(a)(l) An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student.

(2) The officers, employees, and agents of a party that receives information under paragraph (a)(l) of this section may use the information, but only for the purposes for which the disclosure was made.

(b) Paragraph (a) of this section does not prevent an educational agency or institution from disclosing personally identifiable information with the understanding that the party receiving the information may make further disclosures of the information on behalf of the educational agency or institution if:

(1) The disclosures meet the requirements of § 99.31; and

(2) The educational agency or institution has complied with the requirements of § 99.32(b).

(c) Paragraph (a) of this section does not apply to disclosures made to parents of dependent students under § 99.31(a)(8), to disclosures made pursuant to court orders, lawfully issued subpoenas, or litigation under § 99.31(a) (9), to disclosures of directory information under § 99.31(a)(11), to disclosures made to a parent or student under § 99.31(a)(12), to disclosures made in connection with a disciplinary proceeding under § 99.31(a)(14), or to disclosures made to parents under § 99.31(a) (15).

(d) Except for disclosures under § 99.31(a)(9), (11) and (12), an educational agency or institution shall inform a party to whom disclosure is made of the requirements of this section.

(e) If this Office determines that a third party improperly rediscloses personally identifiable information from education records in violation of § 99.33(a) of this section, the educational agency or institution may not allow that third party access to personally identifiable information from education records for at least five years.

(Authority: 20 U.S.C.1232g(b)(4)(B))