Our Take
A study and recommendations on this topic may well be appropriate. But it is not clear why the University of Texas at San Antonio (UTSA), as opposed to some other authority, oversee it. Despite the provision requiring financial institutions to cooperate and provide information, other laws may limit the extent to which financial institutions can provide personally identifiable information to a university. There may be more flexibility if the study is overseen by a consortium of regulators rather than limiting their role to consultation. The bill uses the definition of "sensitive personal information" in Section 521.053, Business & Commerce Code. This may be too limited, in that it appears to relate to sensitive information about natural persons and may not include sensitive information involving incorporated entities.