Bill Text: TX SB1754 | 2023-2024 | 88th Legislature | Introduced


Bill Title: Relating to certain restrictions on the use of personally identifiable information pertaining to a public school student by an operator or educational entity.

Spectrum: Partisan Bill (Republican 1-0)

Status: (Introduced - Dead) 2023-03-20 - Referred to Education [SB1754 Detail]

Download: Texas-2023-SB1754-Introduced.html
  88R10675 DIO-D
 
  By: Hall S.B. No. 1754
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to certain restrictions on the use of personally
  identifiable information pertaining to a public school student by
  an operator or educational entity.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Section 32.151, Education Code, is amended by
  amending Subdivisions (1) and (6) and adding Subdivision (1-a) to
  read as follows:
               (1)  "Covered information" means personally
  identifiable information or information that is linked to
  personally identifiable information, in any media or format, that
  is not publicly available and is:
                     (A)  created by or provided to an operator or
  educational entity by a student or the student's parent in the
  course of the student's or parent's use of the operator's or
  entity's website, online service, online application, or mobile
  application for a school purpose;
                     (B)  created by or provided to an operator or
  educational entity by an employee of a school district or school
  campus for a school purpose; or
                     (C)  gathered by an operator or educational entity
  through the operation of the operator's or entity's website, online
  service, online application, or mobile application for a school
  purpose and personally identifies a student, including the
  student's educational record, electronic mail, first and last name,
  home address, telephone number, electronic mail address,
  information that allows physical or online contact, discipline
  records, test results, special education data, juvenile
  delinquency records, grades, evaluations, criminal records,
  medical records, health records, social security number, biometric
  information, disabilities, socioeconomic information, food
  purchases, political affiliations, religious information, text
  messages, student identifiers, search activity, photograph, voice
  recordings, or geolocation information.
               (1-a)  "Educational entity" includes the agency,
  school districts, open-enrollment charter schools, regional
  education service centers, and other local education agencies.
               (6)  "Targeted advertising" means presenting an
  advertisement to a student or a student's parent in which the
  advertisement is selected for the student or parent based on
  information obtained or inferred over time from the student's
  online behavior, usage of applications, or covered information.  
  The term does not include advertising to a student or parent at an
  online location based on the student's or parent's visit to that
  location at that time, or in response to the student's or parent's
  request for information or feedback, without the retention of the
  student's online activities or requests over time for the purpose
  of targeting subsequent advertisements.
         SECTION 2.  Subchapter D, Chapter 32, Education Code, is
  amended by adding Sections 32.1511, 32.1512, 32.1513, 32.1521, and
  32.1531 to read as follows:
         Sec. 32.1511.  OWNERSHIP OF COVERED INFORMATION AND WORK
  PRODUCT. (a) A student retains ownership over the student's own: 
               (1)  covered information; and
               (2)  work or intellectual product, regardless of
  whether the product was created for academic credit.
         (b)  A student may download, export, transfer, or otherwise
  save or maintain any document, covered information, or other data
  created by the student that is held or maintained by an educational
  entity.
         Sec. 32.1512.  OPERATOR APPROVAL; CONTRACT PROVISIONS. (a)  
  An operator must be approved by the agency before the operator may
  contract with an educational entity and collect, use, store, or
  share covered information.
         (b)  A contract between an educational entity and an operator
  must include the following provisions:
               (1)  requirements and restrictions related to the
  collection, use, storage, and sharing of covered information by the
  operator that are necessary for the educational entity to ensure
  the operator's compliance with this subchapter and other law;
               (2)  a description of the person or type of person,
  including an affiliate or subcontractor of the operator, with whom
  the operator may share covered information; and
               (3)  a prohibition on the secondary use of covered
  information by the operator, except when used for a legitimate
  school or research purpose or as described by Sections 32.153 and
  32.154.
         (c)  The commissioner shall develop a procedure for
  approving an operator as required by this subsection.
         Sec. 32.1513.  NOTICE OF INFORMATION DISCLOSURE. (a) Each
  operator that collects covered information shall provide to the
  public, in a manner provided by agency rule, a notice of information
  disclosure stating in plain language the conditions under which a
  student's covered information may be collected, used, or disclosed.
         (b)  The notice of information disclosure must list:
               (1)   the covered information that the operator
  collects and the rationale for collecting the information; and
               (2)  each educational entity, operator, or other third
  party with access to or control of covered information maintained
  by the operator.
         Sec. 32.1521.  PROHIBITED USE OF COVERED INFORMATION BY
  EDUCATIONAL ENTITY. (a) Except as otherwise provided by this
  subchapter, an educational entity may not release or otherwise
  disclose a student's covered information in exchange for a good,
  product, application, service, or any other thing of measurable
  value.
         (b)  An educational entity may not use or release covered
  information for the purpose of targeted advertising unless the
  release of the data is essential for a school purpose, including the
  use of adaptive educational software or other strictly tailored
  educational endeavor with the sole purpose of providing a tailored
  educational experience to the student.
         Sec. 32.1531.  ALLOWED DISCLOSURE OF COVERED INFORMATION BY
  EDUCATIONAL ENTITY. (a) An educational entity may disclose
  covered information if the disclosure is:
               (1)  determined by the entity to be necessary because
  of an imminent health or safety emergency;
               (2)  ordered by a court of competent jurisdiction; or
               (3)  authorized or required by a provision of federal
  or state law.
         (b)  The educational entity must comply with the
  requirements of federal and state law to protect any student
  information disclosed under this section.
         SECTION 3.  The heading to Section 32.152, Education Code,
  is amended to read as follows:
         Sec. 32.152.  PROHIBITED USE OF COVERED INFORMATION BY
  OPERATOR.
         SECTION 4.  Section 32.152(a), Education Code, is amended to
  read as follows:
         (a)  An operator may not knowingly:
               (1)  engage in targeted advertising on any website,
  online service, online application, or mobile application if the
  target of the advertising is based on any information, including
  covered information and persistent unique identifiers, that the
  operator has acquired through the use of the operator's website,
  online service, online application, or mobile application for a
  school purpose;
               (2)  use information, including persistent unique
  identifiers, created or gathered by the operator's website, online
  service, online application, or mobile application, to create a
  profile about a student unless the profile is created for a school
  purpose; [or]
               (3)  except as provided by Subsection (c), sell or rent
  any student's covered information;
               (4)  exchange a student's covered information for any
  good, service, or application; or
               (5)  disclose covered information except as provided
  under this subchapter.
         SECTION 5.  The heading to Section 32.153, Education Code,
  is amended to read as follows:
         Sec. 32.153.  ALLOWED DISCLOSURE OF COVERED INFORMATION BY
  OPERATOR.
         SECTION 6.  Section 32.153, Education Code, is amended by
  amending Subsection (a) and adding Subsection (f) to read as
  follows:
         (a)  An operator may use or disclose covered information
  under the following circumstances:
               (1)  [to further a school purpose of the website,
  online service, online application, or mobile application and the
  recipient of the covered information disclosed under this
  subsection does not further disclose the information unless the
  disclosure is to allow or improve operability and functionality of
  the operator's website, online service, online application, or
  mobile application;
               [(2)]  to ensure legal and regulatory compliance;
               (2) [(3)]  to protect against liability;
               (3) [(4)]  to respond to or participate in the judicial
  process;
               (4) [(5)]  to protect:
                     (A)  the safety or integrity of users of the
  website, online service, online application, or mobile
  application; or
                     (B)  the security of the website, online service,
  online application, or mobile application; or
               (5) [(6)]  for a school, education, or employment
  purpose requested by the student or the student's parent and the
  information is not used or disclosed for any other purpose[;
               [(7)  to use the covered information for:
                     [(A)  a legitimate research purpose; or
                     [(B)  a school purpose or postsecondary
  educational purpose; or
               [(8)  for a request by the agency or the school district
  for a school purpose].
         (f)  Notwithstanding any other law, an operator shall use a
  student's covered information received under a contract with an
  educational entity strictly for the purpose provided under the
  contract.
         SECTION 7.  Section 32.154, Education Code, is amended to
  read as follows:
         Sec. 32.154.  ALLOWED USE OF COVERED INFORMATION BY
  OPERATOR.  This subchapter does not prohibit an operator from:
               (1)  using covered information[:
                     [(A)]  to improve educational products if that
  information is not associated with an identified student using the
  operator's website, online service, online application, or mobile
  application[; and
                     [(B)  that is not associated with an identified
  student to demonstrate the effectiveness of the operator's products
  or services and to market the operator's services;
               [(2)  sharing covered information that is not
  associated with an identified student for the development and
  improvement of educational websites, online services, online
  applications, or mobile applications;
               [(3)  recommending to a student additional services or
  content relating to an educational, learning, or employment
  opportunity within a website, online service, online application,
  or mobile application if the recommendation is not determined by
  payment or other consideration from a third party];
               (2) [(4)]  responding to a student's request for
  information or for feedback without the information or response
  being determined by payment or other consideration from a third
  party; or
               (3) [(5)]  if the operator is a national assessment
  provider or a provider of a college and career counseling service,
  identifying for a student, with the express affirmative consent of
  the student or the student's parent, institutions of higher
  education or scholarship providers that are seeking students who
  meet specific criteria, regardless of whether the identified
  institution of higher education or scholarship provider provides
  consideration to the operator.
         SECTION 8.  The heading to Section 32.155, Education Code,
  as effective September 1, 2023, is amended to read as follows:
         Sec. 32.155.  PROTECTION OF COVERED INFORMATION BY OPERATOR.
         SECTION 9.  Sections 32.155(c), (d), and (e), Education
  Code, as effective September 1, 2023, are amended to read as
  follows:
         (c)  In addition to including the unique identifier in
  releasing information as provided by Subsection (b), an operator
  may include any other data field identified by the agency or by an
  educational entity [a school district, open-enrollment charter
  school, regional education service center, or other local education
  agency] as necessary for the information being released to be
  useful.
         (d)  An educational entity [A school district,
  open-enrollment charter school, regional education service center,
  or other local education agency] may include additional data fields
  in an agreement with an operator or the amendment of an agreement
  with an operator under this section. An operator may agree to
  include the additional data fields requested by an educational
  entity [a school district, open-enrollment charter school,
  regional education service center, or other local education agency]
  but may not require that additional data fields be included.
         (e)  An educational entity [A school district,
  open-enrollment charter school, regional education service center,
  or other local education agency] may require an operator that
  contracts directly with the entity to adhere to a state-required
  student data sharing agreement that includes the use of an
  established unique identifier standard for all operators as
  prescribed by the agency.
         SECTION 10.  The heading to Section 32.156, Education Code,
  is amended to read as follows:
         Sec. 32.156.  DELETION OF COVERED INFORMATION BY OPERATOR.
         SECTION 11.  Sections 32.153(d) and (e), Education Code, are
  repealed.
         SECTION 12.  (a)  The changes in law made by this Act to
  Chapter 32, Education Code, apply only to a contract between an
  operator and an educational entity, as those terms are defined by
  Section 32.151, Education Code, as amended by this Act, entered
  into on or after the effective date of this Act.  A contract entered
  into before the effective date of this Act is governed by the law in
  effect when the contract was entered into, and the former law is
  continued in effect for that purpose.
         (b)  As soon as practicable, each educational entity, as that
  term is defined by Section 32.151, Education Code, as amended by
  this Act, shall make a good faith effort to renegotiate a term of an
  existing contract entered into before the effective date of this
  Act that would have required the entity, in order to comply with the
  term, to violate a requirement of Chapter 32, Education Code, as
  amended by this Act, to the extent necessary to avoid the violation.
         SECTION 13.  As soon as practicable and not later than
  October 1, 2023, the commissioner of education shall adopt rules
  regarding public notice of information disclosures required under
  Section 32.1513, Education Code, as added by this Act.
         SECTION 14.  This Act takes effect September 1, 2023.
feedback