88R10675 DIO-D
By: Hall S.B. No. 1754
A BILL TO BE ENTITLED
AN ACT
relating to certain restrictions on the use of personally
identifiable information pertaining to a public school student by
an operator or educational entity.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Section 32.151, Education Code, is amended by
amending Subdivisions (1) and (6) and adding Subdivision (1-a) to
read as follows:
(1) "Covered information" means personally
identifiable information or information that is linked to
personally identifiable information, in any media or format, that
is not publicly available and is:
(A) created by or provided to an operator or
educational entity by a student or the student's parent in the
course of the student's or parent's use of the operator's or
entity's website, online service, online application, or mobile
application for a school purpose;
(B) created by or provided to an operator or
educational entity by an employee of a school district or school
campus for a school purpose; or
(C) gathered by an operator or educational entity
through the operation of the operator's or entity's website, online
service, online application, or mobile application for a school
purpose and personally identifies a student, including the
student's educational record, electronic mail, first and last name,
home address, telephone number, electronic mail address,
information that allows physical or online contact, discipline
records, test results, special education data, juvenile
delinquency records, grades, evaluations, criminal records,
medical records, health records, social security number, biometric
information, disabilities, socioeconomic information, food
purchases, political affiliations, religious information, text
messages, student identifiers, search activity, photograph, voice
recordings, or geolocation information.
(1-a) "Educational entity" includes the agency,
school districts, open-enrollment charter schools, regional
education service centers, and other local education agencies.
(6) "Targeted advertising" means presenting an
advertisement to a student or a student's parent in which the
advertisement is selected for the student or parent based on
information obtained or inferred over time from the student's
online behavior, usage of applications, or covered information.
The term does not include advertising to a student or parent at an
online location based on the student's or parent's visit to that
location at that time, or in response to the student's or parent's
request for information or feedback, without the retention of the
student's online activities or requests over time for the purpose
of targeting subsequent advertisements.
SECTION 2. Subchapter D, Chapter 32, Education Code, is
amended by adding Sections 32.1511, 32.1512, 32.1513, 32.1521, and
32.1531 to read as follows:
Sec. 32.1511. OWNERSHIP OF COVERED INFORMATION AND WORK
PRODUCT. (a) A student retains ownership over the student's own:
(1) covered information; and
(2) work or intellectual product, regardless of
whether the product was created for academic credit.
(b) A student may download, export, transfer, or otherwise
save or maintain any document, covered information, or other data
created by the student that is held or maintained by an educational
entity.
Sec. 32.1512. OPERATOR APPROVAL; CONTRACT PROVISIONS. (a)
An operator must be approved by the agency before the operator may
contract with an educational entity and collect, use, store, or
share covered information.
(b) A contract between an educational entity and an operator
must include the following provisions:
(1) requirements and restrictions related to the
collection, use, storage, and sharing of covered information by the
operator that are necessary for the educational entity to ensure
the operator's compliance with this subchapter and other law;
(2) a description of the person or type of person,
including an affiliate or subcontractor of the operator, with whom
the operator may share covered information; and
(3) a prohibition on the secondary use of covered
information by the operator, except when used for a legitimate
school or research purpose or as described by Sections 32.153 and
32.154.
(c) The commissioner shall develop a procedure for
approving an operator as required by this subsection.
Sec. 32.1513. NOTICE OF INFORMATION DISCLOSURE. (a) Each
operator that collects covered information shall provide to the
public, in a manner provided by agency rule, a notice of information
disclosure stating in plain language the conditions under which a
student's covered information may be collected, used, or disclosed.
(b) The notice of information disclosure must list:
(1) the covered information that the operator
collects and the rationale for collecting the information; and
(2) each educational entity, operator, or other third
party with access to or control of covered information maintained
by the operator.
Sec. 32.1521. PROHIBITED USE OF COVERED INFORMATION BY
EDUCATIONAL ENTITY. (a) Except as otherwise provided by this
subchapter, an educational entity may not release or otherwise
disclose a student's covered information in exchange for a good,
product, application, service, or any other thing of measurable
value.
(b) An educational entity may not use or release covered
information for the purpose of targeted advertising unless the
release of the data is essential for a school purpose, including the
use of adaptive educational software or other strictly tailored
educational endeavor with the sole purpose of providing a tailored
educational experience to the student.
Sec. 32.1531. ALLOWED DISCLOSURE OF COVERED INFORMATION BY
EDUCATIONAL ENTITY. (a) An educational entity may disclose
covered information if the disclosure is:
(1) determined by the entity to be necessary because
of an imminent health or safety emergency;
(2) ordered by a court of competent jurisdiction; or
(3) authorized or required by a provision of federal
or state law.
(b) The educational entity must comply with the
requirements of federal and state law to protect any student
information disclosed under this section.
SECTION 3. The heading to Section 32.152, Education Code,
is amended to read as follows:
Sec. 32.152. PROHIBITED USE OF COVERED INFORMATION BY
OPERATOR.
SECTION 4. Section 32.152(a), Education Code, is amended to
read as follows:
(a) An operator may not knowingly:
(1) engage in targeted advertising on any website,
online service, online application, or mobile application if the
target of the advertising is based on any information, including
covered information and persistent unique identifiers, that the
operator has acquired through the use of the operator's website,
online service, online application, or mobile application for a
school purpose;
(2) use information, including persistent unique
identifiers, created or gathered by the operator's website, online
service, online application, or mobile application, to create a
profile about a student unless the profile is created for a school
purpose; [or]
(3) except as provided by Subsection (c), sell or rent
any student's covered information;
(4) exchange a student's covered information for any
good, service, or application; or
(5) disclose covered information except as provided
under this subchapter.
SECTION 5. The heading to Section 32.153, Education Code,
is amended to read as follows:
Sec. 32.153. ALLOWED DISCLOSURE OF COVERED INFORMATION BY
OPERATOR.
SECTION 6. Section 32.153, Education Code, is amended by
amending Subsection (a) and adding Subsection (f) to read as
follows:
(a) An operator may use or disclose covered information
under the following circumstances:
(1) [to further a school purpose of the website,
online service, online application, or mobile application and the
recipient of the covered information disclosed under this
subsection does not further disclose the information unless the
disclosure is to allow or improve operability and functionality of
the operator's website, online service, online application, or
mobile application;
[(2)] to ensure legal and regulatory compliance;
(2) [(3)] to protect against liability;
(3) [(4)] to respond to or participate in the judicial
process;
(4) [(5)] to protect:
(A) the safety or integrity of users of the
website, online service, online application, or mobile
application; or
(B) the security of the website, online service,
online application, or mobile application; or
(5) [(6)] for a school, education, or employment
purpose requested by the student or the student's parent and the
information is not used or disclosed for any other purpose[;
[(7) to use the covered information for:
[(A) a legitimate research purpose; or
[(B) a school purpose or postsecondary
educational purpose; or
[(8) for a request by the agency or the school district
for a school purpose].
(f) Notwithstanding any other law, an operator shall use a
student's covered information received under a contract with an
educational entity strictly for the purpose provided under the
contract.
SECTION 7. Section 32.154, Education Code, is amended to
read as follows:
Sec. 32.154. ALLOWED USE OF COVERED INFORMATION BY
OPERATOR. This subchapter does not prohibit an operator from:
(1) using covered information[:
[(A)] to improve educational products if that
information is not associated with an identified student using the
operator's website, online service, online application, or mobile
application[; and
[(B) that is not associated with an identified
student to demonstrate the effectiveness of the operator's products
or services and to market the operator's services;
[(2) sharing covered information that is not
associated with an identified student for the development and
improvement of educational websites, online services, online
applications, or mobile applications;
[(3) recommending to a student additional services or
content relating to an educational, learning, or employment
opportunity within a website, online service, online application,
or mobile application if the recommendation is not determined by
payment or other consideration from a third party];
(2) [(4)] responding to a student's request for
information or for feedback without the information or response
being determined by payment or other consideration from a third
party; or
(3) [(5)] if the operator is a national assessment
provider or a provider of a college and career counseling service,
identifying for a student, with the express affirmative consent of
the student or the student's parent, institutions of higher
education or scholarship providers that are seeking students who
meet specific criteria, regardless of whether the identified
institution of higher education or scholarship provider provides
consideration to the operator.
SECTION 8. The heading to Section 32.155, Education Code,
as effective September 1, 2023, is amended to read as follows:
Sec. 32.155. PROTECTION OF COVERED INFORMATION BY OPERATOR.
SECTION 9. Sections 32.155(c), (d), and (e), Education
Code, as effective September 1, 2023, are amended to read as
follows:
(c) In addition to including the unique identifier in
releasing information as provided by Subsection (b), an operator
may include any other data field identified by the agency or by an
educational entity [a school district, open-enrollment charter
school, regional education service center, or other local education
agency] as necessary for the information being released to be
useful.
(d) An educational entity [A school district,
open-enrollment charter school, regional education service center,
or other local education agency] may include additional data fields
in an agreement with an operator or the amendment of an agreement
with an operator under this section. An operator may agree to
include the additional data fields requested by an educational
entity [a school district, open-enrollment charter school,
regional education service center, or other local education agency]
but may not require that additional data fields be included.
(e) An educational entity [A school district,
open-enrollment charter school, regional education service center,
or other local education agency] may require an operator that
contracts directly with the entity to adhere to a state-required
student data sharing agreement that includes the use of an
established unique identifier standard for all operators as
prescribed by the agency.
SECTION 10. The heading to Section 32.156, Education Code,
is amended to read as follows:
Sec. 32.156. DELETION OF COVERED INFORMATION BY OPERATOR.
SECTION 11. Sections 32.153(d) and (e), Education Code, are
repealed.
SECTION 12. (a) The changes in law made by this Act to
Chapter 32, Education Code, apply only to a contract between an
operator and an educational entity, as those terms are defined by
Section 32.151, Education Code, as amended by this Act, entered
into on or after the effective date of this Act. A contract entered
into before the effective date of this Act is governed by the law in
effect when the contract was entered into, and the former law is
continued in effect for that purpose.
(b) As soon as practicable, each educational entity, as that
term is defined by Section 32.151, Education Code, as amended by
this Act, shall make a good faith effort to renegotiate a term of an
existing contract entered into before the effective date of this
Act that would have required the entity, in order to comply with the
term, to violate a requirement of Chapter 32, Education Code, as
amended by this Act, to the extent necessary to avoid the violation.
SECTION 13. As soon as practicable and not later than
October 1, 2023, the commissioner of education shall adopt rules
regarding public notice of information disclosures required under
Section 32.1513, Education Code, as added by this Act.
SECTION 14. This Act takes effect September 1, 2023.