85R12590 CAE-F
	By: VanDeaver	H.B. No. 2087

	A BILL TO BE ENTITLED
	AN ACT
	relating to restricting the use of covered information, including
	student personally identifiable information, by an operator of a
	website, online service, online application, or mobile application
	for a school purpose.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1.  The heading to Chapter 32, Education Code, is
	amended to read as follows:
	CHAPTER 32. COMPUTERS, [AND] COMPUTER-RELATED EQUIPMENT, AND
	STUDENT INFORMATION PROTECTION
	SECTION 2.  Chapter 32, Education Code, is amended by adding
	Subchapter D to read as follows:
	SUBCHAPTER D. STUDENT INFORMATION
	Sec. 32.151.  DEFINITIONS. In this subchapter:
	(1)  "Covered information" means personally
	identifiable information or information that is linked to
	personally identifiable information, in any media or format, that
	is not publicly available and is:
	(A)  created by or provided to an operator by a
	student or the student's parent in the course of the student's or
	parent's use of the operator's website, online service, online
	application, or mobile application for a school purpose;
	(B)  created by or provided to an operator by an
	employee of a school district or school campus for a school purpose;
	or
	(C)  gathered by an operator through the operation
	of the operator's website, online service, online application, or
	mobile application for a school purpose and personally identifies a
	student, including the student's educational record, electronic
	mail, first and last name, home address, telephone number,
	electronic mail address, information that allows physical or online
	contact, discipline records, test results, special education data,
	juvenile delinquency records, grades, evaluations, criminal
	records, medical records, health records, social security number,
	biometric information, disabilities, socioeconomic information,
	food purchases, political affiliations, religious information,
	text messages, student identifiers, search activity, photograph,
	voice recordings, or geolocation information.
	(2)  "Interactive computer service" has the meaning
	assigned by 47 U.S.C. Section 230.
	(3)  "Operator" means, to the extent operating in this
	capacity, the operator of a website, online service, online
	application, or mobile application who has actual knowledge that
	the website, online service, online application, or mobile
	application is used primarily for a school purpose and was designed
	and marketed for a school purpose.
	(4)  "Parent" includes a person standing in parental
	relation.
	(5)  "School purpose" means a purpose that is directed
	by or customarily takes place at the direction of a school district,
	school campus, or teacher or assists in the administration of
	school activities, including instruction in the classroom or at
	home, administrative activities, and collaboration between
	students, school personnel, or parents, or is otherwise for the use
	and benefit of the school.
	(6)  "Targeted advertising" means presenting an
	advertisement to a student in which the advertisement is selected
	for the student based on information obtained or inferred over time
	from the student's online behavior, usage of applications, or
	covered information.  The term does not include advertising to a
	student at an online location based on the student's visit to that
	location at that time, or in response to the student's request for
	information or feedback, without the retention of the student's
	online activities or requests over time for the purpose of
	targeting subsequent advertisements.
	Sec. 32.152.  PROHIBITED USE OF COVERED INFORMATION. (a) An
	operator may not knowingly:
	(1)  engage in targeted advertising on any website,
	online service, online application, or mobile application if the
	target of the advertising is based on any information, including
	covered information and persistent unique identifiers, that the
	operator has acquired through the use of the operator's website,
	online service, online application, or mobile application for a
	school purpose;
	(2)  use information, including persistent unique
	identifiers, created or gathered by the operator's website, online
	service, online application, or mobile application, to create a
	profile about a student unless the profile is created for a school
	purpose; or
	(3)  except as provided by Subsection (c), sell or rent
	any student's covered information.
	(b)  For purposes of Subsection (a)(2), the collection and
	retention of account information by an operator that remains under
	the control of the student, the student's parent, or the campus or
	district is not an attempt to create a profile by the operator.
	(c)  Subsection (a)(3) does not apply to:
	(1)  the purchase, merger, or any other type of
	acquisition of an operator by another entity, if the operator or
	successor entity complies with this subchapter regarding
	previously acquired student information; or
	(2)  a national assessment provider if the provider
	secures the express written consent of the student if the student is
	18 years of age or older or the student's parent if the student is 17
	years of age or younger, given in response to clear and conspicuous
	notice, if the information is used solely to provide access to
	employment, educational scholarships, financial aid, or
	postsecondary educational opportunities.
	Sec. 32.153.  ALLOWED DISCLOSURE OF COVERED INFORMATION.
	(a) An operator may use or disclose covered information if the
	disclosure is:
	(1)  to further a school purpose of the website, online
	service, online application, or mobile application and the
	recipient of the covered information disclosed under this
	subsection does not further disclose the information unless the
	disclosure is to allow or improve operability and functionality of
	the operator's website, online service, online application, or
	mobile application;
	(2)  to ensure legal and regulatory compliance;
	(3)  to protect against liability;
	(4)  to respond to or participate in the judicial
	process;
	(5)  to protect:
	(A)  the safety or integrity of users of the
	website, online service, online application, or mobile
	application; or
	(B)  the security of the website, online service,
	online application, or mobile application;
	(6)  for a school, education, or employment purpose
	requested by the student or the student's parent and the
	information is not used or disclosed for any other purpose;
	(7)  to use the covered information for:
	(A)  a legitimate research purpose; or
	(B)  a school purpose or postsecondary
	educational purpose; or
	(8)  requested by the agency or the school district for
	a school purpose.
	(b)  An operator may disclose covered information if a
	provision of federal or state law requires the operator to disclose
	the information. The operator must comply with the requirements of
	federal and state law to protect the information being disclosed.
	(c)  An operator may disclose covered information to a third
	party if the operator has contracted with the third party to provide
	a service for a school purpose for or on behalf of the operator. The
	contract must prohibit the third party from using any covered
	information for any purpose other than providing the contracted
	service. The operator must require the third party to implement and
	maintain reasonable procedures and practices designed to prevent
	disclosure of covered information.
	(d)  Nothing in this subchapter prohibits the operator's use
	of covered information for maintaining, developing, supporting,
	improving, or diagnosing the operator's website, online service,
	online application, or mobile application.
	Sec. 32.154.  ALLOWED USE OF COVERED INFORMATION. This
	subchapter does not prohibit an operator from:
	(1)  using covered information:
	(A)  to improve educational products if that
	information is not associated with an identified student using the
	operator's website, online service, online application, or mobile
	application; and
	(B)  that is not associated with an identified
	student to demonstrate the effectiveness of the operator's products
	or services and to market the operator's services;
	(2)  sharing covered information that is not associated
	with an identified student for the development and improvement of
	educational websites, online services, online applications, or
	mobile applications;
	(3)  recommending to a student additional services or
	content relating to an educational, learning, or employment
	opportunity within a website, online service, online application,
	or mobile application if the recommendation is not determined by
	payment or other consideration from a third party;
	(4)  responding to a student's request for information
	or for feedback without the information or response being
	determined by payment or other consideration from a third party; or
	(5)  identifying for a student, with the express
	affirmative consent of the student if the student is 18 years of age
	or older or the student's parent if the student is 17 years of age or
	younger, institutions of higher education or scholarship providers
	that are seeking students who meet specific criteria, regardless of
	whether the identified institution of higher education or
	scholarship provider provides consideration to the operator.
	Sec. 32.155.  PROTECTION OF COVERED INFORMATION. An
	operator must implement and maintain reasonable security
	procedures and practices designed to protect any covered
	information from unauthorized access, deletion, use, modification,
	or disclosure.
	Sec. 32.156.  DELETION OF COVERED INFORMATION. If a school
	district requests the deletion of a student's covered information
	under the control of the school district and maintained by the
	operator, the operator shall delete the information not later than
	the 60th day after the date of the request, or as otherwise
	specified in the contract or terms of service, unless the student or
	the student's parent consents to the operator's maintenance of the
	covered information.
	Sec. 32.157.  APPLICABILITY. This subchapter does not:
	(1)  limit the authority of a law enforcement agency to
	obtain any information from an operator as authorized by law or
	under a court order;
	(2)  limit the ability of an operator to use student
	data, including covered information, for adaptive learning or
	customized student learning purposes;
	(3)  apply to general audience:
	(A)  websites;
	(B)  online services;
	(C)  online applications; or
	(D)  mobile applications;
	(4)  limit service providers from providing Internet
	connection to school districts or students and students' families;
	(5)  prohibit an operator from marketing educational
	products directly to a student's parent if the marketing is not a
	result of the use of covered information obtained by the operator
	through providing services to the school district;
	(6)  impose a duty on a provider of an electronic store,
	gateway, marketplace, or other means of purchasing or downloading
	software or applications to review or enforce compliance with this
	subchapter on those applications or software;
	(7)  impose a duty on a provider of an interactive
	computer service to review or enforce compliance with this
	subchapter by third-party content providers; or
	(8)  prohibit a student from downloading, exporting,
	transferring, saving, or maintaining the student's data or
	documents.
	SECTION 3.  This Act takes effect September 1, 2017.