An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student, except that:
To a parent of a student at an institution of postsecondary education regarding the student's violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance.
An educational agency or institution must inform a party to whom disclosure is made of the requirements of redisclosure of information, except when the disclosure is pursuant to WHEN CONSENT IS NOT REQUIRED TO DISCLOSE INFORMATION.
The officers, employees, and agents of a party that receives education records from an educational agency or institution must use the information only for the purposes for which the disclosure was made, except that:
If the Family Policy Compliance Office (FPCO) determines that a third party improperly rediscloses personally identifiable information from education records, the educational agency or institution may not allow that third party access to personally identifiable information from education records for at least five years.