(a) A private college or university that discloses personally identifiable information in student data or records according to the terms of a written agreement with a State agency, local school administrative unit, community college, constituent institution of The University of North Carolina, or the North Carolina Independent Colleges and Universities, Inc., in compliance with the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, shall not be liable for a breach of confidentiality, disclosure, use, retention, or destruction of the student data or records if the breach, disclosure, use, retention, or destruction results from actions or omissions of either (i) the North Carolina Independent Colleges and Universities, Inc., the State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina to which the data was provided or (ii) persons provided access to the data or records by those entities.

(b) The North Carolina Independent Colleges and Universities, Inc., shall not be liable for a breach of confidentiality, disclosure, use, retention, or destruction of student data or records transferred on behalf of a private college or university to a State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina if the breach, disclosure, use, retention, or destruction results from actions or omissions of either (i) the State agency, local school administrative unit, community college, or constituent institution of The University of North Carolina to which the data was provided or (ii) persons provided access to the data or records by those entities. (2012-133, s. 3; 2016-94, s. 11.5.)