ALLOWED DISCLOSURE OF COVERED INFORMATION.

(a) An operator may use or disclose covered information under the following circumstances:

(1) to further a school purpose of the website, online service, online application, or mobile application and the recipient of the covered information disclosed under this subsection does not further disclose the information unless the disclosure is to allow or improve operability and functionality of the operator's website, online service, online application, or mobile application;

(2) to ensure legal and regulatory compliance;

(3) to protect against liability;

(4) to respond to or participate in the judicial process;

(5) to protect:

(A) the safety or integrity of users of the website, online service, online application, or mobile application; or

(B) the security of the website, online service, online application, or mobile application;

(6) for a school, education, or employment purpose requested by the student or the student's parent and the information is not used or disclosed for any other purpose;

(7) to use the covered information for:

(A) a legitimate research purpose; or

(B) a school purpose or postsecondary educational purpose; or

(8) for a request by the agency or the school district for a school purpose.

(b) A national assessment provider or a provider of a college and career counseling service may, in response to a request of a student, and on receiving the express affirmative consent of the student or the student's parent given in response to clear and conspicuous notice, use or disclose covered information solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.

(c) An operator may disclose covered information if a provision of federal or state law requires the operator to disclose the information. The operator must comply with the requirements of federal and state law to protect the information being disclosed.

(d) An operator may disclose covered information to a third party if the operator has contracted with the third party to provide a service for a school purpose for or on behalf of the operator. The contract must prohibit the third party from using any covered information for any purpose other than providing the contracted service. The operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure of covered information.

(e) Nothing in this subchapter prohibits the operator's use of covered information for maintaining, developing, supporting, improving, or diagnosing the operator's website, online service, online application, or mobile application.