| |
| |
|
|
A BILL TO BE ENTITLED
|
|
|
AN ACT
|
|
|
relating to restricting the use of personally identifiable student |
|
|
information by an operator of a website, online service, online |
|
|
application, or mobile application used for a school purpose and |
|
|
providing an exemption from certain restrictions for a national |
|
|
assessment provider. |
|
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
|
SECTION 1. Section 32.155, Education Code, is amended to |
|
|
read as follows: |
|
|
Sec. 32.155. PROTECTION OF COVERED INFORMATION. (a) An |
|
|
operator must implement and maintain reasonable security |
|
|
procedures and practices designed to protect any covered |
|
|
information from unauthorized access, deletion, use, modification, |
|
|
or disclosure. |
|
|
(b) Any operator that has been approved by the agency or had |
|
|
a product adopted by the agency and possesses any covered |
|
|
information must use the unique identifier established by the Texas |
|
|
Student Data System (TSDS) or a successor data management system |
|
|
maintained by the agency for any account creation, data upload, |
|
|
data transmission, analysis, or reporting to mask all personally |
|
|
identifiable student information. The operator shall adhere to a |
|
|
state-required student data sharing agreement that includes an |
|
|
established unique identifier standard for all operators as |
|
|
prescribed by the agency. |
|
|
(c) In addition to including the unique identifier in |
|
|
releasing information as provided by Subsection (b), an operator |
|
|
may include any other data field identified by the agency or by a |
|
|
school district, open-enrollment charter school, regional |
|
|
education service center, or other local education agency as |
|
|
necessary for the information being released to be useful. |
|
|
(d) A school district, open-enrollment charter school, |
|
|
regional education service center, or other local education agency |
|
|
may include additional data fields in an agreement with an operator |
|
|
or the amendment of an agreement with an operator under this |
|
|
section. An operator may agree to include the additional data |
|
|
fields requested by a school district, open-enrollment charter |
|
|
school, regional education service center, or other local education |
|
|
agency but may not require that additional data fields be included. |
|
|
(e) A school district, open-enrollment charter school, |
|
|
regional education service center, or other local education agency |
|
|
may require an operator that contracts directly with the entity to |
|
|
adhere to a state-required student data sharing agreement that |
|
|
includes the use of an established unique identifier standard for |
|
|
all operators as prescribed by the agency. |
|
|
(f) A national assessment provider who receives covered |
|
|
information from a student or from a school district or campus on |
|
|
behalf of a student is not required to comply with Subsection (b) or |
|
|
(e) if the provider receives the covered information solely to |
|
|
provide access to: |
|
|
(1) employment, educational scholarships, financial |
|
|
aid, or postsecondary educational opportunities; or |
|
|
(2) educational resources for middle school, junior |
|
|
high school, or high school students. |
|
|
(g) The commissioner may adopt rules as necessary to |
|
|
administer this section. |
|
|
SECTION 2. This Act takes effect September 1, 2023. |