An institution may not do any of the following:
(1) request a student or prospective student to disclose a username and password, or a password that allows access to the student's or prospective student's personal Internet account; or
(2) expel, discipline, fail to admit, or otherwise penalize a student or prospective student for failure to disclose information specified in Subsection (1).