; and (5) collect and disseminate to eligible entities carrying out a demonstration project under this section, best practices with respect to such projects. (j) Data privacy (1) In general It shall be unlawful for any person who obtains or has access to personally identifiable information in connection with this section to willfully disclose to any person (except as authorized in this Act or any Federal law) such personally identifiable information. (2) Penalty Any person who violates paragraph (1) shall be fined not more than $5,000, imprisoned for not more than 5 years, or both, together with the costs of prosecution. (3) Employee or officer of the united states If a violation of paragraph (1) is committed by any officer or employee of the United States, the officer or employee shall be dismissed from office or discharged from employment upon conviction for the violation. (4) Sale of data prohibited Data collected under this section shall not be sold to any third party by the Director, any postsecondary institution, or any other entity. (5) Limitation on use by other Federal agencies The Director shall not allow any other Federal agency to use data collected under this section for any purpose except as explicitly authorized by this Act. (6) Law enforcement Personally identifiable information collected under this section shall not be used for any law enforcement activity or any other activity that would result in adverse action against any student, including debt collection activity or enforcement of the immigration laws. (k) Authorization of appropriations There are authorized to be appropriated $5,000,000 to carry out this section. (l) Definitions For the purpose of this section: (1) Competency-based education program The term competency-based education program means a program that provides competency-based education for which the accrediting agency or association of the institution of higher education offering such program has established or will establish the standards described in subsection (c) and, in