(a) As used in this section, the following terms shall have the meanings respectively ascribed to them unless the context requires otherwise:

(1) “Board” means the state board of regents, the state board of education, the board of trustees of any public community college, the board of regents of any municipal university, the governing board of any technical college and the board of education of any school district.

(2) “Student” means a person who has attained 18 years of age, or is attending an institution of postsecondary education.

(3) “Pupil” means a person who has not attained 18 years of age and is attending an educational institution below the postsecondary level.

(b) Every board shall adopt a policy in accordance with the student data privacy act and applicable federal laws and regulations to protect the right of privacy of any student, or pupil and such pupil’s family regarding personally identifiable records, files and data directly related to such student or pupil. The board shall adopt and implement procedures to effectuate such policy by January 1, 1977. Such procedures shall provide for: (1) Means by which any student or parent of a pupil, as the case may be, may inspect and review any records or files directly related to the student or pupil; and (2) restricting the accessibility and availability of any personally identifiable records or files of any student or pupil and preventing disclosure thereof unless made upon written consent of such student or parent of such pupil, as the case may be.