May a school disclose de-identified data to community-based organization?

Yes. Schools do not need to obtain written consent or to inform parents or eligible students when releasing properly de-identified information.  For additional information on de-identified data and recommended practices, see § 99.31(b)(1) of the regulations and a relevant case study released by the Department, Case Study #5: Minimizing Access to PII: Best Practices for Access Controls and Disclosure Avoidance Techniques.