Institutions of higher education, including their agents, employees, student groups, alumni organizations, or any affiliates may not provide to a business organization or financial institution for purposes of marketing credit cards the following information about students pursuing an undergraduate education: (i) name, (ii) address, (iii) telephone number, (iv) social security number, (v) e-mail address, or (vi) other personally identifying information. This requirement is waived if the student pursuing an undergraduate education is 21 years of age or older.