Texas 2023 - 88th Regular

Texas Senate Bill SB1754 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R10675 DIO-D
2	2	By: Hall S.B. No. 1754
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to certain restrictions on the use of personally
8	8	identifiable information pertaining to a public school student by
9	9	an operator or educational entity.
10	10	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
11	11	SECTION 1. Section 32.151, Education Code, is amended by
12	12	amending Subdivisions (1) and (6) and adding Subdivision (1-a) to
13	13	read as follows:
14	14	(1) "Covered information" means personally
15	15	identifiable information or information that is linked to
16	16	personally identifiable information, in any media or format, that
17	17	is not publicly available and is:
18	18	(A) created by or provided to an operator or
19	19	educational entity by a student or the student's parent in the
20	20	course of the student's or parent's use of the operator's or
21	21	entity's website, online service, online application, or mobile
22	22	application for a school purpose;
23	23	(B) created by or provided to an operator or
24	24	educational entity by an employee of a school district or school
25	25	campus for a school purpose; or
26	26	(C) gathered by an operator or educational entity
27	27	through the operation of the operator's or entity's website, online
28	28	service, online application, or mobile application for a school
29	29	purpose and personally identifies a student, including the
30	30	student's educational record, electronic mail, first and last name,
31	31	home address, telephone number, electronic mail address,
32	32	information that allows physical or online contact, discipline
33	33	records, test results, special education data, juvenile
34	34	delinquency records, grades, evaluations, criminal records,
35	35	medical records, health records, social security number, biometric
36	36	information, disabilities, socioeconomic information, food
37	37	purchases, political affiliations, religious information, text
38	38	messages, student identifiers, search activity, photograph, voice
39	39	recordings, or geolocation information.
40	40	(1-a) "Educational entity" includes the agency,
41	41	school districts, open-enrollment charter schools, regional
42	42	education service centers, and other local education agencies.
43	43	(6) "Targeted advertising" means presenting an
44	44	advertisement to a student or a student's parent in which the
45	45	advertisement is selected for the student or parent based on
46	46	information obtained or inferred over time from the student's
47	47	online behavior, usage of applications, or covered information.
48	48	The term does not include advertising to a student or parent at an
49	49	online location based on the student's or parent's visit to that
50	50	location at that time, or in response to the student's or parent's
51	51	request for information or feedback, without the retention of the
52	52	student's online activities or requests over time for the purpose
53	53	of targeting subsequent advertisements.
54	54	SECTION 2. Subchapter D, Chapter 32, Education Code, is
55	55	amended by adding Sections 32.1511, 32.1512, 32.1513, 32.1521, and
56	56	32.1531 to read as follows:
57	57	Sec. 32.1511. OWNERSHIP OF COVERED INFORMATION AND WORK
58	58	PRODUCT. (a) A student retains ownership over the student's own:
59	59	(1) covered information; and
60	60	(2) work or intellectual product, regardless of
61	61	whether the product was created for academic credit.
62	62	(b) A student may download, export, transfer, or otherwise
63	63	save or maintain any document, covered information, or other data
64	64	created by the student that is held or maintained by an educational
65	65	entity.
66	66	Sec. 32.1512. OPERATOR APPROVAL; CONTRACT PROVISIONS. (a)
67	67	An operator must be approved by the agency before the operator may
68	68	contract with an educational entity and collect, use, store, or
69	69	share covered information.
70	70	(b) A contract between an educational entity and an operator
71	71	must include the following provisions:
72	72	(1) requirements and restrictions related to the
73	73	collection, use, storage, and sharing of covered information by the
74	74	operator that are necessary for the educational entity to ensure
75	75	the operator's compliance with this subchapter and other law;
76	76	(2) a description of the person or type of person,
77	77	including an affiliate or subcontractor of the operator, with whom
78	78	the operator may share covered information; and
79	79	(3) a prohibition on the secondary use of covered
80	80	information by the operator, except when used for a legitimate
81	81	school or research purpose or as described by Sections 32.153 and
82	82	32.154.
83	83	(c) The commissioner shall develop a procedure for
84	84	approving an operator as required by this subsection.
85	85	Sec. 32.1513. NOTICE OF INFORMATION DISCLOSURE. (a) Each
86	86	operator that collects covered information shall provide to the
87	87	public, in a manner provided by agency rule, a notice of information
88	88	disclosure stating in plain language the conditions under which a
89	89	student's covered information may be collected, used, or disclosed.
90	90	(b) The notice of information disclosure must list:
91	91	(1) the covered information that the operator
92	92	collects and the rationale for collecting the information; and
93	93	(2) each educational entity, operator, or other third
94	94	party with access to or control of covered information maintained
95	95	by the operator.
96	96	Sec. 32.1521. PROHIBITED USE OF COVERED INFORMATION BY
97	97	EDUCATIONAL ENTITY. (a) Except as otherwise provided by this
98	98	subchapter, an educational entity may not release or otherwise
99	99	disclose a student's covered information in exchange for a good,
100	100	product, application, service, or any other thing of measurable
101	101	value.
102	102	(b) An educational entity may not use or release covered
103	103	information for the purpose of targeted advertising unless the
104	104	release of the data is essential for a school purpose, including the
105	105	use of adaptive educational software or other strictly tailored
106	106	educational endeavor with the sole purpose of providing a tailored
107	107	educational experience to the student.
108	108	Sec. 32.1531. ALLOWED DISCLOSURE OF COVERED INFORMATION BY
109	109	EDUCATIONAL ENTITY. (a) An educational entity may disclose
110	110	covered information if the disclosure is:
111	111	(1) determined by the entity to be necessary because
112	112	of an imminent health or safety emergency;
113	113	(2) ordered by a court of competent jurisdiction; or
114	114	(3) authorized or required by a provision of federal
115	115	or state law.
116	116	(b) The educational entity must comply with the
117	117	requirements of federal and state law to protect any student
118	118	information disclosed under this section.
119	119	SECTION 3. The heading to Section 32.152, Education Code,
120	120	is amended to read as follows:
121	121	Sec. 32.152. PROHIBITED USE OF COVERED INFORMATION BY
122	122	OPERATOR.
123	123	SECTION 4. Section 32.152(a), Education Code, is amended to
124	124	read as follows:
125	125	(a) An operator may not knowingly:
126	126	(1) engage in targeted advertising on any website,
127	127	online service, online application, or mobile application if the
128	128	target of the advertising is based on any information, including
129	129	covered information and persistent unique identifiers, that the
130	130	operator has acquired through the use of the operator's website,
131	131	online service, online application, or mobile application for a
132	132	school purpose;
133	133	(2) use information, including persistent unique
134	134	identifiers, created or gathered by the operator's website, online
135	135	service, online application, or mobile application, to create a
136	136	profile about a student unless the profile is created for a school
137	137	purpose; [or]
138	138	(3) except as provided by Subsection (c), sell or rent
139	139	any student's covered information;
140	140	(4) exchange a student's covered information for any
141	141	good, service, or application; or
142	142	(5) disclose covered information except as provided
143	143	under this subchapter.
144	144	SECTION 5. The heading to Section 32.153, Education Code,
145	145	is amended to read as follows:
146	146	Sec. 32.153. ALLOWED DISCLOSURE OF COVERED INFORMATION BY
147	147	OPERATOR.
148	148	SECTION 6. Section 32.153, Education Code, is amended by
149	149	amending Subsection (a) and adding Subsection (f) to read as
150	150	follows:
151	151	(a) An operator may use or disclose covered information
152	152	under the following circumstances:
153	153	(1) [to further a school purpose of the website,
154	154	online service, online application, or mobile application and the
155	155	recipient of the covered information disclosed under this
156	156	subsection does not further disclose the information unless the
157	157	disclosure is to allow or improve operability and functionality of
158	158	the operator's website, online service, online application, or
159	159	mobile application;
160	160	[(2)] to ensure legal and regulatory compliance;
161	161	(2) [(3)] to protect against liability;
162	162	(3) [(4)] to respond to or participate in the judicial
163	163	process;
164	164	(4) [(5)] to protect:
165	165	(A) the safety or integrity of users of the
166	166	website, online service, online application, or mobile
167	167	application; or
168	168	(B) the security of the website, online service,
169	169	online application, or mobile application; or
170	170	(5) [(6)] for a school, education, or employment
171	171	purpose requested by the student or the student's parent and the
172	172	information is not used or disclosed for any other purpose[;
173	173	[(7) to use the covered information for:
174	174	[(A) a legitimate research purpose; or
175	175	[(B) a school purpose or postsecondary
176	176	educational purpose; or
177	177	[(8) for a request by the agency or the school district
178	178	for a school purpose].
179	179	(f) Notwithstanding any other law, an operator shall use a
180	180	student's covered information received under a contract with an
181	181	educational entity strictly for the purpose provided under the
182	182	contract.
183	183	SECTION 7. Section 32.154, Education Code, is amended to
184	184	read as follows:
185	185	Sec. 32.154. ALLOWED USE OF COVERED INFORMATION BY
186	186	OPERATOR. This subchapter does not prohibit an operator from:
187	187	(1) using covered information[:
188	188	[(A)] to improve educational products if that
189	189	information is not associated with an identified student using the
190	190	operator's website, online service, online application, or mobile
191	191	application[; and
192	192	[(B) that is not associated with an identified
193	193	student to demonstrate the effectiveness of the operator's products
194	194	or services and to market the operator's services;
195	195	[(2) sharing covered information that is not
196	196	associated with an identified student for the development and
197	197	improvement of educational websites, online services, online
198	198	applications, or mobile applications;
199	199	[(3) recommending to a student additional services or
200	200	content relating to an educational, learning, or employment
201	201	opportunity within a website, online service, online application,
202	202	or mobile application if the recommendation is not determined by
203	203	payment or other consideration from a third party];
204	204	(2) [(4)] responding to a student's request for
205	205	information or for feedback without the information or response
206	206	being determined by payment or other consideration from a third
207	207	party; or
208	208	(3) [(5)] if the operator is a national assessment
209	209	provider or a provider of a college and career counseling service,
210	210	identifying for a student, with the express affirmative consent of
211	211	the student or the student's parent, institutions of higher
212	212	education or scholarship providers that are seeking students who
213	213	meet specific criteria, regardless of whether the identified
214	214	institution of higher education or scholarship provider provides
215	215	consideration to the operator.
216	216	SECTION 8. The heading to Section 32.155, Education Code,
217	217	as effective September 1, 2023, is amended to read as follows:
218	218	Sec. 32.155. PROTECTION OF COVERED INFORMATION BY OPERATOR.
219	219	SECTION 9. Sections 32.155(c), (d), and (e), Education
220	220	Code, as effective September 1, 2023, are amended to read as
221	221	follows:
222	222	(c) In addition to including the unique identifier in
223	223	releasing information as provided by Subsection (b), an operator
224	224	may include any other data field identified by the agency or by an
225	225	educational entity [a school district, open-enrollment charter
226	226	school, regional education service center, or other local education
227	227	agency] as necessary for the information being released to be
228	228	useful.
229	229	(d) An educational entity [A school district,
230	230	open-enrollment charter school, regional education service center,
231	231	or other local education agency] may include additional data fields
232	232	in an agreement with an operator or the amendment of an agreement
233	233	with an operator under this section. An operator may agree to
234	234	include the additional data fields requested by an educational
235	235	entity [a school district, open-enrollment charter school,
236	236	regional education service center, or other local education agency]
237	237	but may not require that additional data fields be included.
238	238	(e) An educational entity [A school district,
239	239	open-enrollment charter school, regional education service center,
240	240	or other local education agency] may require an operator that
241	241	contracts directly with the entity to adhere to a state-required
242	242	student data sharing agreement that includes the use of an
243	243	established unique identifier standard for all operators as
244	244	prescribed by the agency.
245	245	SECTION 10. The heading to Section 32.156, Education Code,
246	246	is amended to read as follows:
247	247	Sec. 32.156. DELETION OF COVERED INFORMATION BY OPERATOR.
248	248	SECTION 11. Sections 32.153(d) and (e), Education Code, are
249	249	repealed.
250	250	SECTION 12. (a) The changes in law made by this Act to
251	251	Chapter 32, Education Code, apply only to a contract between an
252	252	operator and an educational entity, as those terms are defined by
253	253	Section 32.151, Education Code, as amended by this Act, entered
254	254	into on or after the effective date of this Act. A contract entered
255	255	into before the effective date of this Act is governed by the law in
256	256	effect when the contract was entered into, and the former law is
257	257	continued in effect for that purpose.
258	258	(b) As soon as practicable, each educational entity, as that
259	259	term is defined by Section 32.151, Education Code, as amended by
260	260	this Act, shall make a good faith effort to renegotiate a term of an
261	261	existing contract entered into before the effective date of this
262	262	Act that would have required the entity, in order to comply with the
263	263	term, to violate a requirement of Chapter 32, Education Code, as
264	264	amended by this Act, to the extent necessary to avoid the violation.
265	265	SECTION 13. As soon as practicable and not later than
266	266	October 1, 2023, the commissioner of education shall adopt rules
267	267	regarding public notice of information disclosures required under
268	268	Section 32.1513, Education Code, as added by this Act.
269	269	SECTION 14. This Act takes effect September 1, 2023.