	(3) apply to general audience:
198	198	(A) websites;
199	199	(B) online services;
200	200	(C) online applications; or
201	201	(D) mobile applications;
202	202	(4) limit service providers from providing Internet
203	203	connection to school districts or students and students' families;
204	204	(5) prohibit an operator from marketing educational
205	205	products directly to a student's parent if the marketing is not a
206	206	result of the use of covered information obtained by the operator
207	207	through providing services to the school district;
208	208	(6) impose a duty on a provider of an electronic store,
209	209	gateway, marketplace, or other means of purchasing or downloading
210	210	software or applications to review or enforce compliance with this
211	211	subchapter on those applications or software;
212	212	(7) impose a duty on a provider of an interactive
213	213	computer service to review or enforce compliance with this
214	214	subchapter by third-party content providers; or
215	215	(8) prohibit a student from downloading, exporting,
216	216	transferring, saving, or maintaining the student's data or
217	217	documents.
218	218	SECTION 3. This Act takes effect September 1, 2017.