Texas 2023 - 88th Regular

Texas House Bill HB3289 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R24128 JCG-D
2	2	By: Anderson H.B. No. 3289
3	3	Substitute the following for H.B. No. 3289:
4	4	By: Smithee C.S.H.B. No. 3289
5	5
6	6
7	7	A BILL TO BE ENTITLED
8	8	AN ACT
9	9	relating to prohibiting the use of certain social media
10	10	applications and services on devices owned or leased by state
11	11	agencies.
12	12	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
13	13	SECTION 1. Subtitle B, Title 6, Government Code, is amended
14	14	by adding Chapter 674 to read as follows:
15	15	CHAPTER 674. USE OF CERTAIN SOCIAL MEDIA APPLICATIONS AND SERVICES
16	16	ON STATE AGENCY DEVICES PROHIBITED
17	17	Sec. 674.001. DEFINITIONS. In this chapter:
18	18	(1) "Prohibited application" means:
19	19	(A) a social media application or service
20	20	included on the list published by the Department of Information
21	21	Resources under Section 674.005; or
22	22	(B) a social media application or service
23	23	specified by executive order of the governor under Section 674.004.
24	24	(2) "State agency" means:
25	25	(A) a department, commission, board, office, or
26	26	other agency that is in the executive or legislative branch of state
27	27	government and that was created by the constitution or a statute,
28	28	including an institution of higher education as defined by Section
29	29	61.003, Education Code; or
30	30	(B) the supreme court, the court of criminal
31	31	appeals, a court of appeals, or the Texas Judicial Council or
32	32	another agency in the judicial branch of state government.
33	33	Sec. 674.002. PROHIBITION; MODEL POLICY. (a) Subject to
34	34	Section 674.003, a state agency shall adopt a policy prohibiting
35	35	the installation or use of a prohibited application on any device
36	36	owned or leased by the state agency and requiring the removal of
37	37	prohibited applications from those devices.
38	38	(b) The Department of Information Resources and the
39	39	Department of Public Safety shall jointly develop a model policy
40	40	for state agencies to use in developing the policy required by
41	41	Subsection (a).
42	42	Sec. 674.003. EXCEPTIONS; MITIGATING MEASURES. (a) A
43	43	policy adopted under Section 674.002 may include an exception
44	44	allowing the installation and use of a prohibited application to
45	45	the extent necessary:
46	46	(1) for providing law enforcement;
47	47	(2) for developing or implementing information
48	48	security measures; or
49	49	(3) to allow other legitimate governmental uses as
50	50	jointly determined by the Department of Information Resources and
51	51	the Department of Public Safety.
52	52	(b) A policy allowing the installation and use of a
53	53	prohibited application under Subsection (a) must require:
54	54	(1) the use of measures to mitigate risks to the
55	55	security of state agency information during the use of the
56	56	prohibited application; and
57	57	(2) the documentation of those measures.
58	58	(c) The administrative head of a state agency must approve
59	59	in writing the installation and use of a prohibited application
60	60	under an exception described by Subsection (a) by employees of the
61	61	state agency and report the approval to the Department of
62	62	Information Resources.
63	63	Sec. 674.004. APPLICATIONS IDENTIFIED BY GOVERNOR'S ORDER.
64	64	The governor by executive order may identify social media
65	65	applications or services that pose a threat to the security of the
66	66	state's sensitive information, critical infrastructure, or both.
67	67	Sec. 674.005. APPLICATION IDENTIFIED BY DEPARTMENT OF
68	68	INFORMATION RESOURCES AND DEPARTMENT OF PUBLIC SAFETY. (a) The
69	69	Department of Information Resources and the Department of Public
70	70	Safety, in consultation with the office of the governor, shall
71	71	jointly identify social media applications or services that pose a
72	72	threat to the security of the state's sensitive information,
73	73	critical infrastructure, or both.
74	74	(b) The Department of Information Resources shall publish
75	75	annually and maintain on the department's publicly accessible
76	76	Internet website a list of the prohibited applications identified
77	77	under Subsection (a).
78	78	SECTION 2. Not later than the 60th day after the date the
79	79	Department of Information Resources and the Department of Public
80	80	Safety make available the model policy required by Section
81	81	674.002(b), Government Code, as added by this Act, each state
82	82	agency shall adopt the policy required by Section 674.002(a),
83	83	Government Code, as added by this Act.
84	84	SECTION 3. This Act takes effect immediately if it receives
85	85	a vote of two-thirds of all the members elected to each house, as
86	86	provided by Section 39, Article III, Texas Constitution. If this
87	87	Act does not receive the vote necessary for immediate effect, this
88	88	Act takes effect September 1, 2023.