1. (a) Each institution of higher education shall publish a privacy and security policy for its Web site, and post a link to the policy from its home page, or Site Policies page. The privacy and security policy shall address the following:

   1. (1) Notice: This section must disclose the institution of higher education's information practices before the site collects personal information from the public, including the use of, cookies, and/or Web bugs as well as information collected by other technologies and processes, and information collected via e-mail and Web-based forms.
   2. (2) Choice: This section must disclose whether and how personal information collected from the public may be used for purposes beyond those for which the information was provided.
   3. (3) Access: This section must address the procedure under which an individual may obtain information about himself or herself from the institution of higher education and/or have the institution of higher education correct information about the individual.
   4. (4) Security: This section must describe the procedures that ensure that information collected from individuals is accurate and secure from unauthorized use.
2. (b) Web pages designed for children must comply with all applicable federal and state laws intended to protect minors.

3. (c) Prior to providing access to information or services on a state Web site that require user identification, each institution of higher education shall conduct a transaction risk assessment and implement appropriate privacy and security safeguards. At a minimum, Web sites that require an individual to enter the following information in a Web based electronic form shall use an SSL session or equivalent technology to encrypt the data:

   1. (1) The individual's name and other personal information, such as an SSN;
   2. (2) Transaction payment information;
   3. (3) An individual's access identification code and password;
   4. (4) An individual's e-mail address.
4. (d) Any Web based form that requests information from the public shall have a link to the associated privacy and security policy.

Source Note:The provisions of this §206.73 adopted to be effective November 28, 2004, 29 TexReg 10712.