OAR 581-021-0350: Limitations on the Redisclosure of Information

(1) An educational agency or institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student. The officers, employees, and agents of a party that receives information under this section may use the information, but only for the purposes for which the disclosure was made. (2) Section (1) of this rule does not prevent an educational agency or institution from disclosing personally identifiable information with the understanding that the party receiving the information may make further disclosures of the information on behalf of the educational agency or institution if: (a) The disclosures meets the requirements of OAR 581-021-0340; and (b) The educational agency or institution has complied with the requirements in OAR 581-021-0400(2). (3) Section (1) of this rule does not apply to the following: (a) Disclosures to parents of a dependent student under OAR 581-021-0340(7) or to an eligible student; (b) Disclosures pursuant to court orders, lawfully issued subpoenas, or legal action under OAR 581-021-0340(8) or (9); (c) Disclosures of directory information under OAR 581-021-0340(11). (4) When applicable, an educational agency or institution shall inform a party to whom disclosure is made of the requirements of this rule. (5) If the Family Policy Compliance Office determines that a third party improperly rediscloses personally identifiable information from education records in violation of paragraph 1, the educational agency or institution may not allow that third party access to personally identifiable information from education records for at least five years.