SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Student Financial Aid Data Privacy 
Protection Act''.

SEC. 2. NATIONAL STUDENT LOAN DATA SYSTEM.

    Section 485B of the Higher Education Act of 1965 (20 U.S.C. 1092b) 
is amended--
            (1) by redesignating subsections (d) through (g) as 
        subsections (e) through (h), respectively;
            (2) by inserting after subsection (c) the following:
    ``(d) Principles for Administering the Data System.--In managing 
the National Student Loan Data System, the Secretary shall take actions 
necessary to maintain confidence in the data system, including, at a 
minimum--
            ``(1) ensuring that the primary purpose of access to the 
        data system by guaranty agencies, eligible lenders, and 
        eligible institutions of higher education is for legitimate 
        program operations, such as the need to verify the eligibility 
        of a student, potential student, or parent for loans under part 
        B, D, or E;
            ``(2) prohibiting nongovernmental researchers and policy 
        analysts from accessing personally identifiable information;
            ``(3) creating a disclosure form for students and potential 
        students that is distributed when such students complete the 
        common financial reporting form under section 483, and as a 
        part of the exit counseling process under section 485(b), 
        that--
                    ``(A) informs the students that any title IV grant 
                or loan the students receive will be included in the 
                National Student Loan Data System, and instructs the 
                students on how to access that information;
                    ``(B) describes the categories of individuals or 
                entities that may access the data relating to such 
                grant or loan through the data system, and for what 
                purposes access is allowed;
                    ``(C) defines and explains the categories of 
                information included in the data system;
                    ``(D) provides a summary of the provisions of the 
                Federal Educational Rights and Privacy Act of 1974 and 
                other applicable Federal privacy statutes, and a 
                statement of the students' rights and responsibilities 
                with respect to such statutes;
                    ``(E) explains the measures taken by the Department 
                to safeguard the students' data; and
                    ``(F) includes other information as determined 
                appropriate by the Secretary;
            ``(4) requiring guaranty agencies, eligible lenders, and 
        eligible institutions of higher education that enter into an 
        agreement with a potential student, student, or parent of such 
        student regarding a loan under part B, D, or E, to inform the 
        student or parent that such loan shall be--
                    ``(A) submitted to the data system; and
                    ``(B) accessible to guaranty agencies, eligible 
                lenders, and eligible institutions of higher education 
                determined by the Secretary to be authorized users of 
                the data system;
            ``(5) regularly reviewing the data system to--
                    ``(A) delete inactive users from the data system;
                    ``(B) ensure that the data in the data system are 
                not being used for marketing purposes; and
                    ``(C) monitor the use of the data system by 
                guaranty agencies and eligible lenders to determine 
                whether an agency or lender is accessing the records of 
                students in which the agency or lender has no existing 
                financial interest; and
            ``(6) developing standardized protocols for limiting access 
        to the data system that include--
                    ``(A) collecting data on the usage of the data 
                system to monitor whether access has been or is being 
                used contrary to the purposes of the data system;
                    ``(B) defining the steps necessary for determining 
                whether, and how, to deny or restrict access to the 
                data system; and
                    ``(C) determining the steps necessary to reopen 
                access to the data system following a denial or 
                restriction of access.''; and
            (3) by striking subsection (e) (as redesignated by 
        paragraph (1)) and inserting the following:
    ``(e) Reports to Congress.--
            ``(1) Annual report.--Not later than September 30 of each 
        fiscal year, the Secretary shall prepare and submit to the 
        appropriate committees of Congress a report describing--
                    ``(A) the results obtained by the establishment and 
                operation of the National Student Loan Data System 
                authorized by this section;
                    ``(B) the effectiveness of existing privacy 
                safeguards in protecting student and parent information 
                in the data system;
                    ``(C) the success of any new authorization 
                protocols in more effectively preventing abuse of the 
                data system;
                    ``(D) the ability of the Secretary to monitor how 
                the system is being used, relative to the intended 
                purposes of the data system; and
                    ``(E) any protocols developed under subsection 
                (d)(6) during the preceding fiscal year.
            ``(2) Study.--
                    ``(A) In general.--The Secretary shall conduct a 
                study regarding--
                            ``(i) available mechanisms for providing 
                        students and parents with the ability to opt in 
                        or opt out of allowing eligible lenders to 
                        access their records in the National Student 
                        Loan Data System; and
                            ``(ii) appropriate protocols for limiting 
                        access to the data system, based on the risk 
                        assessment required under subchapter III of 
                        chapter 35 of title 44, United States Code.
                    ``(B) Submission of study.--Not later than 3 years 
                after the date of enactment of the Student Financial 
                Aid Data Privacy Protection Act, the Secretary shall 
                prepare and submit a report on the findings of the 
                study to the appropriate committees of Congress.''.
Output: Student Financial Aid Data Privacy Protection Act - Amends the Higher Education Act of 1965 to direct the Secretary of Education to take actions necessary to maintain confidence in the National Student Loan Data System, at a minimum: (1) ensuring that guaranty agencies, lenders, and schools primarily access it for legitimate program operations; (2) prohibiting nongovernmental researchers or policy analysts from accessing personally identifiable information; (3) creating a disclosure form for actual and potential students describing the contents of, and access to, the system; (4) requiring guaranty agencies, lenders, and schools to inform borrowers of Federal Family Education Loans, Direct Loans, and Perkins Loans that such a loan will be submitted to the system and accessible to such entities; (5) regularly review the system to delete inactive users, monitor use, and ensure that data is not used for marketing purposes; and (6) developing standardized protocols for limiting access.

Requires the Secretary to study and report to Congress on: (1) mechanisms giving borrowers the option of restricting lender access to their system records; and (2) appropriate risk-based protocols for limiting access.