| 1 | 1 | | 87R3823 CAE-D |
|---|
| 2 | 2 | | By: Perry S.B. No. 1526 |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | A BILL TO BE ENTITLED |
|---|
| 6 | 6 | | AN ACT |
|---|
| 7 | 7 | | relating to restricting the use of personally identifiable student |
|---|
| 8 | 8 | | information by an operator of a website, online service, online |
|---|
| 9 | 9 | | application, or mobile application used for a school purpose and |
|---|
| 10 | 10 | | providing an exemption from certain restrictions for a national |
|---|
| 11 | 11 | | assessment provider. |
|---|
| 12 | 12 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 13 | 13 | | SECTION 1. Section 32.155, Education Code, is amended to |
|---|
| 14 | 14 | | read as follows: |
|---|
| 15 | 15 | | Sec. 32.155. PROTECTION OF COVERED INFORMATION. (a) An |
|---|
| 16 | 16 | | operator must implement and maintain reasonable security |
|---|
| 17 | 17 | | procedures and practices designed to protect any covered |
|---|
| 18 | 18 | | information from unauthorized access, deletion, use, modification, |
|---|
| 19 | 19 | | or disclosure. |
|---|
| 20 | 20 | | (b) Any operator that has been approved by the agency or had |
|---|
| 21 | 21 | | a product adopted by the agency and possesses any covered |
|---|
| 22 | 22 | | information must use the unique identifier established by the Texas |
|---|
| 23 | 23 | | Student Data System (TSDS) or a successor data management system |
|---|
| 24 | 24 | | maintained by the agency for any account creation, data upload, |
|---|
| 25 | 25 | | data transmission, analysis, or reporting to mask all personally |
|---|
| 26 | 26 | | identifiable student information. The operator shall adhere to a |
|---|
| 27 | 27 | | state-required student data sharing agreement that includes the use |
|---|
| 28 | 28 | | of an established unique identifier standard for all operators as |
|---|
| 29 | 29 | | prescribed by the agency. |
|---|
| 30 | 30 | | (c) A school district, open-enrollment charter school, |
|---|
| 31 | 31 | | regional education service center, or other local education agency |
|---|
| 32 | 32 | | may require an operator that contracts directly with the entity to |
|---|
| 33 | 33 | | adhere to a state-required student data sharing agreement that |
|---|
| 34 | 34 | | includes the use of an established unique identifier standard for |
|---|
| 35 | 35 | | all operators as prescribed by the agency. |
|---|
| 36 | 36 | | (d) A national assessment provider who receives covered |
|---|
| 37 | 37 | | information from a student or from a school district or campus on |
|---|
| 38 | 38 | | behalf of a student is not required to comply with Subsection (b) or |
|---|
| 39 | 39 | | (c) if the provider receives the covered information solely to |
|---|
| 40 | 40 | | provide access to: |
|---|
| 41 | 41 | | (1) employment, educational scholarships, financial |
|---|
| 42 | 42 | | aid, or postsecondary educational opportunities; or |
|---|
| 43 | 43 | | (2) educational resources for middle school, junior |
|---|
| 44 | 44 | | high school, or high school students. |
|---|
| 45 | 45 | | (e) The commissioner may adopt rules as necessary to |
|---|
| 46 | 46 | | administer this section. |
|---|
| 47 | 47 | | SECTION 2. This Act takes effect September 1, 2022. |
|---|