(a) For the purposes of this subpart, Office means the Office of the Chief Privacy Officer, U.S. Department of Education.

(b) The Secretary designates the Office to:

(1) Investigate, process, and review complaints and violations under the Act and this part; and

(2) Provide technical assistance to ensure compliance with the Act and this part.

(c) The Secretary designates the Office of Administrative Law Judges to act as the Review Board required under the Act to enforce the Act with respect to all applicable programs. The term applicable program is defined in section 400 of the General Education Provisions Act.

If an educational agency or institution determines that it cannot comply with the Act or this part due to a conflict with State or local law, it must notify the Office within 45 days, giving the text and citation of the conflicting law. If another recipient of Department funds under any program administered by the Secretary or a third party to which personally identifiable information from education records has been non-consensually disclosed determines that it cannot comply with the Act or this part due to a conflict with State or local law, it also must notify the Office within 45 days, giving the text and citation of the conflicting law.

The Office may require an educational agency or institution, other recipient of Department funds under any program administered by the Secretary to which personally identifiable information from education records is non-consensually disclosed, or any third party outside of an educational agency or institution to which personally identifiable information from education records is non-consensually disclosed to submit reports, information on policies and procedures, annual notifications, training materials, or other information necessary to carry out the Office's enforcement responsibilities under the Act or this part.

A parent or eligible student may file a written complaint with the Office regarding an alleged violation under the Act and this part. The Office's address is: Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW., Washington, DC 20202.

(a) A complaint must contain specific allegations of fact giving reasonable cause to believe that a violation of the Act or this part has occurred. A complaint does not have to allege that a violation is based on a policy or practice of the educational agency or institution, other recipient of Department funds under any program administered by the Secretary, or any third party outside of an educational agency or institution.

(b) The Office investigates a timely complaint filed by a parent or eligible student, or conducts its own investigation when no complaint has been filed or a complaint has been withdrawn, to determine whether an educational agency or institution or other recipient of Department funds under any program administered by the Secretary has failed to comply with a provision of the Act or this part. If the Office determines that an educational agency or institution or other recipient of Department funds under any program administered by the Secretary has failed to comply with a provision of the Act or this part, it may also determine whether the failure to comply is based on a policy or practice of the agency or institution or other recipient. The Office also investigates a timely complaint filed by a parent or eligible student, or conducts its own investigation when no complaint has been filed or a complaint has been withdrawn, to determine whether a third party outside of the educational agency or institution has failed to comply with the provisions of § 99.31(a)(6)(iii)(B) or has improperly redisclosed personally identifiable information from education records in violation of § 99.33.

(c) A timely complaint is defined as an allegation of a violation of the Act that is submitted to the Office within 180 days of the date of the alleged violation or of the date that the complainant knew or reasonably should have known of the alleged violation.

(d) The Office may extend the time limit in this section for good cause shown.

(a) The Office notifies in writing the complainant, if any, and the educational agency or institution, the recipient of Department funds under any program administered by the Secretary, or the third party outside of an educational agency or institution if it initiates an investigation under § 99.64(b). The written notice—

(1) Includes the substance of the allegations against the educational agency or institution, other recipient, or third party; and

(2) Directs the agency or institution, other recipient, or third party to submit a written response and other relevant information, as set forth in § 99.62, within a specified period of time, including information about its policies and practices regarding education records.

(b) The Office notifies the complainant if it does not initiate an investigation because the complaint fails to meet the requirements of § 99.64.

(a) The Office reviews a complaint, if any, information submitted by the educational agency or institution, other recipient of Department funds under any program administered by the Secretary, or third party outside of an educational agency or institution, and any other relevant information. The Office may permit the parties to submit further written or oral arguments or information.

(b) Following its investigation, the Office provides to the complainant, if any, and the educational agency or institution, other recipient, or third party a written notice of its findings and the basis for its findings.

(c) If the Office finds that an educational agency or institution or other recipient has not complied with a provision of the Act or this part, it may also find that the failure to comply was based on a policy or practice of the agency or institution or other recipient. A notice of findings issued under paragraph (b) of this section to an educational agency or institution, or other recipient that has not complied with a provision of the Act or this part—

(1) Includes a statement of the specific steps that the agency or institution or other recipient must take to comply; and

(2) Provides a reasonable period of time, given all of the circumstances of the case, during which the educational agency or institution or other recipient may comply voluntarily.

(d) If the Office finds that a third party outside of an educational agency or institution has not complied with the provisions of § 99.31(a)(6)(iii)(B) or has improperly redisclosed personally identifiable information from education records in violation of § 99.33, the Office's notice of findings issued under paragraph (b) of this section—

(1) Includes a statement of the specific steps that the third party outside of the educational agency or institution must take to comply; and

(2) Provides a reasonable period of time, given all of the circumstances of the case, during which the third party may comply voluntarily.

(a) If an educational agency or institution or other recipient of Department funds under any program administered by the Secretary does not comply during the period of time set under § 99.66(c), the Secretary may take any legally available enforcement action in accordance with the Act, including, but not limited to, the following enforcement actions available in accordance with part D of the General Education Provisions Act—

(1) Withhold further payments under any applicable program;

(2) Issue a complaint to compel compliance through a cease and desist order; or

(3) Terminate eligibility to receive funding under any applicable program.

(b) If, after an investigation under § 99.66, the Secretary finds that an educational agency or institution, other recipient, or third party has complied voluntarily with the Act or this part, the Secretary provides the complainant and the agency or institution, other recipient, or third party with written notice of the decision and the basis for the decision.

(c) If the Office finds that a third party, outside the educational agency or institution, violates § 99.31(a)(6)(iii)(B), then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the violation of § 99.31(a)(6)(iii)(B) access to personally identifiable information from education records for at least five years.

(d) If the Office finds that a State or local educational authority, a Federal agency headed by an official listed in § 99.31(a)(3), or an authorized representative of a State or local educational authority or a Federal agency headed by an official listed in § 99.31(a)(3), improperly rediscloses personally identifiable information from education records, then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the improper redisclosure access to personally identifiable information from education records for at least five years.

(e) If the Office finds that a third party, outside the educational agency or institution, improperly rediscloses personally identifiable information from education records in violation of § 99.33 or fails to provide the notification required under § 99.33(b)(2), then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the violation access to personally identifiable information from education records for at least five years.