Prohibited activities.

An institution may not do any of the following: (1) request a student or prospective student to disclose a username and password, or a password that allows access to the student's or prospective student's personal Internet account; or (2) expel, discipline, fail to admit, or otherwise penalize a student or prospective student for failure to disclose information specified in Subsection (1).