; and (iv) ensure data privacy and security for the information in accordance with the most recent Federal standards developed by the National Institute of Standards and Technology. (5) Permissible disclosures of data (A) Nonpublicly available data (i) In general The Commissioner shall develop and implement a secure process for making student-level, non-personally identifiable information from the postsecondary student data system available for research and evaluation purposes approved by the Commissioner in a manner compatible with practices for disclosing National Center for Education Statistics survey data as in effect on the day before the date of enactment of the College Transparency Act . (ii) Availability for institutional improvement and program evaluation The Commissioner shall create a process through which any postsecondary institution, or postsecondary education system, that fully participates in the postsecondary student data system described in this subsection may request and receive from the Commissioner non-personally identifiable information, and aggregate summary data, related to students who have attended the institution or system, as applicable, for the purposes of institutional improvement and program evaluation. (iii) Providing data to institutions The Commissioner shall provide, at least annually, each postsecondary institution that fully participates in the postsecondary student data system under this subsection with a set of program-level, non-personally identifiable information from the postsecondary student data system for students currently or formerly associated with the institution that includes aggregated information from other Federal data sources included in the system. (iv) Providing data to States The Commissioner shall create a process through which States may request and receive institution-level aggregate data outcomes for postsecondary institutions located in the State. (v) Regulations The Commissioner shall promulgate regulations to ensure fair, secure, and equitable access