(a)(1) An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student.
(2) The officers, employees, and agents of a party that receives information under paragraph (a)(1) of this section may use the information, but only for the purposes for which the disclosure was made.
(b)(1) Paragraph (a) of this section does not prevent an educational agency or institution from disclosing personally identifiable information with the understanding that the party receiving the information may make further disclosures of the information on behalf of the educational agency or institution if?
(i) The disclosures meet the requirements of Section 99.31; and
(ii)(A) The educational agency or institution has complied with the requirements of Section 99.32(b); or
(B) A State or local educational authority or Federal official or agency listed in Section 99.31(a)(3) has complied with the requirements of Section 99.32(b)(2).
(2) A party that receives a court order or lawfully issued subpoena and rediscloses personally identifiable information from education records on behalf of an educational agency or institution in response to that order or subpoena under Section 99.31(a)(9) must provide the notification required under Section 99.31(a)(9)(ii).
(c) Paragraph (a) of this section does not apply to disclosures under Sections 99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to disclose under the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act, 20 USC 1092(f) (Clery Act), to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense.
(d) An educational agency or institution must inform a party to whom disclosure is made of the requirements of paragraph (a) of this section except for disclosures made under Sections 99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to disclose under the Clery Act to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense.
(e) If this Office determines that a third party outside the educational agency or institution improperly rediscloses personally identifiable information from education records in violation of this section, or fails to provide the notification required under paragraph (b)(2) of this section, the educational agency or institution may not allow that third party access to personally identifiable information from education records for at least five years.
[73 FR 74853, Dec. 9, 2008]