§24–703.2.

    (a)    (1)    In this section the following words have the meanings indicated.

        (2)    “Aggregated data” means de–identified data that is summarized by type of program of study or educational institution.

        (3)    “Student information” means:

            (i)    Student Social Security number;

            (ii)    Program of study;

            (iii)    Enrollment; and

            (iv)    Name of educational institution.

        (4)    “Tax information” means income tax records, wage information, and other data stored by the Comptroller.

    (b)    (1)    The Center and the Comptroller jointly shall develop a protocol for research purposes for the:

            (i)    Center to send student information to the Comptroller;

            (ii)    Comptroller to match student information to tax information; and

            (iii)    Comptroller to produce aggregated data from the matched information on the average amount of wage or salary earnings from self–employment or other sources of income for individuals within each educational institution or program of study.

        (2)    The Comptroller may not produce any aggregated data that may be identifiable based on the size or uniqueness of the population under consideration.

    (c)    The Center and the Comptroller jointly shall develop data handling and security standards for the Comptroller to utilize for the protocol, including:

        (1)    Data retention and disposition policies;

        (2)    Authorized access and authentication for authorized access policies;

        (3)    Privacy compliance standards; and

        (4)    Breach notification and procedures.

    (d)    The Comptroller shall comply with any data privacy and security standards in accordance with the federal Family Educational Rights and Privacy Act and other relevant privacy laws and policies.