As prescribed in 3424.704, insert the following clause in solicitations and contracts:

Protection of Student Privacy in Compliance With FERPA (OCT 2023)

(a) Pursuant to the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, and its implementing regulations, 34 CFR part 99, the Department designates the Contractor to serve as an authorized representative of the Secretary of Education, solely for the purpose of carrying out an audit or evaluation of federally supported education programs, the enforcement or compliance with Federal legal requirements that relate to federally supported education programs, or conducting a study for or on behalf of the Department, to develop, validate, or administer predictive tests, administer student aid programs, or improve instruction, as specified in the statement of work, the schedule, and other similar documents to the contract.

(b) The Contractor shall collect or receive access to the following personally identifiable information from student education records that is protected by FERPA: [specify the PII from student education records to be collected or accessed by the Contractor, as identified by the requiring activity] (collectively, the PII).

(c) The Contractor shall only use the PII to meet the purpose set forth in paragraph (a) of this clause and for the activity, scope, and duration specified in the statement of work, the schedule, and other similar documents to the contract. Prior to collecting or receiving access to the PII, the Contractor shall establish policies and procedures, consistent with FERPA and other Federal confidentiality and privacy provisions, to protect the PII from further disclosure (except back to the Department) and unauthorized use, including limiting use of the PII to only authorized representatives with legitimate interests in the purpose set forth in paragraph (a) of this clause.

(d) To the extent required to ensure the Contractor's compliance with the provisions of FERPA and other Federal provisions, the Contractor shall afford the Department and its authorized agents access to all of the facilities, installations, technical capabilities, operations, documentation, records, databases, policies, procedures, and systems of the Contractor and any subcontractor.

(e) The Contractor shall limit access to the PII to the Contractor's personnel who require the PII to satisfy the Contractor's obligations under the contract.

(f) If the Contractor collects or receives access to the PII to conduct a study for, or on behalf of, an educational agency or institution, then the Contractor shall conduct such study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the Contractor, or subcontractors, with legitimate interests in the study.

(g) Once the purpose for which the PII was collected or accessed is fully satisfied, the Contractor shall notify the Department immediately and seek the Department's instruction and authorization regarding destruction of the PII in accordance with law.

(h) If the Contractor subcontracts any of the contract work requiring collection or access to the PII, then the Contractor shall include this clause (including this paragraph (h)) in any such subcontract and, further, the Contractor shall ensure that subcontractors at any tier comply with all terms, conditions, and obligations imposed on the Contractor herein and under FERPA.

(i) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

(End of clause)