| 2 | 5 | | |
|---|
| 3 | 6 | | |
|---|
| 4 | 7 | | A BILL TO BE ENTITLED |
|---|
| 5 | 8 | | AN ACT |
|---|
| 6 | 9 | | relating to restricting the use of personally identifiable student |
|---|
| 7 | 10 | | information by an operator of a website, online service, online |
|---|
| 8 | 11 | | application, or mobile application used for a school purpose and |
|---|
| 9 | 12 | | providing an exemption from certain restrictions for a national |
|---|
| 10 | 13 | | assessment provider. |
|---|
| 11 | 14 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 12 | 15 | | SECTION 1. Section 32.155, Education Code, is amended to |
|---|
| 13 | 16 | | read as follows: |
|---|
| 14 | 17 | | Sec. 32.155. PROTECTION OF COVERED INFORMATION. (a) An |
|---|
| 15 | 18 | | operator must implement and maintain reasonable security |
|---|
| 16 | 19 | | procedures and practices designed to protect any covered |
|---|
| 17 | 20 | | information from unauthorized access, deletion, use, modification, |
|---|
| 18 | 21 | | or disclosure. |
|---|
| 19 | 22 | | (b) Any operator that has been approved by the agency or had |
|---|
| 20 | 23 | | a product adopted by the agency and possesses any covered |
|---|
| 21 | 24 | | information must use the unique identifier established by the Texas |
|---|
| 22 | 25 | | Student Data System (TSDS) or a successor data management system |
|---|
| 23 | 26 | | maintained by the agency for any account creation, data upload, |
|---|
| 24 | 27 | | data transmission, analysis, or reporting to mask all personally |
|---|
| 25 | 28 | | identifiable student information. The operator shall adhere to a |
|---|
| 26 | 29 | | state-required student data sharing agreement that includes an |
|---|
| 27 | 30 | | established unique identifier standard for all operators as |
|---|
| 28 | 31 | | prescribed by the agency. |
|---|
| 29 | 32 | | (c) A school district, open-enrollment charter school, |
|---|
| 30 | 33 | | regional education service center, or other local education agency |
|---|
| 31 | 34 | | may require an operator that contracts directly with the entity to |
|---|
| 32 | 35 | | adhere to a state-approved student data sharing agreement that |
|---|
| 33 | 36 | | includes the use of an established unique identifier standard for |
|---|
| 34 | 37 | | all operators as prescribed by the agency. |
|---|
| 35 | 38 | | (d) A national assessment provider who receives covered |
|---|
| 36 | 39 | | information from a student or from a school district or campus on |
|---|
| 37 | 40 | | behalf of a student is not required to comply with Subsection (b) or |
|---|
| 38 | 41 | | (c) if the provider receives the covered information solely to |
|---|
| 39 | | - | provide access to: |
|---|
| 40 | | - | (1) employment, educational scholarships, financial |
|---|
| 41 | | - | aid, or postsecondary educational opportunities; or |
|---|
| 42 | | - | (2) educational resources for middle school, junior |
|---|
| 43 | | - | high school, or high school students. |
|---|
| 42 | + | provide access to employment, educational scholarships, financial |
|---|
| 43 | + | aid, or postsecondary educational opportunities. |
|---|