34 CFR 99.32 record of disclosures + 99.33 limitations on redisclosure. RECORDKEEPING (99.32): for each request for access to + each disclosure of PII (with EXCEPTIONS for: disclosures to + access by the student; school officials under 99.31(a)(1); disclosures with consent; disclosures of directory information; disclosures to a party seeking access pursuant to a judicial order or subpoena issued at a request of the institution), the institution must record: (a) the parties who have requested or received PII + the legitimate interest; (b) the date; (c) for disclosures to (a)(11) directory information, (a)(13) sex offense final results, (a)(15) parents of dependent students, the record must include the names of state + local officials who received the information. The record must be maintained as long as the underlying education record + made available for inspection by the parent + eligible student + the SPPO. REDISCLOSURE LIMITATIONS (99.33): the recipient of PII without consent may NOT redisclose the information without prior consent UNLESS the redisclosure is for one of the §99.31 exceptions + the original institution records the redisclosure. The 2008 + 2011 amendments tightened redisclosure rules + the recordkeeping requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.