((a)) ** Development of System** The Secretary shall consult with a representative group of guaranty agencies, eligible lenders, and eligible institutions to develop a mutually agreeable proposal for the establishment of a National Student Loan Data System containing information regarding loans made, insured, or guaranteed under part B and loans made under parts D and E, and for allowing the electronic exchange of data between program participants and the system. In establishing such data system, the Secretary shall place a priority on providing for the monitoring of enrollment, student status, information about current loan holders and servicers, and internship and residency information. Such data system shall also permit borrowers to use the system to identify the current loan holders and servicers of such borrower’s loan not later than one year after . The information in the data system shall include (but is not limited to)—

((1)) the amount and type of each such loan made;

((2)) the names and social security numbers of the borrowers;

((3)) the guaranty agency responsible for the guarantee of the loan;

((4)) the institution of higher education or organization responsible for loans made under parts D and E;

((5)) the exact amount of loans partially or totally canceled or in deferment for service under the Peace Corps Act ( et seq.), for service under the Domestic Volunteer Service Act of 1973 [ et seq.], and for comparable full-time service as a volunteer for a tax-exempt organization of demonstrated effectiveness;

((6)) the eligible institution in which the student was enrolled or accepted for enrollment at the time the loan was made, and any additional institutions attended by the borrower;

((7)) the total amount of loans made to any borrower and the remaining balance of the loans;

((8)) the lender, holder, and servicer of such loans;

((9)) information concerning the date of any default on the loan and the collection of the loan, including any information concerning the repayment status of any defaulted loan on which the Secretary has made a payment pursuant to or the guaranty agency has made a payment to the previous holder of the loan;

((10)) information regarding any deferments or forbearance granted on such loans; and

((11)) the date of cancellation of the note upon completion of repayment by the borrower of the loan or payment by the Secretary pursuant to .

((b)) ** Additional information** For the purposes of research and policy analysis, the proposal shall also contain provisions for obtaining additional data concerning the characteristics of borrowers and the extent of student loan indebtedness on a statistically valid sample of borrowers under part B. Such data shall include—

((1)) information concerning the income level of the borrower and his family and the extent of the borrower’s need for student financial assistance, including loans;

((2)) information concerning the type of institution attended by the borrower and the year of the program of education for which the loan was obtained;

((3)) information concerning other student financial assistance received by the borrower; and

((4)) information concerning Federal costs associated with the student loan program under part B, including the costs of interest subsidies, special allowance payments, and other subsidies.

((c)) ** Verification** The Secretary may require lenders, guaranty agencies, or institutions of higher education to verify information or obtain eligibility or other information through the National Student Loan Data System prior to making, guaranteeing, or certifying a loan made under part B, D, or E.

((d)) ** Principles for administering the data system** In managing the National Student Loan Data System, the Secretary shall take actions necessary to maintain confidence in the data system, including, at a minimum—

((1)) ensuring that the primary purpose of access to the data system by guaranty agencies, eligible lenders, and eligible institutions of higher education is for legitimate program operations, such as the need to verify the eligibility of a student, potential student, or parent for loans under part B, D, or E;

((2)) prohibiting nongovernmental researchers and policy analysts from accessing personally identifiable information;

((3)) creating a disclosure form for students and potential students that is distributed when such students complete the common financial reporting form under , and as a part of the exit counseling process under , that—

((A)) informs the students that any subchapter IV grant or loan the students receive will be included in the National Student Loan Data System, and instructs the students on how to access that information;

((B)) describes the categories of individuals or entities that may access the data relating to such grant or loan through the data system, and for what purposes access is allowed;

((C)) defines and explains the categories of information included in the data system;

((D)) provides a summary of the provisions of (commonly known as the “Family Educational Rights and Privacy Act of 1974”) and other applicable Federal privacy statutes, and a statement of the students’ rights and responsibilities with respect to such statutes;

((E)) explains the measures taken by the Department to safeguard the students’ data; and

((F)) includes other information as determined appropriate by the Secretary;

((4)) requiring guaranty agencies, eligible lenders, and eligible institutions of higher education that enter into an agreement with a potential student, student, or parent of such student regarding a loan under part B, D, or E, to inform the student or parent that such loan shall be—

((A)) submitted to the data system; and

((B)) accessible to guaranty agencies, eligible lenders, and eligible institutions of higher education determined by the Secretary to be authorized users of the data system;

((5)) regularly reviewing the data system to—

((A)) delete inactive users from the data system;

((B)) ensure that the data in the data system are not being used for marketing purposes; and

((C)) monitor the use of the data system by guaranty agencies and eligible lenders to determine whether an agency or lender is accessing the records of students in which the agency or lender has no existing financial interest;

((6)) developing standardized protocols for limiting access to the data system that include—

((A)) collecting data on the usage of the data system to monitor whether access has been or is being used contrary to the purposes of the data system;

((B)) defining the steps necessary for determining whether, and how, to deny or restrict access to the data system; and

((C)) determining the steps necessary to reopen access to the data system following a denial or restriction of access; and

((7)) preventing access to the data system and any other system used to administer a program under this subchapter by any person or entity for the purpose of assisting a student in managing loan repayment or applying for any repayment plan, consolidation loan, or other benefit authorized by this subchapter, unless such access meets the requirements described in subsection (e).

((e)) ** Requirements for third-party data system access**

((1)) ** In general** As provided in paragraph (7) of subsection (d), an authorized person or entity described in paragraph (2) may access the data system and any other system used to administer a program under this subchapter if that access—

((A)) is in compliance with terms of service, information security standards, and a code of conduct which shall be established by the Secretary and published in the Federal Register;

((B)) is obtained using an access device (as defined in ) issued by the Secretary to the authorized person or entity; and

((C)) is obtained without using any access device (as defined in ) issued by the Secretary to a student, borrower, or parent.

((2)) ** Authorized person or entity** An authorized person or entity described in this paragraph means—

((A)) a guaranty agency, eligible lender, or eligible institution, or a third-party organization acting on behalf of a guaranty agency, eligible lender, or eligible institution, that is in compliance with applicable Federal law (including regulations and guidance); or

((B)) a licensed attorney representing a student, borrower, or parent, or another individual who works for a Federal, State, local, or Tribal government or agency, or for a nonprofit organization, providing financial or student loan repayment counseling to a student, borrower, or parent, if—

((i)) that attorney or other individual has never engaged in unfair, deceptive, or abusive practices, as determined by the Secretary;

((ii)) that attorney or other individual does not work for an entity that has engaged in unfair, deceptive, or abusive practices (including an entity that is owned or operated by a person or entity that engaged in such practices), as determined by the Secretary;

((iii)) system access is provided only through a separate point of entry; and

((iv)) the attorney or other individual has consent from the relevant student, borrower, or parent to access the system.

((f)) ** Reports to Congress**

((1)) ** Annual report** Not later than September 30 of each fiscal year, the Secretary shall prepare and submit to the authorizing committees a report describing—

((A)) the effectiveness of existing privacy safeguards in protecting student, borrower, and parent information in the data system;

((B)) the success of any new authorization protocols in more effectively preventing abuse of the data system;

((C)) the reduction in improper data system access as described in subsection (d)(7);

((D)) the ability of the Secretary to monitor how the system is being used, relative to the intended purposes of the data system; and

((E)) any protocols, codes of conduct, terms of service, or information security standards developed under paragraphs (6) or (7) of subsection (d) during the preceding fiscal year.

((2)) ** Study**

((A)) ** In general** The Secretary shall conduct a study regarding—

((i)) available mechanisms for providing students and parents with the ability to opt in or opt out of allowing eligible lenders to access their records in the National Student Loan Data System; and

((ii)) appropriate protocols for limiting access to the data system, based on the risk assessment required under subchapter III of chapter 35 of title 44.

((B)) ** Submission of study** Not later than three years after , the Secretary shall prepare and submit a report on the findings of the study under subparagraph (A) to the authorizing committees.August 14, 20082008-08-14

((g)) ** Standardization of data reporting**

((1)) ** In general** The Secretary shall by regulation prescribe standards and procedures (including relevant definitions) that require all lenders and guaranty agencies to report information on all aspects of loans made under this subchapter in uniform formats in order to permit the direct comparison of data submitted by individual lenders, servicers or guaranty agencies.

((2)) ** Activities** For the purpose of establishing standards under this section, the Secretary shall—

((A)) consult with guaranty agencies, lenders, institutions of higher education, and organizations representing the groups described in paragraph (1);

((B)) develop standards designed to be implemented by all guaranty agencies and lenders with minimum modifications to existing data processing hardware and software; and

((C)) publish the specifications selected to be used to encourage the automation of exchanges of information between all parties involved in loans under this subchapter.

((h)) ** Common identifiers** The Secretary shall, not later than —

((1)) revise the codes used to identify institutions and students in the student loan data system authorized by this section to make such codes consistent with the codes used in each database used by the Department of Education that contains information of participation in programs under this subchapter; and

((2)) modify the design or operation of the system authorized by this section to ensure that data relating to any institution is readily accessible and can be used in a form compatible with the integrated postsecondary education data system (IPEDS).

((i)) ** Integration of databases** The Secretary shall integrate the National Student Loan Data System with the Pell Grant applicant and recipient databases as of , and any other databases containing information on participation in programs under this subchapter.January 1, 19941994-01-01