; and (ii) require each outside party to whom personally identifiable information from education records is disclosed to have information security policies and procedures that include a comprehensive security program designed to protect the personally identifiable information from education records. (B) For purposes of this subsection, the term outside party means a person that is not an employee, officer, or volunteer of the educational agency or institution or of a Federal, State, or local governmental agency and includes any contractor or consultant acting as a school official or authorized representative or in any other capacity. (5) Notwithstanding any other provision of this section or paragraph (2)(A), no funds shall be made available under any applicable program to any educational agency or institution that has a policy or practice of using, knowingly releasing, or otherwise knowingly providing access to personally identifiable information, as described in paragraph (2), in the education records of a student to advertise or market a product or service. (6) Each State educational agency receiving funds under an applicable program, and each educational agency or institution, shall ensure that any outside party with access to education records with personally identifiable information complies with the following: (A) Any education records that are held by the outside party shall be held in a manner that provides, as directed by the educational agency or institution, parents with— (i) the right to access the personally identifiable information held about their students by the outside party, to the same extent and in the same manner as provided in subsection (a)(1)