PROTECTION OF COVERED INFORMATION.

(a) An operator must implement and maintain reasonable security procedures and practices designed to protect any covered information from unauthorized access, deletion, use, modification, or disclosure.

(b) Any operator that has been approved by the agency or had a product adopted by the agency and possesses any covered information must use the unique identifier established by the Texas Student Data System (TSDS) or a successor data management system maintained by the agency for any account creation, data upload, data transmission, analysis, or reporting to mask all personally identifiable student information. The operator shall adhere to a state-required student data sharing agreement that includes an established unique identifier standard for all operators as prescribed by the agency.

(c) In addition to including the unique identifier in releasing information as provided by Subsection (b), an operator may include any other data field identified by the agency or by a school district, open-enrollment charter school, regional education service center, or other local education agency as necessary for the information being released to be useful.

(d) A school district, open-enrollment charter school, regional education service center, or other local education agency may include additional data fields in an agreement with an operator or the amendment of an agreement with an operator under this section. An operator may agree to include the additional data fields requested by a school district, open-enrollment charter school, regional education service center, or other local education agency but may not require that additional data fields be included.

(e) A school district, open-enrollment charter school, regional education service center, or other local education agency may require an operator that contracts directly with the entity to adhere to a state-required student data sharing agreement that includes the use of an established unique identifier standard for all operators as prescribed by the agency.

(f) A national assessment provider who receives covered information from a student or from a school district or campus on behalf of a student is not required to comply with Subsection (b) or (e) if the provider receives the covered information solely to provide access to:

(1) employment, educational scholarships, financial aid, or postsecondary educational opportunities; or

(2) educational resources for middle school, junior high school, or high school students.

(g) The commissioner may adopt rules as necessary to administer this section.