34 CFR 99.31(a)(3) audit + evaluation + 99.35 authorised representatives; 99.31(a)(6) studies for or on behalf of the institution. AUDIT + EVALUATION (99.31(a)(3) + 99.35): authorised representatives of the Secretary of Education + State + local educational authorities + Attorney General + Comptroller General of the United States may receive PII without consent for audit + evaluation of federal- or state-supported education programs + or for enforcement of federal or state legal requirements relating to such programs. The 2011 final rule clarified WHO qualifies as an authorised representative + required: (a) a written agreement with the authorised representative; (b) the authorised representative is under the direct control of the educational authority; (c) the authorised representative uses PII only for the audit/evaluation purpose; (d) appropriate safeguards in place; (e) destruction of PII when no longer needed. STUDIES EXCEPTION (99.31(a)(6)): institutions may disclose PII without consent to organizations conducting studies for or on behalf of the institution to develop + validate + administer predictive tests + administer student aid + improve instruction. REQUIREMENTS: (i) written agreement requiring use of PII only for the study + restricting redisclosure + requiring destruction when no longer needed; (ii) study purpose specific + clearly stated; (iii) safeguards in place to protect PII. The 2011 amendments + the SPPO/PTAC Best Practices Guidance detail the agreement + safeguard requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.