(a) Educational agencies shall not sell personally identifiable information nor use or disclose it for any marketing or commercial purpose or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so.

(b) Each educational agency shall take steps to minimize its collection, processing and transmission of personally identifiable information.

(c) Each educational agency shall ensure that it has provisions in its contracts with third-party contractors or in separate data sharing and confidentiality agreements that require the confidentiality of shared student data or teacher or principal data be maintained in accordance with Federal and State law and the educational agency's data security and privacy policy.

(d) Except as required by law or in the case of educational enrollment data, school districts shall not report to the department the following student data elements: