88R10675 DIO-D

By: Hall S.B. No. 1754

A BILL TO BE ENTITLED

AN ACT

relating to certain restrictions on the use of personally identifiable information pertaining to a public school student by an operator or educational entity.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 32.151, Education Code, is amended by amending Subdivisions (1) and (6) and adding Subdivision (1-a) to read as follows:

(1) "Covered information" means personally identifiable information or information that is linked to personally identifiable information, in any media or format, that is not publicly available and is:

(A) created by or provided to an operator or educational entity by a student or the student's parent in the course of the student's or parent's use of the operator's or entity's website, online service, online application, or mobile application for a school purpose;

(B) created by or provided to an operator or educational entity by an employee of a school district or school campus for a school purpose; or

(C) gathered by an operator or educational entity through the operation of the operator's or entity's website, online service, online application, or mobile application for a school purpose and personally identifies a student, including the student's educational record, electronic mail, first and last name, home address, telephone number, electronic mail address, information that allows physical or online contact, discipline records, test results, special education data, juvenile delinquency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, student identifiers, search activity, photograph, voice recordings, or geolocation information.

(1-a) "Educational entity" includes the agency, school districts, open-enrollment charter schools, regional education service centers, and other local education agencies.

(6) "Targeted advertising" means presenting an advertisement to a student or a student's parent in which the advertisement is selected for the student or parent based on information obtained or inferred over time from the student's online behavior, usage of applications, or covered information. The term does not include advertising to a student or parent at an online location based on the student's or parent's visit to that location at that time, or in response to the student's or parent's request for information or feedback, without the retention of the student's online activities or requests over time for the purpose of targeting subsequent advertisements.

SECTION 2. Subchapter D, Chapter 32, Education Code, is amended by adding Sections 32.1511, 32.1512, 32.1513, 32.1521, and 32.1531 to read as follows:

Sec. 32.1511. OWNERSHIP OF COVERED INFORMATION AND WORK PRODUCT. (a) A student retains ownership over the student's own:

(1) covered information; and

(2) work or intellectual product, regardless of whether the product was created for academic credit.

(b) A student may download, export, transfer, or otherwise save or maintain any document, covered information, or other data created by the student that is held or maintained by an educational entity.

Sec. 32.1512. OPERATOR APPROVAL; CONTRACT PROVISIONS. (a) An operator must be approved by the agency before the operator may contract with an educational entity and collect, use, store, or share covered information.

(b) A contract between an educational entity and an operator must include the following provisions:

(1) requirements and restrictions related to the collection, use, storage, and sharing of covered information by the operator that are necessary for the educational entity to ensure the operator's compliance with this subchapter and other law;

(2) a description of the person or type of person, including an affiliate or subcontractor of the operator, with whom the operator may share covered information; and

(3) a prohibition on the secondary use of covered information by the operator, except when used for a legitimate school or research purpose or as described by Sections 32.153 and 32.154.

(c) The commissioner shall develop a procedure for approving an operator as required by this subsection.

Sec. 32.1513. NOTICE OF INFORMATION DISCLOSURE. (a) Each operator that collects covered information shall provide to the public, in a manner provided by agency rule, a notice of information disclosure stating in plain language the conditions under which a student's covered information may be collected, used, or disclosed.

(b) The notice of information disclosure must list:

(1) the covered information that the operator collects and the rationale for collecting the information; and

(2) each educational entity, operator, or other third party with access to or control of covered information maintained by the operator.

Sec. 32.1521. PROHIBITED USE OF COVERED INFORMATION BY EDUCATIONAL ENTITY. (a) Except as otherwise provided by this subchapter, an educational entity may not release or otherwise disclose a student's covered information in exchange for a good, product, application, service, or any other thing of measurable value.

(b) An educational entity may not use or release covered information for the purpose of targeted advertising unless the release of the data is essential for a school purpose, including the use of adaptive educational software or other strictly tailored educational endeavor with the sole purpose of providing a tailored educational experience to the student.

Sec. 32.1531. ALLOWED DISCLOSURE OF COVERED INFORMATION BY EDUCATIONAL ENTITY. (a) An educational entity may disclose covered information if the disclosure is:

(1) determined by the entity to be necessary because of an imminent health or safety emergency;

(2) ordered by a court of competent jurisdiction; or

(3) authorized or required by a provision of federal or state law.

(b) The educational entity must comply with the requirements of federal and state law to protect any student information disclosed under this section.

SECTION 3. The heading to Section 32.152, Education Code, is amended to read as follows:

Sec. 32.152. PROHIBITED USE OF COVERED INFORMATION BY OPERATOR.

SECTION 4. Section 32.152(a), Education Code, is amended to read as follows:

(a) An operator may not knowingly:

(1) engage in targeted advertising on any website, online service, online application, or mobile application if the target of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired through the use of the operator's website, online service, online application, or mobile application for a school purpose;

(2) use information, including persistent unique identifiers, created or gathered by the operator's website, online service, online application, or mobile application, to create a profile about a student unless the profile is created for a school purpose; [or]

(3) except as provided by Subsection (c), sell or rent any student's covered information;

(4) exchange a student's covered information for any good, service, or application; or

(5) disclose covered information except as provided under this subchapter.

SECTION 5. The heading to Section 32.153, Education Code, is amended to read as follows:

Sec. 32.153. ALLOWED DISCLOSURE OF COVERED INFORMATION BY OPERATOR.

SECTION 6. Section 32.153, Education Code, is amended by amending Subsection (a) and adding Subsection (f) to read as follows:

(a) An operator may use or disclose covered information under the following circumstances:

(1) [to further a school purpose of the website, online service, online application, or mobile application and the recipient of the covered information disclosed under this subsection does not further disclose the information unless the disclosure is to allow or improve operability and functionality of the operator's website, online service, online application, or mobile application;

[(2)] to ensure legal and regulatory compliance;

(2) [(3)] to protect against liability;

(3) [(4)] to respond to or participate in the judicial process;

(4) [(5)] to protect:

(A) the safety or integrity of users of the website, online service, online application, or mobile application; or

(B) the security of the website, online service, online application, or mobile application; or

(5) [(6)] for a school, education, or employment purpose requested by the student or the student's parent and the information is not used or disclosed for any other purpose[;

[(7) to use the covered information for:

[(A) a legitimate research purpose; or

[(B) a school purpose or postsecondary educational purpose; or

[(8) for a request by the agency or the school district for a school purpose].

(f) Notwithstanding any other law, an operator shall use a student's covered information received under a contract with an educational entity strictly for the purpose provided under the contract.

SECTION 7. Section 32.154, Education Code, is amended to read as follows:

Sec. 32.154. ALLOWED USE OF COVERED INFORMATION BY OPERATOR. This subchapter does not prohibit an operator from:

(1) using covered information[:

[(A)] to improve educational products if that information is not associated with an identified student using the operator's website, online service, online application, or mobile application[; and

[(B) that is not associated with an identified student to demonstrate the effectiveness of the operator's products or services and to market the operator's services;

[(2) sharing covered information that is not associated with an identified student for the development and improvement of educational websites, online services, online applications, or mobile applications;

[(3) recommending to a student additional services or content relating to an educational, learning, or employment opportunity within a website, online service, online application, or mobile application if the recommendation is not determined by payment or other consideration from a third party];

(2) [(4)] responding to a student's request for information or for feedback without the information or response being determined by payment or other consideration from a third party; or

(3) [(5)] if the operator is a national assessment provider or a provider of a college and career counseling service, identifying for a student, with the express affirmative consent of the student or the student's parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institution of higher education or scholarship provider provides consideration to the operator.

SECTION 8. The heading to Section 32.155, Education Code, as effective September 1, 2023, is amended to read as follows:

Sec. 32.155. PROTECTION OF COVERED INFORMATION BY OPERATOR.

SECTION 9. Sections 32.155(c), (d), and (e), Education Code, as effective September 1, 2023, are amended to read as follows:

(c) In addition to including the unique identifier in releasing information as provided by Subsection (b), an operator may include any other data field identified by the agency or by an educational entity [a school district, open-enrollment charter school, regional education service center, or other local education agency] as necessary for the information being released to be useful.

(d) An educational entity [A school district, open-enrollment charter school, regional education service center, or other local education agency] may include additional data fields in an agreement with an operator or the amendment of an agreement with an operator under this section. An operator may agree to include the additional data fields requested by an educational entity [a school district, open-enrollment charter school, regional education service center, or other local education agency] but may not require that additional data fields be included.

(e) An educational entity [A school district, open-enrollment charter school, regional education service center, or other local education agency] may require an operator that contracts directly with the entity to adhere to a state-required student data sharing agreement that includes the use of an established unique identifier standard for all operators as prescribed by the agency.

SECTION 10. The heading to Section 32.156, Education Code, is amended to read as follows:

Sec. 32.156. DELETION OF COVERED INFORMATION BY OPERATOR.

SECTION 11. Sections 32.153(d) and (e), Education Code, are repealed.

SECTION 12. (a) The changes in law made by this Act to Chapter 32, Education Code, apply only to a contract between an operator and an educational entity, as those terms are defined by Section 32.151, Education Code, as amended by this Act, entered into on or after the effective date of this Act. A contract entered into before the effective date of this Act is governed by the law in effect when the contract was entered into, and the former law is continued in effect for that purpose.

(b) As soon as practicable, each educational entity, as that term is defined by Section 32.151, Education Code, as amended by this Act, shall make a good faith effort to renegotiate a term of an existing contract entered into before the effective date of this Act that would have required the entity, in order to comply with the term, to violate a requirement of Chapter 32, Education Code, as amended by this Act, to the extent necessary to avoid the violation.

SECTION 13. As soon as practicable and not later than October 1, 2023, the commissioner of education shall adopt rules regarding public notice of information disclosures required under Section 32.1513, Education Code, as added by this Act.

SECTION 14. This Act takes effect September 1, 2023.