(i) In general Each State that receives a grant under subsection (c)(2) shall implement measures to
(I) ensure that the statewide P16 education data system meets the requirements of section
1232g of this title (commonly known as the Family Educational Rights and Privacy Act of 1974);
(II) limit the use of information in the statewide P16 education data system by institutions of higher education and State or local educational agencies or institutions to the activities set forth in paragraph (1) or State law regarding education, consistent with the purposes of this subchapter;
(III) prohibit the disclosure of personally identifiable information except as permitted under section
1232g of this title and any additional limitations set forth in State law;
(IV) keep an accurate accounting of the date, nature, and purpose of each disclosure of personally identifiable information in the statewide P16 education data system, a description of the information disclosed, and the name and address of the person, agency, institution, or entity to whom the disclosure is made, which accounting shall be made available on request to parents of any
student whose information has been disclosed;
(V) notwithstanding section
1232g of this title, require any non-governmental party obtaining personally identifiable information to sign a data use agreement prior to disclosure that
(aa) prohibits the party from further disclosing the information;
(bb) prohibits the party from using the information for any purpose other than the purpose specified in the agreement; and
(cc) requires the party to destroy the information when the purpose for which the disclosure was made is accomplished;
(VI) maintain adequate security measures to ensure the confidentiality and integrity of the statewide P16 education data system, such as protecting a
student record from identification by a unique identifier;
(VII) where rights are provided to parents under this clause, provide those rights to the
student instead of the parent if the
student has reached the age of 18 or is enrolled in a postsecondary educational institution; and
(VIII) ensure adequate enforcement of the requirements of this clause.
(ii) Use of unique identifiers
(I) Governmental use of unique identifiers It shall be unlawful for any Federal, State, or local governmental agency to use the unique identifiers employed in the statewide P16 education data systems for any purpose other than as authorized by Federal or State law regarding education, or to deny any individual any right, benefit, or privilege provided by law because of such individuals refusal to disclose the individuals unique identifier.
(II) Regulations Not later than 180 days after August 9, 2007, the Secretary shall promulgate regulations governing the use by governmental and non-governmental entities of the unique identifiers employed in statewide P16 education data systems, including, where necessary, regulations requiring States desiring grants for statewide P16 education data systems under this section to implement specified measures, with the goal of safeguarding individual privacy to the maximum extent practicable consistent with the uses of the information authorized in this Act or other Federal or State law regarding education.