Student Privacy Protection Act

To amend the General Education Provisions Act to strengthen privacy protections for students and parents. 1. Short title This Act may be cited as the Student Privacy Protection Act 2. References Except as otherwise expressly provided, whenever in this Act an amendment or repeal is expressed in terms of an amendment to, or repeal of, a subsection or other provision, the reference shall be considered to be made to a subsection or other provision of section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g Family Educational Rights and Privacy Act of 1974 3. FERPA short title Subsection (a) ( 20 U.S.C. 1232g(a) (a) Short title This section may be cited as the Family Educational Rights and Privacy Act of 1974 . 4. Requirements Such section ( 20 U.S.C. 1232g (b) In general No funds shall be made available under any applicable program to any educational agency or institution, or State educational authority, unless such agency or institution, or State educational authority, complies with the following requirements: (1) Parental access (A) Educational agency or institution The educational agency or institution shall not deny or effectively prevent the parents of students who are or have been in attendance at a school of such agency or at such institution, as the case may be, the right to inspect and review the education records of their children. If any material or document in the education record of a student includes information on more than one student, a parent shall have the right to inspect and review only such part of such material or document that relates to such parent’s child. (B) Appropriate procedures (i) In general The State educational authority shall establish appropriate procedures for the granting of a request by parents for access to the education records of their children who are or have been in attendance at any educational agency or institution under the jurisdiction of the State educational authority. (ii) Reasonable response time The educational agency or institution, or the State educational authority, shall establish appropriate procedures for the granting of a request by parents for access to the education records of their children within a reasonable period of time, but in no case more than 30 days after the request has been received. (2) Restrictions on parent and student access (A) Restrictions The educational agency or institution shall not make available to students enrolled in an institution of higher education the following: (i) Financial records of the parents of the student or any information contained therein. (ii) Confidential letters and statements of recommendation, which were placed in the education records prior to January 1, 1975, if such letters or statements are not used for purposes other than those for which they were specifically intended. (iii) If the student, while in high school at any age, has signed a waiver of the student’s right of access in accordance with subparagraph (B), confidential recommendations— (I) respecting admission to any educational agency or institution; (II) respecting an application for employment; and (III) respecting the receipt of an honor or honorary recognition. (B) Waiver (i) In general A student or a person applying for admission may waive the right to access confidential statements described in subparagraph (A)(ii), except that such waiver shall apply to recommendations only if— (I) the student is, upon request, notified of the names of all persons making confidential recommendations; and (II) such recommendations are used solely for the purposes for which they were specifically intended. (ii) Limitations A waiver under this subparagraph may not be required as a condition for admission to, receipt of financial aid from, or receipt of any other services or benefits from such agency or institution. (3) Adjustments to record The educational agency or institution shall provide parents of students who are or have been in attendance at a school of such agency or at such institution an opportunity to— (A) challenge and correct the content of the education record that the parent believes is inaccurate or misleading at the time of attendance or otherwise in violation of privacy rights of students through a hearing by such agency or institution, in accordance with the regulations of the Secretary; and (B) insert into such education records a written explanation of the parents respecting the content of such records. (4) Disclosure of records without parental consent Except as otherwise provided under subsection (c), the educational agency or institution shall not permit the disclosure of education records (or personally identifiable information contained therein) of students without the written consent of their parents to any individual, agency, or organization. (5) Recordkeeping (A) In general The educational agency or institution shall maintain a record, kept with the education records of each student, in an easy to retrieve and understandable format, which will indicate— (i) each individual, agency, or organization (other than an individual, agency, or organization specified under subsection (c)) that has obtained access to a student’s education record maintained by such educational agency or institution; and (ii) specifically the legitimate interest that each such individual, agency, or organization has in obtaining such information. (B) Availability of records Such record of access shall be available only to parents, to the school officials and their assistants who are responsible for the custody of such record of access, and to the Secretary or the designee of the Secretary, as a means of monitoring compliance with this section. (C) Written agreements The educational agency or institution and the State educational authority shall maintain a copy of and make available to parents, upon request, any written agreements that are required under this section. (6) Security practices The educational agency or institution, and the State educational authority shall— (A) establish, implement, and enforce policies and procedures regarding information security practices that— (i) serve to protect the education records (and personally identifiable information contained therein) held or maintained by that educational agency or institution, or State educational authority; and (ii) require any party that is given access to such education records (or personally identifiable information contained therein) on behalf of the educational agency or institution, or State educational authority, to have information security practices that serve to protect such records and information; (B) designate an official who shall be responsible for maintaining the security of its education records; and (C) establish a breach notification policy in the case of a breach of the security practices under subparagraph (A) or the release of the education records or information contained therein in violation of this section, under which the educational agency or institution, or State educational authority— (i) provides notification of the breach or violation to parents in not less than 3 days of being made aware of such breach; and (ii) works with the third parties involved with such breach or violation to gather the information necessary to provide such notification. (7) Duty to inform The educational agency or institution shall effectively— (A) inform the parents of students, or the students (if such students are 18 years of age or older, or are attending an institution of higher education) of the rights accorded them by this section; and (B) inform students of high school age of the rights of parents and students under this section, and how those rights transfer from a parent to a student in accordance with paragraph (8). (8) Transfer of rights The educational agency or institution shall ensure that whenever a student has attained 18 years of age, or is attending an institution of higher education, the consent required of and the rights accorded to the parents of the student shall thereafter only be required of and accorded to the student. (9) Ensuring compliance The State educational authority shall— (A) verify that each educational agency and institution under its jurisdiction— (i) has provided the appropriate notices to parents and students required under this section in an easy-to-understand format; and (ii) is in compliance with the requirements of this section; and (B) certify to the Secretary that each educational agency and institution under its jurisdiction is in compliance with the requirements of this section. . 5. Disclosure of records without parental consent (a) In general Such section ( 20 U.S.C. 1232g (c) Disclosure of records without parental consent Notwithstanding subsection (b)(4) and subject to subsection (h), an educational agency or institution may permit the disclosure of education records (or personally identifiable information contained therein) of students without the written consent of their parents to, or for, any of the following: (1) Other school officials, including teachers, within the same educational agency or institution, who have been determined by such agency or institution to have legitimate educational interests, including the educational interests of the child for whom consent would otherwise be required. (2) An education service provider, contractor, consultant, volunteer, or other party who has been determined by such educational agency or institution to have legitimate educational interests and to whom the educational agency or institution has outsourced institutional services or functions, provided that— (A) the party— (i) performs an institutional service or function for which the agency or institution would otherwise use employees; (ii) is under the direct control of the educational agency or institution with respect to the use and maintenance of education records; (iii) is in compliance with the requirements of this section relating to the use and release of personally identifiable information contained in such education records; and (iv) has entered into a written agreement with the educational agency or institution, subject to the regulations of the Secretary, that establishes requirements concerning the protection of the information that will be disclosed to the party, including— (I) clear provisions outlining how and what information from the education records shall be disclosed to the party and what personally identifiable information the party will create in carrying out the party’s duties under the agreement; (II) a description of any subcontractor or person acting for the party in carrying out its duties under the agreement; (III) requirements that prohibit the party from releasing personally identifiable information to any other party, except to a subcontractor or person acting for the party described in subclause (II); (IV) clear provisions— (aa) outlining policies and practices to ensure that education records (including personally identifiable information contained therein) will be secured using commonly accepted industry standards, by electronic or physical means by such party; and (bb) which stipulate that such means will secure such records and information from unauthorized access and that such policies and practices will be followed; (V) the penalties for a security breach in violation of the agreement; and (VI) provisions that specify the acceptable uses by such party of the personally identifiable information in compliance with this section; and (B) the educational agency or institution— (i) notifies parents and students of the policies and means the party uses, without disclosing the specific policies or means used, to protect the security of personally identifiable information maintained by the party; and (ii) ensures that— (I) any education records that are held by the party shall, at a minimum, be handled and stored in a manner that meets the commonly accepted industry standards on privacy protection; and (II) upon request, a parent is provided access by the educational agency or institution to the personally identifiable information held about their children by the party to the same extent and in the same manner as such access is provided in subsection (b)(1). (3) The disclosure of directory information, as so designated by the educational agency or institution under this paragraph, provided that the educational agency or institution which the student attends— (A) has implemented a directory information policy, which may include a directory information policy limiting the parties to or purposes for which directory information may be disclosed; (B) has given public notice, including an easy-to-understand notice to parents of students, of— (i) the categories of information which the agency or institution has designated as directory information with respect to students attending the institution or agency; and (ii) the right of a parent to opt out of allowing their child’s information to be disclosed as directory information; and (C) has allowed a reasonable period of time after such notice has been given under subparagraph (B), but not less than 15 school days, for a parent to inform the institution or agency that any or all of the information designated as directory information shall not be disclosed without the parent’s prior consent. (4) Officials of another educational agency or institution in which the student seeks or intends to enroll, upon condition that the student’s parents be notified of the transfer, receive a copy of the education record if desired, and have an opportunity for a hearing to challenge the content of the record. (5) (A) An official listed in subparagraph (B) or an authorized representative working for, or on behalf of, such official, subject to the limitations described in this paragraph and subsection (m)(1)(B), and only in connection with and to the extent necessary for— (i) the audit, evaluation, or enforcement of local, State, or Federal law; (ii) the audit or evaluation of locally supported, State-supported, or federally supported education programs pursuant to local, State, or Federal law; or (iii) the enforcement of the Federal or State legal requirements which relate to the programs described in clause (ii). (B) The following officials are covered by this paragraph: (i) The Comptroller of the United States. (ii) The Secretary. (iii) State or local educational authorities. (iv) The Attorney General. (C) Any data collected by an official listed in subparagraph (B) shall be protected in a manner that will not permit the personal identification of students and their parents by other than such official, and such education records and personally identifiable information in such records shall be destroyed when no longer needed for the audit, evaluation, and enforcement of legal requirements described in clause (i), (ii), or (iii) of subparagraph (A). (6) Organizations conducting a study for, or on behalf of, an educational agency or institution, provided that— (A) such study is conducted in such a manner as will not permit the personal identification of students and their parents by persons other than representatives of such organizations and such personally identifiable information will be destroyed when no longer needed for the purpose of the study; (B) the organization has agreed to and has appropriate security that meets the information security requirements of subparagraphs (A) and (C) of subsection (b)(6); and (C) the purpose of the study is limited to improving the academic outcomes of students attending that educational agency or institution. (7) Officials in connection with a student’s application for, or receipt of, financial aid. (8) State and local officials or authorities to whom personally identifiable information in education records is specifically allowed to be reported or disclosed pursuant to a State statute regarding the juvenile justice system. (9) The Secretary of Agriculture, or the designee of the Secretary from the Food and Nutrition Service acting on behalf of the Food and Nutrition Service, for the purposes of conducting program monitoring, evaluations, and performance measurements of State and local educational and other agencies and institutions receiving funding or providing benefits of 1 or more programs authorized under the Richard B. Russell National School Lunch Act ( 42 U.S.C. 1751 et seq. 42 U.S.C. 1771 et seq. (A) any data collected under this paragraph shall be protected in a manner that will not permit the personal identification of students and their parents by anyone other than the Secretary of Agriculture or the designee of such Secretary; (B) any personally identifiable information shall be destroyed when the information is no longer needed for program monitoring, evaluations, or performance measurements; and (C) the parents of the student have been notified that the student’s education records will be disclosed for the purposes described in this paragraph. (10) Accrediting organizations in order to carry out their accrediting functions. (11) Parents of a dependent student of such parents, as defined in section 152 (12) In connection with an emergency, appropriate persons if the knowledge of such information is necessary to protect the health or safety of the student or other persons. (13) Teachers and school officials who have legitimate educational interest in the behavior of the student, including teachers and school officials in another educational agency or institution who need to know information in the education record of a student to protect the safety of their students, if the information concerns disciplinary action taken against a student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the educational agency or institution community. (14) (A) An agency caseworker or other representative of a State or local child welfare agency, or tribal organization (as defined in section 4 of the Indian Self-Determination and Education Assistance Act ( 25 U.S.C. 450b (B) Nothing in this paragraph shall prevent a State from further limiting the number or type of State or local officials who will continue to have access under this paragraph. . (b) Transfer and redesignations (1) Subsection (b)(1) ( 20 U.S.C. 1232g(b)(1) (2) Subparagraph (J) of subsection (c) ( 20 U.S.C. 1232g(c) (A) by striking (J)(i) (15) (B) by striking (ii) (16) 6. Disclosure of records for college admissions, credit, and aid Subsection (d) ( 20 U.S.C. 1232g(d) (d) Disclosure of records for college admissions, credit, and aid (1) In general Records, files, documents, information, or other materials that are collected during or based on the administration of an examination that meets the requirements of paragraph (2) may be used or released by the developer of such examination, provided that— (A) such developer is not an educational agency or institution or State educational authority; and (B) such records, files, documents, information, or other materials are released by such developer solely for the purposes of college admissions, college placement, college academic credit, or college scholarships to any entity eligible to receive funds under title IV of the Higher Education Act of 1965 ( 20 U.S.C. 1070 et seq. (2) Examination An examination covered under paragraph (1) is an examination that— (A) may culminate in academic credit that is widely accepted by institutions of higher education; (B) is norm-referenced and used for college admissions or scholarship purposes; or (C) is administered by institutions of higher education for purposes of college placement. . 7. Rules of construction Subsection (e) ( 20 U.S.C. 1232g(e) (e) Rules of construction (1) Disciplinary proceedings (A) In general Nothing in this section shall be construed to prohibit an institution of higher education from disclosing— (i) to an alleged victim of any crime of violence (as that term is defined in section 26 of title 18, United States Code), or a nonforcible sex offense, the final results of any disciplinary proceeding conducted by such institution against the alleged perpetrator of such crime or offense with respect to such crime or offense; or (ii) the final results of any disciplinary proceeding conducted by such institution against a student who is an alleged perpetrator of any crime of violence (as that term is defined in section 16 of title 18, United States Code), or a nonforcible sex offense, if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution’s rules or policies with respect to such crime or offense. (B) Definition For the purpose of this paragraph, the final results of any disciplinary proceeding— (i) shall include only the name of the student, the violation committed, and any sanction imposed by the institution on that student; and (ii) may include the name of any other student, such as a victim or witness, only with the written consent of that other student. (2) Drug and alcohol disclosures (A) In general Nothing in this Act or the Higher Education Act of 1965 shall be construed to prohibit an institution of higher education from disclosing, to a parent or legal guardian of a student, information regarding any violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance, regardless of whether that information is contained in the student’s education records, if— (i) the student is under the age of 21; and (ii) the institution determines that the student has committed a disciplinary violation with respect to such use or possession. (B) State law regarding disclosure Nothing in this paragraph shall be construed to supersede any provision of State law that prohibits an institution of higher education from making the disclosure described in subparagraph (A). (3) Adam Walsh Child Protection and Safety Act of 2006 (A) In general Nothing in this Act shall be construed to prohibit an educational agency or institution from disclosing information provided to the agency or institution under the Adam Walsh Child Protection and Safety Act of 2006 ( 42 U.S.C. 16901 et seq. (B) Notification The Secretary shall take appropriate steps to notify educational agencies and institutions that disclosure of information described in subparagraph (A) is permitted. . 8. Other disclosures Such section ( 20 U.S.C. 1232g (1) by striking subsection (f); and (2) by redesignating subsection (j) as subsection (f). 9. Marketing and advertising ban Subsection (g) ( 20 U.S.C. 1232g(g) (g) Marketing and advertising ban (1) General prohibition No person with access to an education record or a student’s personally identifiable information contained in the education record shall market or otherwise advertise directly to students with the use of the information gained through access to such record or information. (2) Prohibitions relating to education service providers Subject to paragraph (3), an educational agency or institution or State educational authority shall not contract or enter into an agreement with an education service provider that has a policy or practice of using, releasing, or otherwise providing access to personally identifiable information in the education record of a student— (A) to advertise or market a product or service; or (B) for the development of commercial products or services. (3) Exceptions The prohibitions described in paragraph (2) shall not apply with respect to— (A) official school pictures, class rings, yearbooks, or other traditional school-sanctioned commemorative products, events, or activities; (B) personally identifiable information which may be used by an education service provider to develop, diagnose, or deliver services to improve a student’s academic outcomes or to assist an educational agency or institution to develop, diagnose, or deliver services to improve a student’s academic outcomes; (C) an educational agency or institution or State educational authority sharing information on educational opportunities offered by such agency, institution, or authority; or (D) in a case in which the parent of a student at an educational agency or institution has provided written consent for an educational service provider described in paragraph (2) to carry out the activities described in such paragraph with the personally identifiable information contained in such student’s education record. . 10. General rules on disclosure or release of information Subsection (h) ( 20 U.S.C. 1232g(h) (h) General rules on disclosure or release of information (1) In general A disclosure or release of education records or personally identifiable information in such records under this section shall be limited to records or information determined by the appropriate educational agency or institution or State educational authority to be necessary to meet the specific conditions of the permitted disclosures listed under subsection (c). (2) State or local laws A State or local law may further restrict the permitted disclosures or release of information under subsection (c) or provide additional rights to parents with respect to the disclosure of education records (or the personally identifiable information contained therein). . 11. Enforcement Subsection (i) ( 20 U.S.C. 1232g(i) (i) Enforcement (1) In general The Secretary shall take appropriate actions to enforce this section and to address violations of this section, in accordance with this Act, except that action to terminate assistance may be taken only if the Secretary finds there has been a failure to comply with this section, and the Secretary has determined that compliance cannot be secured by voluntary means. (2) Fines (A) Educational agencies and institutions The Secretary may impose, on an educational agency or institution, or State educational authority, for failure to voluntarily comply with this section or for a substantial violation of this section (which may include a single violation), a fine equal to a minimum of $100 and a maximum of $1,500,000, depending on the severity of the violation, except in no case may such a fine exceed 10 percent of the annual budget of such agency or institution, or authority. (B) Other parties With respect to a release of an education record or personally identifiable information contained therein, which was made by a party that is not subject to a fine under subparagraph (A), and which violates this section because the release was made without the parental consent required under this section, or in violation of a written agreement entered into under this section or another provision of this section, the Secretary shall— (i) refer such violation, and the supporting material for such violation, to the Commissioner of the Federal Trade Commission or the Attorney General for action; and (ii) require the educational agency or institution, or local educational agency or State educational authority involved to prohibit access to such personally identifiable information by such party (or individuals who worked for or with such party at the time of such violation) for a period of not less than 5, and not more than 12 years, as determined by the Secretary. (3) Distribution of certain monetary penalties collected Any monetary penalty or settlement collected under this subsection with respect to an offense punishable under this section shall be transferred to the Secretary to be used for the purposes of providing technical assistance on privacy and security and enforcing the provisions of this section. . 12. Compliance office Such section ( 20 U.S.C. 1232g (j) Compliance office (1) In general The Secretary shall establish or designate an office within the Department for the purpose of investigating, processing, reviewing, and adjudicating violations of this section and investigating, processing, reviewing, and adjudicating complaints which may be filed concerning alleged violations of this section. This office shall be the official office within the Department to address privacy concerns in student education records. (2) Regional offices Except for the conduct of hearings, none of the functions of the Secretary under this section shall be carried out in any of the regional offices of such Department. . 13. Prohibition on data gathering Such section ( 20 U.S.C. 1232g (k) Prohibition on data gathering No survey or data-gathering activities shall be conducted by the Secretary, or an administrative head of an education agency under an applicable program, unless such activities are authorized by Federal law. . 14. Regulations Such section ( 20 U.S.C. 1232g (l) Regulations (1) In general The Secretary, in accordance with this section and section 446, shall adopt appropriate regulations or procedures or identify existing regulations or procedures, which protect the rights of privacy of students and their families in connection with any surveys or data-gathering activities conducted, assisted, or authorized by the Secretary or an administrative head of an education agency and ensure that parents are aware of their rights under those sections. (2) Contents Regulations established under this subsection shall include provisions controlling the use, dissemination, and protection of such data. . 15. Definitions Such section ( 20 U.S.C. 1232g (m) Definitions For purposes of this section: (1) Authorized representative (A) In general The term authorized representative (i) who is an employee or contractor designated by an official listed in subsection (c)(5)(B) to conduct an activity described in clause (i), (ii), or (iii) of subsection (c)(5)(A); and (ii) who is under the direct control of an official listed in subsection (c)(5)(B) with respect to the use and maintenance of education records. (B) Limitation on release of information An authorized representative shall not release to any individual, agency, or organization, any education records or personally identifiable information of a student collected while serving as an authorized representative, except that an authorized representative may release such records or such information in a case in which the authorized representative is in compliance with information security requirements of subparagraphs (A) and (C) of subsection (b)(6), and such representative— (i) has written consent from the student's parents specifying the education records to be released; (ii) releases such records or information to the official under whom the authorized representative is an employee or contractor; or (iii) releases such records or information— (I) in compliance with the publically available, written agreement specifying the terms of such release and permitting such release without the written consent of the student’s parents; and (II) under the approval of the official under whom such representative is working as an employee or contractor. (2) Directory information The term directory information (3) Educational agency or institution The term educational agency or institution (A) principally engaged in the provision of education, including early childhood education, to students; and (B) the recipient of funds under an applicable program. (4) Education records (A) In general Except as provided in subparagraph (B), the term education records (i) maintained, electronically, digitally, or physically, by an educational agency or institution, or by a person acting for such agency or institution; (ii) accessible, collected, used, or maintained by a party described in subsection (c)(2) in the course of providing services to a school official; or (iii) created by or for a State educational authority, without regard to whether the student who attends a school subject to this section attends a school under the jurisdiction of such State educational authority. (B) Limitations The term education records (i) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are not created in conjunction with the student and are in the sole possession of the maker thereof and which are not accessible or revealed to any other person; (ii) records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement; (iii) in the case of persons who are employed by an educational agency or institution but who are not in attendance at such agency or institution, records made and maintained in the normal course of business which relate exclusively to such person in that person’s capacity as an employee and are not available for use for any other purpose; or (iv) records on a student who is 18 years of age or older, or is attending an institution of higher education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than the student (if showing the student the records would not be detrimental to the student or others) or persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. (C) Maintain The term maintain (5) Education service provider The term education service provider (6) ESEA terms The terms elementary school secondary school local educational agency 20 U.S.C. 7801 (7) Institution of higher education The term institution of higher education 20 U.S.C. 1002 (8) Personally identifiable information The term personally identifiable information (A) any information (such as a student’s name, Social Security number, email address, or parent’s name), or compilation of information, in electronic, digital, or paper form that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; (B) biometric information, including any record of one or more measurable biological or behavioral characteristics that may be used for automated recognition of a student, such as fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting; or (C) information in an education record requested by a person who an educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. (9) State educational authority The term State educational authority (10) Student The term student . 16. Conforming amendment Section 446(a) of the General Education Provisions Act ( 20 U.S.C. 1232i(a) 444(b)(1)(D) 444(c)(7) 17. FERPA regulations The definition of the terms early childhood education program education program

Summary: Student Privacy Protection Act Amends the Family Educational Rights and Privacy Act of 1974 (FERPA) to require educational agencies or institutions and state educational authorities to establish: (1) information security practices to protect students' education records and personally identifiable information, and (2) breach notification policies to notify parents of breaches or security violations. Expands the definition of "education records" to include student records that are: (1) maintained electronically or digitally; (2) accessible or collected by service providers, contractors, or other parties; or (3) created by or for a state educational authority, without regard to whether the student attends a school under the jurisdiction of such state educational authority. Allows educational agencies or institutions to disclose education records without parental consent to education service providers, contractors, or other parties to whom institutional services have been outsourced, provided that the party agrees to secure information from unauthorized access and be subject to penalties for violations. Permits disclosure of education records without parental consent to authorized representatives of the Government Accountability Office, the Department of Education (ED), state or local educational authorities, or the Department of Justice (DOJ) for: (1) audits, evaluations, or enforcement of local, state, or federal laws; (2) audits or evaluations of locally supported, state supported, or federally supported education programs pursuant to local, state, or federal laws; or (3) enforcement of federal or state legal requirements related to such programs. Removes restrictions on disclosures to state and local authorities to whom information is specifically allowed to be reported or disclosed pursuant to a state statute regarding the juvenile justice system. Limits the types of studies that organizations may conduct with student records disclosed without parental consent to studies used to improve academic outcomes of students attending the educational agency or institution. Establishes conditions under which college exam developers may release information collected during or based on the administration of an exam for college admissions, placements, credits, or scholarships. Updates existing provisions concerning disclosures of: (1) disciplinary proceedings regarding crimes of violence or nonforcible sex offenses to specify that the provisions apply to institutions of higher education, and (2) registered sex offender information to make the provisions apply to educational agencies or institutions provided information under the Adam Walsh Child Protection and Safety Act of 2006. Prohibits information gained through access to student education records from being used to market or advertise directly to students, but allows educational agencies or institutions or state educational authorities to contract with education service providers to use student information to market, advertise, or develop services for: (1) traditional school-sanctioned commemorative activities, such as official school pictures or class rings; (2) services to improve student academic outcomes; (3) sharing educational opportunities offered by the educational agency or institution or state educational authority; or (4) activities with parental consent. Establishes fines that ED may impose on educational agencies or institutions or state educational authorities that fail to voluntarily comply with, or that substantially violate, education record requirements under FERPA. Requires ED, for violations by other parties, to: (1) refer the matter to the Federal Trade Commission or DOJ, and (2) prohibit such information from being accessed by those parties for a period of at least 5 but not more than 12 years. Prohibits ED or education agencies from conducting surveys or data-gathering activities unless authorized by federal law.