(a) Any student data submitted to and maintained by a statewide longitudinal student data system shall only be disclosed by an educational agency in accordance with the provisions of this section. An educational agency shall provide annual written notice to each student’s parent or legal guardian that student data may be disclosed in accordance with this section. Such notice shall be signed by the student’s parent or legal guardian and maintained on file with the district.

(b) Student data may be disclosed at any time to:

(1) The authorized personnel of an educational agency who require such disclosures to perform their assigned duties;

(2) the authorized personnel of the state board of regents who require such disclosures to perform their assigned duties; and

(3) the student and the parent or legal guardian of the student, provided the student data pertains solely to such student.

(c) Student data may be disclosed to the authorized personnel of any state agency not specified in subsection (b), or to a service provider of a state agency, educational agency or school who is engaged to perform a function of instruction, assessment or longitudinal reporting, provided there is a data-sharing agreement between the educational agency and such other state agency or service provider that provides the following:

(1) The purpose, scope and duration of the data-sharing agreement;

(2) that the recipient of the student data use such information solely for the purposes specified in the agreement;

(3) that the recipient shall comply with data access, use and security restrictions that are specifically described in the agreement; and

(4) that the student data shall be destroyed when no longer necessary for the purposes of the data-sharing agreement or upon expiration of the data-sharing agreement, whichever occurs first. Except that a service provider engaged to perform a function of instruction may retain student transcripts as required by applicable laws and rules and regulations. Destruction shall comply with the NISTSP800-88 standards of data destruction.

(d) (1) Except as otherwise provided in paragraph (2), student data may be disclosed to any governmental entity not specified in subsection (b) or (c), or to any public or private audit and evaluation or research organization, provided that only aggregate data is disclosed to such governmental entity or audit and evaluation or research organization.

(2) Personally identifiable student data may be disclosed if the student, if an adult, or the parent or legal guardian of the student, if a minor, consents to such disclosure in writing.

(e) Notwithstanding the provisions of subsections (b), (c) and (d), an educational agency may disclose:

(1) Directory information of a student when such agency deems such disclosure necessary and the disclosure of which has been consented to in writing by such student’s parent or legal guardian;

(2) directory information to an enhancement vendor that provides photography services, class ring services, yearbook publishing services, memorabilia services or other substantially similar services;

(3) any information required to be disclosed pursuant to Kan. Stat. Ann. §§ 65-101, 65-118 and 65-202, and amendments thereto, provided such information is disclosed in accordance with any provisions of such statutes regarding the confidentiality and disclosure of such information;

(4) any student data in order to comply with any lawful subpoena or court order directing such disclosure; and

(5) student data to a public or private postsecondary educational institution which is required by such postsecondary educational institution for the purposes of application or admission of a student to such postsecondary educational institution, provided that such disclosure is consented to in writing by such student.