SECTION 1. Short title.

SEC. 2. Postsecondary student data system.

(1) by redesignating subsection (l) as subsection (m); and

(2) by inserting after subsection (k) the following:

“(l) Postsecondary student data system.—

“(1) IN GENERAL.—

“(A) ESTABLISHMENT OF SYSTEM.—Not later than 4 years after the date of enactment of the College Transparency Act, the Commissioner of the National Center for Education Statistics (referred to in this subsection as the ‘Commissioner’) shall develop and maintain a secure and privacy-protected postsecondary student-level data system in order to—

“(i) accurately evaluate student enrollment patterns, progression, completion, and postcollegiate outcomes, and higher education costs and financial aid;

“(ii) assist with transparency, institutional improvement, and analysis of Federal aid programs;

“(iii) provide accurate, complete, and customizable information for students and families making decisions about postsecondary education; and

“(iv) reduce the reporting burden on institutions of higher education, in accordance with section 5 of the College Transparency Act.

“(B) AVOIDING DUPLICATED REPORTING.—Notwithstanding any other provision of this section, to the extent that another provision of this section requires the same reporting or collection of data that is required under this subsection, an institution of higher education, or the Secretary or Commissioner, shall use the reporting or data required for the postsecondary student data system under this subsection to satisfy both requirements.

“(C) DEVELOPMENT PROCESS.—In developing the postsecondary student data system described in this subsection, the Commissioner shall—

“(i) focus on the needs of—

“(I) users of the data system; and

“(II) entities, including institutions of higher education, reporting to the data system;

“(ii) take into consideration, to the extent practicable—

“(I) the guidelines outlined in the U.S. Web Design Standards maintained by the General Services Administration and the Digital Services Playbook and TechFAR Handbook for Procuring Digital Services Using Agile Processes of the U.S. Digital Service; and

“(II) the relevant successor documents or recommendations of such guidelines;

“(iii) use modern, relevant privacy- and security-enhancing technology, and enhance and update the data system as necessary to carry out the purpose of this subsection;

“(iv) ensure data privacy and security is consistent with any relevant Federal law relating to privacy or data security, including—

“(I) the requirements of subchapter II of chapter 35 of title 44, United States Code, specifying security categorization under the Federal Information Processing Standards or any relevant successor of such standards;

“(II) security requirements that are consistent with the Federal agency responsibilities in section 3554 of title 44, United States Code, or any relevant successor of such responsibilities; and

“(III) security requirements, guidelines, and controls consistent with cybersecurity standards and best practices developed by the National Institute of Standards and Technology, including frameworks, consistent with section 2(c) of the National Institute of Standards and Technology Act (15 U.S.C. 272(c)), or any relevant successor of such frameworks;

“(v) follow Federal data minimization practices to ensure only the minimum amount of data is collected to meet the system’s goals, in accordance with Federal data minimization standards and guidelines developed by the National Institute of Standards and Technology; and

“(vi) provide notice to students outlining the data included in the system and how the data are used.

“(2) DATA ELEMENTS.—

“(A) IN GENERAL.—Not later than 4 years after the date of enactment of the College Transparency Act, the Commissioner, in consultation with the Postsecondary Student Data System Advisory Committee established under subparagraph (B), shall determine—

“(i) the data elements to be included in the postsecondary student data system, in accordance with subparagraphs (C) and (D); and

“(ii) how to include the data elements required under subparagraph (C), and any additional data elements selected under subparagraph (D), in the postsecondary student data system.

“(B) POSTSECONDARY STUDENT DATA SYSTEM ADVISORY COMMITTEE.—

“(i) ESTABLISHMENT.—Not later than 2 years after the date of enactment of the College Transparency Act, the Commissioner shall establish a Postsecondary Student Data System Advisory Committee (referred to in this subsection as the ‘Advisory Committee’), whose members shall include—

“(I) the Chief Privacy Officer of the Department or an official of the Department delegated the duties of overseeing data privacy at the Department;

“(II) the Chief Security Officer of the Department or an official of the Department delegated the duties of overseeing data security at the Department;

“(III) representatives of diverse institutions of higher education, which shall include equal representation between 2-year and 4-year institutions of higher education, and from public, nonprofit, and proprietary institutions of higher education, including minority-serving institutions;

“(IV) representatives from State higher education agencies, entities, bodies, or boards;

“(V) representatives of postsecondary students;

“(VI) representatives from relevant Federal agencies;

“(VII) individuals with expertise in data privacy and security; and

“(VIII) other stakeholders (including individuals with consumer protection and postsecondary education research).

“(ii) REQUIREMENTS.—The Commissioner shall ensure that the Advisory Committee—

“(I) adheres to all requirements under chapter 10 of title 5, United States Code (commonly known as the ‘Federal Advisory Committee Act’);

“(II) establishes operating and meeting procedures and guidelines necessary to execute its advisory duties; and

“(III) is provided with appropriate staffing and resources to execute its advisory duties.

“(C) REQUIRED DATA ELEMENTS.—The data elements in the postsecondary student data system shall include, at a minimum, the following:

“(i) Student-level data elements necessary to calculate the information within the surveys designated by the Commissioner as ‘student-related surveys’ in the Integrated Postsecondary Education Data System (IPEDS), as such surveys are in effect on the day before the date of enactment of the College Transparency Act, except that in the case that collection of such elements would conflict with subparagraph (F), such elements in conflict with subparagraph (F) shall be included in the aggregate instead of at the student level.

“(ii) Student-level data elements necessary to allow for reporting student enrollment, persistence, retention, transfer, and completion measures for all credential levels separately (including certificate, associate, baccalaureate, and advanced degree levels), within and across institutions of higher education (including across all categories of institution level, control, and predominant degree awarded). The data elements shall allow for reporting about all such data disaggregated by the following categories:

“(I) Enrollment status as a first-time student, recent transfer student, or other non-first-time student.

“(II) Attendance intensity, whether full-time or part-time.

“(III) Credential-seeking status, by credential level.

“(IV) Race or ethnicity, in a manner that captures all the racial groups specified in the most recent American Community Survey of the Bureau of the Census.

“(V) Age intervals.

“(VI) Gender.

“(VII) Program of study (as applicable).

“(VIII) Military or veteran benefit status (as determined based on receipt of veteran's education benefits, as defined in section 480(c)).

“(IX) Status as a distance education student, whether exclusively or partially enrolled in distance education.

“(X) Federal Pell Grant recipient status under section 401 and Federal loan recipient status under title IV, provided that the collection of such information complies with paragraph (1)(B).

“(D) OTHER DATA ELEMENTS.—

“(i) IN GENERAL.—The Commissioner may, after consultation with the Advisory Committee and provision of a public comment period, include additional data elements in the postsecondary student data system, such as those described in clause (ii), if those data elements—

“(I) are necessary to ensure that the postsecondary data system fulfills the purposes described in paragraph (1)(A); and

“(II) are consistent with data minimization principles, including the collection of only those additional elements that are necessary to ensure such purposes.

“(ii) DATA ELEMENTS.—The data elements described in clause (i) may include—

“(I) status as a first generation college student, as defined in section 402A(h);

“(II) economic status;

“(III) participation in postsecondary remedial coursework or gateway course completion; or

“(IV) other data elements that are necessary in accordance with clause (i).

“(E) REEVALUATION.—Not less than once every 3 years after the implementation of the postsecondary student data system described in this subsection, the Commissioner, in consultation with the Advisory Committee described in subparagraph (B), shall review the data elements included in the postsecondary student data system and may revise the data elements to be included in such system.

“(F) PROHIBITIONS.—The Commissioner shall not include individual health data (including data relating to physical health or mental health), student discipline records or data, elementary and secondary education data, an exact address, citizenship status, migrant status, or national origin status for students or their families, course grades, postsecondary entrance examination results, political affiliation, or religion in the postsecondary student data system under this subsection.

“(3) PERIODIC MATCHING WITH OTHER FEDERAL DATA SYSTEMS.—

“(A) DATA SHARING AGREEMENTS.—

“(i) The Commissioner shall ensure secure and privacy-protected periodic data matches by entering into data sharing agreements with each of the following Federal agencies and offices:

“(I) The Secretary of the Treasury and the Commissioner of the Internal Revenue Service, in order to calculate aggregate program- and institution-level earnings of postsecondary students.

“(II) The Secretary of Defense, in order to assess the use of postsecondary educational benefits and the outcomes of servicemembers.

“(III) The Secretary of Veterans Affairs, in order to assess the use of postsecondary educational benefits and outcomes of veterans.

“(IV) The Director of the Bureau of the Census, in order to assess the earnings outcomes of former postsecondary education students.

“(V) The Chief Operating Officer of the Office of Federal Student Aid, in order to analyze the use of postsecondary educational benefits provided under this Act.

“(VI) The Commissioner of the Social Security Administration, in order to evaluate labor market outcomes of former postsecondary education students.

“(VII) The Commissioner of the Bureau of Labor Statistics, in order to assess the wages of former postsecondary education students.

“(ii) The heads of Federal agencies and offices described under clause (i) shall enter into data sharing agreements with the Commissioner to ensure secure and privacy-protected periodic data matches as described in this paragraph.

“(B) CATEGORIES OF DATA.—The Commissioner shall, at a minimum, seek to ensure that the secure and privacy-protected periodic data matches described in subparagraph (A) permit consistent reporting of the following categories of data for all postsecondary students:

“(i) Enrollment, retention, transfer, and completion outcomes for all postsecondary students.

“(ii) Financial indicators for postsecondary students receiving Federal grants and loans, including grant and loan aid by source, cumulative student debt, loan repayment status, and repayment plan.

“(iii) Post-completion outcomes for all postsecondary students, including earnings, employment, and further education, by program of study and credential level and as measured—

“(I) immediately after leaving postsecondary education; and

“(II) at time intervals appropriate to the credential sought and earned.

“(C) PERIODIC DATA MATCH STREAMLINING AND CONFIDENTIALITY.—

“(i) STREAMLINING.—In carrying out the secure and privacy-protected periodic data matches under this paragraph, the Commissioner shall—

“(I) ensure that such matches are not continuous, but occur only periodically at appropriate intervals, as determined by the Commissioner to meet the goals of subparagraph (A); and

“(II) seek to—

“(aa) streamline the data collection and reporting requirements for institutions of higher education;

“(bb) minimize duplicative reporting across or within Federal agencies or departments, including reporting requirements applicable to institutions of higher education under the Workforce Innovation and Opportunity Act (29 U.S.C. 3101 et seq.) and the Carl D. Perkins Career and Technical Education Act of 2006;

“(cc) protect student privacy; and

“(dd) streamline the application process for student loan benefit programs available to borrowers based on data available from different Federal data systems.

“(ii) REVIEW.—Not less often than once every 3 years after the establishment of the postsecondary student data system under this subsection, the Commissioner, in consultation with the Advisory Committee, shall review methods for streamlining data collection from institutions of higher education and minimizing duplicative reporting within the Department and across Federal agencies that provide data for the postsecondary student data system.

“(iii) CONFIDENTIALITY.—The Commissioner shall ensure that any periodic matching or sharing of data through periodic data system matches established in accordance with this paragraph—

“(I) complies with the security and privacy protections described in paragraph (1)(C)(iv) and other Federal data protection protocols;

“(II) follows industry best practices commensurate with the sensitivity of specific data elements or metrics;

“(III) does not result in the creation of a single standing, linked Federal database at the Department that maintains the information reported across other Federal agencies; and

“(IV) discloses to postsecondary students what data are included in the data system and periodically matched and how the data are used.

“(iv) CORRECTION.—The Commissioner, in consultation with the Advisory Committee, shall establish a process for students to request access to only their personal information for inspection and request corrections to inaccuracies in a manner that protects the student's personally identifiable information. The Commissioner shall respond in writing to every request for a correction from a student.

“(4) PUBLICLY AVAILABLE INFORMATION.—

“(A) IN GENERAL.—The Commissioner shall make the summary aggregate information described in subparagraph (C), at a minimum, publicly available through a user-friendly consumer information website and analytic tool that—

“(i) provides appropriate mechanisms for users to customize and filter information by institutional and student characteristics;

“(ii) allows users to build summary aggregate reports of information, including reports that allow comparisons across multiple institutions and programs, subject to subparagraph (B);

“(iii) uses appropriate statistical disclosure limitation techniques necessary to ensure that the data released to the public cannot be used to identify specific individuals; and

“(iv) provides users with appropriate contextual factors to make comparisons, which may include national median figures of the summary aggregate information described in subparagraph (C).

“(B) NO PERSONALLY IDENTIFIABLE INFORMATION AVAILABLE.—The summary aggregate information described in this paragraph shall not include personally identifiable information.

“(C) SUMMARY AGGREGATE INFORMATION AVAILABLE.—The summary aggregate information described in this paragraph shall, at a minimum, include each of the following for each institution of higher education:

“(i) Measures of student access, including—

“(I) admissions selectivity and yield; and

“(II) enrollment, disaggregated by each category described in paragraph (2)(C)(ii).

“(ii) Measures of student progression, including retention rates and persistence rates, disaggregated by each category described in paragraph (2)(C)(ii).

“(iii) Measures of student completion, including—

“(I) transfer rates and completion rates, disaggregated by each category described in paragraph (2)(C)(ii); and

“(II) number of completions, disaggregated by each category described in paragraph (2)(C)(ii).

“(iv) Measures of student costs, including—

“(I) tuition, required fees, total cost of attendance, and net price after total grant aid, disaggregated by in-State tuition or in-district tuition status (if applicable), program of study (if applicable), and credential level; and

“(II) typical grant amounts and loan amounts received by students reported separately from Federal, State, local, and institutional sources, and cumulative debt, disaggregated by each category described in paragraph (2)(C)(ii) and completion status.

“(v) Measures of postcollegiate student outcomes, including employment rates, mean and median earnings, loan repayment and default rates, and further education rates. These measures shall—

“(I) be disaggregated by each category described in paragraph (2)(C)(ii) and completion status; and

“(II) be measured immediately after leaving postsecondary education and at time intervals appropriate to the credential sought or earned.

“(D) DEVELOPMENT CRITERIA.—In developing the method and format of making the information described in this paragraph publicly available, the Commissioner shall—

“(i) focus on the needs of the users of the information, which will include students, families of students, potential students, researchers, and other consumers of education data;

“(ii) take into consideration, to the extent practicable, the guidelines described in paragraph (1)(C)(ii)(I), and relevant successor documents or recommendations of such guidelines;

“(iii) use modern, relevant technology and enhance and update the postsecondary student data system with information, as necessary to carry out the purpose of this paragraph;

“(iv) ensure data privacy and security in accordance with standards and guidelines developed by the National Institute of Standards and Technology, and in accordance with any other Federal law relating to privacy or security, including complying with the requirements of subchapter II of chapter 35 of title 44, United States Code, specifying security categorization under the Federal Information Processing Standards, and security requirements, and setting of National Institute of Standards and Technology security baseline controls at the appropriate level; and

“(v) conduct consumer testing to determine how to make the information as meaningful to users as possible.

“(5) PERMISSIBLE DISCLOSURES OF DATA.—

“(A) DATA REPORTS AND QUERIES.—

“(i) IN GENERAL.—Not later than 4 years after the date of enactment of the College Transparency Act, the Commissioner shall develop and implement a secure and privacy-protected process for making student-level, non-personally identifiable information, with direct identifiers removed, from the postsecondary student data system available for vetted research and evaluation purposes approved by the Commissioner in a manner compatible with practices for disclosing National Center for Education Statistics restricted-use survey data as in effect on the day before the date of enactment of the College Transparency Act, or by applying other research and disclosure restrictions to ensure data privacy and security. Such process shall be approved by the National Center for Education Statistics’ Disclosure Review Board (or successor body).

“(ii) PROVIDING DATA REPORTS AND QUERIES TO INSTITUTIONS AND STATES.—

“(I) IN GENERAL.—The Commissioner shall provide feedback reports, at least annually, to each institution of higher education, each postsecondary education system that fully participates in the postsecondary student data system, and each State higher education body as designated by the governor.

“(II) FEEDBACK REPORTS.—The feedback reports provided under this clause shall include program-level and institution-level information from the postsecondary student data system regarding students who are associated with the institution or, for State representatives, the institutions within that State, on or before the date of the report, on measures including student mobility and workforce outcomes, provided that the feedback aggregate summary reports protect the privacy of individuals.

“(III) DETERMINATION OF CONTENT.—The content of the feedback reports shall be determined by the Commissioner in consultation with the Advisory Committee.

“(iii) PERMITTING STATE DATA QUERIES.—The Commissioner shall, in consultation with the Advisory Committee and as soon as practicable, create a process through which States may submit lists of secondary school graduates within the State to receive summary aggregate outcomes for those students who enrolled at an institution of higher education, including postsecondary enrollment and college completion, provided that those data protect the privacy of individuals and that the State data submitted to the Commissioner are not stored in the postsecondary education system.

“(iv) REGULATIONS.—The Commissioner shall promulgate regulations to ensure fair, secure and privacy-protected, and equitable access to data reports and queries under this paragraph.

“(B) DISCLOSURE LIMITATIONS.—In carrying out the public reporting and disclosure requirements of this subsection, the Commissioner shall use appropriate statistical disclosure limitation techniques necessary to ensure that the data released to the public cannot include personally identifiable information or be used to identify specific individuals.

“(C) SALE OF DATA PROHIBITED.—Data collected under this subsection, including the public-use data set and data comprising the summary aggregate information available under paragraph (4), shall not be sold to any third party by the Commissioner, including any institution of higher education or any other entity.

“(D) LIMITATION ON USE BY OTHER FEDERAL AGENCIES.—

“(i) IN GENERAL.—The Commissioner shall not allow any other Federal agency to use data collected under this subsection for any purpose except—

“(I) for vetted research and evaluation conducted by the other Federal agency, as described in subparagraph (A)(i); or

“(II) for a purpose explicitly authorized by this Act.

“(ii) PROHIBITION ON LIMITATION OF SERVICES.—The Secretary, or the head of any other Federal agency, shall not use data collected under this subsection to limit services to students.

“(E) LAW ENFORCEMENT.—Personally identifiable information collected under this subsection shall not be used for any Federal, State, or local law enforcement activity or any other activity that would result in adverse action against any student or a student's family, including debt collection activity or enforcement of immigration laws.

“(F) LIMITATION OF USE FOR FEDERAL RANKINGS OR SUMMATIVE RATING SYSTEM.—The comprehensive data collection and analysis necessary for the postsecondary student data system under this subsection shall not be used by the Secretary or any Federal entity to establish any Federal ranking system of institutions of higher education or a system that results in a summative Federal rating of institutions of higher education.

“(G) RULE OF CONSTRUCTION.—Nothing in this paragraph shall be construed to prevent the use of individual categories of aggregate information to be used for accountability purposes.

“(H) RULE OF CONSTRUCTION REGARDING COMMERCIAL USE OF DATA.—Nothing in this paragraph shall be construed to prohibit third-party entities from using publicly available information in this data system for commercial use.

“(6) SUBMISSION OF DATA.—

“(A) REQUIRED SUBMISSION.—Each institution of higher education participating in a program under title IV, or the assigned agent of such institution, shall, for each eligible program, in accordance with section 487(a)(17), collect, and submit to the Commissioner, the data requested by the Commissioner to carry out this subsection.

“(B) VOLUNTARY SUBMISSION.—Any institution of higher education not participating in a program under title IV may voluntarily participate in the postsecondary student data system under this subsection by collecting and submitting data to the Commissioner, as the Commissioner may request to carry out this subsection.

“(C) PERSONALLY IDENTIFIABLE INFORMATION.—In accordance with paragraph (2)(C)(i), if the submission of an element of student-level data is prohibited under paragraph (2)(F) (or otherwise prohibited by law), the institution of higher education shall submit that data to the Commissioner in the aggregate.

“(7) UNLAWFUL WILLFUL DISCLOSURE.—

“(A) IN GENERAL.—It shall be unlawful for any person who obtains or has access to personally identifiable information in connection with the postsecondary student data system described in this subsection to willfully disclose to any person (except as authorized in this Act or by any Federal law) such personally identifiable information.

“(B) PENALTY.—Any person who violates subparagraph (A) shall be subject to a penalty described under section 3572(f) of title 44, United States Code, and section 183(d)(6) of the Education Sciences Reform Act of 2002 (20 U.S.C. 9573(d)(6)).

“(C) EMPLOYEE OF OFFICER OF THE UNITED STATES.—If a violation of subparagraph (A) is committed by any officer or employee of the United States, the officer or employee shall be dismissed from office or discharged from employment upon conviction for the violation.

“(8) DATA SECURITY.—The Commissioner shall produce and update as needed guidance and regulations relating to privacy, security, and access which shall govern the use and disclosure of data collected in connection with the activities authorized in this subsection. The guidance and regulations developed and reviewed shall protect data from unauthorized access, use, and disclosure, and shall include—

“(A) an audit capability, including mandatory and regularly conducted audits;

“(B) access controls;

“(C) requirements to ensure sufficient data security, quality, validity, and reliability;

“(D) confidentiality protection in accordance with the applicable provisions of subchapter III of chapter 35 of title 44, United States Code;

“(E) appropriate and applicable privacy and security protection, including data retention and destruction protocols and data minimization, in accordance with the most recent Federal standards developed by the National Institute of Standards and Technology; and

“(F) protocols for managing a breach, including breach notifications, in accordance with the standards of National Center for Education Statistics.

“(9) DATA COLLECTION.—The Commissioner shall ensure that data collection, maintenance, and use under this subsection complies with section 552a of title 5, United States Code.

“(10) DEFINITIONS.—In this subsection:

“(A) INSTITUTION OF HIGHER EDUCATION.—The term ‘institution of higher education’ has the meaning given the term in section 102.

“(B) MINORITY-SERVING INSTITUTION.—The term ‘minority-serving institution’ means an institution of higher education listed in section 371(a).

“(C) PERSONALLY IDENTIFIABLE INFORMATION.—The term ‘personally identifiable information’ means personally identifiable information within the meaning of section 444 of the General Education Provisions Act.”.

SEC. 3. Repeal of prohibition on student data system.

SEC. 4. Institutional requirements.

SEC. 5. Transition provisions.