; or (4) disclose covered information, unless the disclosure is made— (A) pursuant to lawful process or to ensure legal and regulatory compliance with Federal or State law; (B) (i) in furtherance of the preK–12 purpose of the site or service; and (ii) if the recipient of the covered information disclosed under this paragraph does not further disclose the information unless the disclosure is done to allow or improve operability and functionality of the operator’s site or service; (C) for a school, educational, or employment purpose requested by the student or the student’s parent, as long as the information is not used or further disclosed for any other purpose; (D) to protect the safety or integrity of users or others or the security of the school service; or (E) to a State or local educational agency, including elementary schools and secondary schools, for preK–12 purposes, as permitted by Federal or State law; or (5) notwithstanding paragraph (4), disclose covered information to a third-party service provider of the school service for purposes of maintaining, developing, supporting, improving, or diagnosing the operator’s site or service unless the operator contractually requires the provider to comply with all the provisions of this Act (including such paragraph). (b) Requirements An operator shall— (1) establish, implement, and maintain reasonable security procedures appropriate to the nature of the covered information that are designed to protect the covered information from unauthorized access, destruction, use, modification, or disclosure; (2) unless the educational agency, institution, or program or a student's parent consents to the maintenance of the covered information, delete a student’s covered information— (A) within a reasonable time after receiving a request for deletion through an educational agency, institution, or program, or from the student’s parent; or (B) once the data has outlived the legitimate purpose for which the data was collected