88R10675 DIO-D
	By: Hall	S.B. No. 1754

	A BILL TO BE ENTITLED
	AN ACT
	relating to certain restrictions on the use of personally
	identifiable information pertaining to a public school student by
	an operator or educational entity.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1.  Section 32.151, Education Code, is amended by
	amending Subdivisions (1) and (6) and adding Subdivision (1-a) to
	read as follows:
	(1)  "Covered information" means personally
	identifiable information or information that is linked to
	personally identifiable information, in any media or format, that
	is not publicly available and is:
	(A)  created by or provided to an operator or
	educational entity by a student or the student's parent in the
	course of the student's or parent's use of the operator's or
	entity's website, online service, online application, or mobile
	application for a school purpose;
	(B)  created by or provided to an operator or
	educational entity by an employee of a school district or school
	campus for a school purpose; or
	(C)  gathered by an operator or educational entity
	through the operation of the operator's or entity's website, online
	service, online application, or mobile application for a school
	purpose and personally identifies a student, including the
	student's educational record, electronic mail, first and last name,
	home address, telephone number, electronic mail address,
	information that allows physical or online contact, discipline
	records, test results, special education data, juvenile
	delinquency records, grades, evaluations, criminal records,
	medical records, health records, social security number, biometric
	information, disabilities, socioeconomic information, food
	purchases, political affiliations, religious information, text
	messages, student identifiers, search activity, photograph, voice
	recordings, or geolocation information.
	(1-a)  "Educational entity" includes the agency,
	school districts, open-enrollment charter schools, regional
	education service centers, and other local education agencies.
	(6)  "Targeted advertising" means presenting an
	advertisement to a student or a student's parent in which the
	advertisement is selected for the student or parent based on
	information obtained or inferred over time from the student's
	online behavior, usage of applications, or covered information.
	The term does not include advertising to a student or parent at an
	online location based on the student's or parent's visit to that
	location at that time, or in response to the student's or parent's
	request for information or feedback, without the retention of the
	student's online activities or requests over time for the purpose
	of targeting subsequent advertisements.
	SECTION 2.  Subchapter D, Chapter 32, Education Code, is
	amended by adding Sections 32.1511, 32.1512, 32.1513, 32.1521, and
	32.1531 to read as follows:
	Sec. 32.1511.  OWNERSHIP OF COVERED INFORMATION AND WORK
	PRODUCT. (a) A student retains ownership over the student's own:
	(1)  covered information; and
	(2)  work or intellectual product, regardless of
	whether the product was created for academic credit.
	(b)  A student may download, export, transfer, or otherwise
	save or maintain any document, covered information, or other data
	created by the student that is held or maintained by an educational
	entity.
	Sec. 32.1512.  OPERATOR APPROVAL; CONTRACT PROVISIONS. (a)
	An operator must be approved by the agency before the operator may
	contract with an educational entity and collect, use, store, or
	share covered information.
	(b)  A contract between an educational entity and an operator
	must include the following provisions:
	(1)  requirements and restrictions related to the
	collection, use, storage, and sharing of covered information by the
	operator that are necessary for the educational entity to ensure
	the operator's compliance with this subchapter and other law;
	(2)  a description of the person or type of person,
	including an affiliate or subcontractor of the operator, with whom
	the operator may share covered information; and
	(3)  a prohibition on the secondary use of covered
	information by the operator, except when used for a legitimate
	school or research purpose or as described by Sections 32.153 and
	32.154.
	(c)  The commissioner shall develop a procedure for
	approving an operator as required by this subsection.
	Sec. 32.1513.  NOTICE OF INFORMATION DISCLOSURE. (a) Each
	operator that collects covered information shall provide to the
	public, in a manner provided by agency rule, a notice of information
	disclosure stating in plain language the conditions under which a
	student's covered information may be collected, used, or disclosed.
	(b)  The notice of information disclosure must list:
	(1)   the covered information that the operator
	collects and the rationale for collecting the information; and
	(2)  each educational entity, operator, or other third
	party with access to or control of covered information maintained
	by the operator.
	Sec. 32.1521.  PROHIBITED USE OF COVERED INFORMATION BY
	EDUCATIONAL ENTITY. (a) Except as otherwise provided by this
	subchapter, an educational entity may not release or otherwise
	disclose a student's covered information in exchange for a good,
	product, application, service, or any other thing of measurable
	value.
	(b)  An educational entity may not use or release covered
	information for the purpose of targeted advertising unless the
	release of the data is essential for a school purpose, including the
	use of adaptive educational software or other strictly tailored
	educational endeavor with the sole purpose of providing a tailored
	educational experience to the student.
	Sec. 32.1531.  ALLOWED DISCLOSURE OF COVERED INFORMATION BY
	EDUCATIONAL ENTITY. (a) An educational entity may disclose
	covered information if the disclosure is:
	(1)  determined by the entity to be necessary because
	of an imminent health or safety emergency;
	(2)  ordered by a court of competent jurisdiction; or
	(3)  authorized or required by a provision of federal
	or state law.
	(b)  The educational entity must comply with the
	requirements of federal and state law to protect any student
	information disclosed under this section.
	SECTION 3.  The heading to Section 32.152, Education Code,
	is amended to read as follows:
	Sec. 32.152.  PROHIBITED USE OF COVERED INFORMATION BY
	OPERATOR.
	SECTION 4.  Section 32.152(a), Education Code, is amended to
	read as follows:
	(a)  An operator may not knowingly:
	(1)  engage in targeted advertising on any website,
	online service, online application, or mobile application if the
	target of the advertising is based on any information, including
	covered information and persistent unique identifiers, that the
	operator has acquired through the use of the operator's website,
	online service, online application, or mobile application for a
	school purpose;
	(2)  use information, including persistent unique
	identifiers, created or gathered by the operator's website, online
	service, online application, or mobile application, to create a
	profile about a student unless the profile is created for a school
	purpose; [or]
	(3)  except as provided by Subsection (c), sell or rent
	any student's covered information;
	(4)  exchange a student's covered information for any
	good, service, or application; or
	(5)  disclose covered information except as provided
	under this subchapter.
	SECTION 5.  The heading to Section 32.153, Education Code,
	is amended to read as follows:
	Sec. 32.153.  ALLOWED DISCLOSURE OF COVERED INFORMATION BY
	OPERATOR.
	SECTION 6.  Section 32.153, Education Code, is amended by
	amending Subsection (a) and adding Subsection (f) to read as
	follows:
	(a)  An operator may use or disclose covered information
	under the following circumstances:
	(1)  [to further a school purpose of the website,
	online service, online application, or mobile application and the
	recipient of the covered information disclosed under this
	subsection does not further disclose the information unless the
	disclosure is to allow or improve operability and functionality of
	the operator's website, online service, online application, or
	mobile application;
	[(2)]  to ensure legal and regulatory compliance;
	(2) [(3)]  to protect against liability;
	(3) [(4)]  to respond to or participate in the judicial
	process;
	(4) [(5)]  to protect:
	(A)  the safety or integrity of users of the
	website, online service, online application, or mobile
	application; or
	(B)  the security of the website, online service,
	online application, or mobile application; or
	(5) [(6)]  for a school, education, or employment
	purpose requested by the student or the student's parent and the
	information is not used or disclosed for any other purpose[;
	[(7)  to use the covered information for:
	[(A)  a legitimate research purpose; or
	[(B)  a school purpose or postsecondary
	educational purpose; or
	[(8)  for a request by the agency or the school district
	for a school purpose].
	(f)  Notwithstanding any other law, an operator shall use a
	student's covered information received under a contract with an
	educational entity strictly for the purpose provided under the
	contract.
	SECTION 7.  Section 32.154, Education Code, is amended to
	read as follows:
	Sec. 32.154.  ALLOWED USE OF COVERED INFORMATION BY
	OPERATOR.  This subchapter does not prohibit an operator from:
	(1)  using covered information[:
	[(A)]  to improve educational products if that
	information is not associated with an identified student using the
	operator's website, online service, online application, or mobile
	application[; and
	[(B)  that is not associated with an identified
	student to demonstrate the effectiveness of the operator's products
	or services and to market the operator's services;
	[(2)  sharing covered information that is not
	associated with an identified student for the development and
	improvement of educational websites, online services, online
	applications, or mobile applications;
	[(3)  recommending to a student additional services or
	content relating to an educational, learning, or employment
	opportunity within a website, online service, online application,
	or mobile application if the recommendation is not determined by
	payment or other consideration from a third party];
	(2) [(4)]  responding to a student's request for
	information or for feedback without the information or response
	being determined by payment or other consideration from a third
	party; or
	(3) [(5)]  if the operator is a national assessment
	provider or a provider of a college and career counseling service,
	identifying for a student, with the express affirmative consent of
	the student or the student's parent, institutions of higher
	education or scholarship providers that are seeking students who
	meet specific criteria, regardless of whether the identified
	institution of higher education or scholarship provider provides
	consideration to the operator.
	SECTION 8.  The heading to Section 32.155, Education Code,
	as effective September 1, 2023, is amended to read as follows:
	Sec. 32.155.  PROTECTION OF COVERED INFORMATION BY OPERATOR.
	SECTION 9.  Sections 32.155(c), (d), and (e), Education
	Code, as effective September 1, 2023, are amended to read as
	follows:
	(c)  In addition to including the unique identifier in
	releasing information as provided by Subsection (b), an operator
	may include any other data field identified by the agency or by an
	educational entity [a school district, open-enrollment charter
	school, regional education service center, or other local education
	agency] as necessary for the information being released to be
	useful.
	(d)  An educational entity [A school district,
	open-enrollment charter school, regional education service center,
	or other local education agency] may include additional data fields
	in an agreement with an operator or the amendment of an agreement
	with an operator under this section. An operator may agree to
	include the additional data fields requested by an educational
	entity [a school district, open-enrollment charter school,
	regional education service center, or other local education agency]
	but may not require that additional data fields be included.
	(e)  An educational entity [A school district,
	open-enrollment charter school, regional education service center,
	or other local education agency] may require an operator that
	contracts directly with the entity to adhere to a state-required
	student data sharing agreement that includes the use of an
	established unique identifier standard for all operators as
	prescribed by the agency.
	SECTION 10.  The heading to Section 32.156, Education Code,
	is amended to read as follows:
	Sec. 32.156.  DELETION OF COVERED INFORMATION BY OPERATOR.
	SECTION 11.  Sections 32.153(d) and (e), Education Code, are
	repealed.
	SECTION 12.  (a)  The changes in law made by this Act to
	Chapter 32, Education Code, apply only to a contract between an
	operator and an educational entity, as those terms are defined by
	Section 32.151, Education Code, as amended by this Act, entered
	into on or after the effective date of this Act.  A contract entered
	into before the effective date of this Act is governed by the law in
	effect when the contract was entered into, and the former law is
	continued in effect for that purpose.
	(b)  As soon as practicable, each educational entity, as that
	term is defined by Section 32.151, Education Code, as amended by
	this Act, shall make a good faith effort to renegotiate a term of an
	existing contract entered into before the effective date of this
	Act that would have required the entity, in order to comply with the
	term, to violate a requirement of Chapter 32, Education Code, as
	amended by this Act, to the extent necessary to avoid the violation.
	SECTION 13.  As soon as practicable and not later than
	October 1, 2023, the commissioner of education shall adopt rules
	regarding public notice of information disclosures required under
	Section 32.1513, Education Code, as added by this Act.
	SECTION 14.  This Act takes effect September 1, 2023.