(a) In this section, “personal data” means any information relating to an identified or identifiable individual that directly or indirectly identifies the individual by reference to:
(1) an identifier for the individual, including a name, an identification number, location information, or an online identifier; or
(2) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of the individual.
(b) As part of its review of a state agency, the commission shall determine whether the state agency sells personal data the agency possesses. If the state agency sells personal data, the commission shall determine:
(1) to whom the personal data is sold;
(2) to the extent possible, the purpose for which the personal data is sold;
(3) the amount the state agency receives for the sale of the personal data; and
(4) the law that authorizes the state agency to sell the personal data.

(c) The commission shall recommend prohibiting the sale of personal data by a state agency, unless the commission identifies a compelling state or public interest justifying the state agency’s authority to sell the personal data. If the commission recommends continuing the state agency’s authority to sell personal data, the commission shall make any recommendations it considers necessary to protect the personal data from improper use and dissemination.