Are there any restrictions on how a community-based organization can use and protect the PII from education records it receives to conduct a study?

Yes.  Under the studies exception, the school or LEA may non-consensually disclose PII from education records to the community-based organization only if—

  1. The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;
  2. The information is destroyed when no longer needed for the purposes for which the study was conducted; and
  3. The school or LEA enters into a written agreement with the community-based organization.