; and (ii) a process to challenge, correct, or delete any inaccurate, misleading, or otherwise inappropriate data in any education records of such student that are held by the outside party, through an opportunity for a hearing by the agency or institution providing the outside party with access, in accordance with subsection (a)(2). (B) The outside party shall maintain a record of all individuals, agencies, or organizations that have requested or obtained access to the education records of a student held by the outside party, in the same manner as is required under paragraph (8). (C) The outside party shall have policies or procedures in place regarding information security practices regarding the education records, in accordance with paragraph (4). (7) No funds under any applicable program shall be made available to any educational agency or institution, or any State educational agency, unless the agency or institution has a policy or practice that— (A) promotes data minimization in order to safeguard individual privacy by meeting any request for student information with non-personally identifiable information, if the purpose of any appropriate request can be effectively met with non-personally identifiable information; and (B) requires that all personally identifiable information on an individual student held by any outside party be destroyed when the information is no longer needed for the specified purpose. ; and (3) in paragraph (8)(A), as redesignated by paragraph (1)— (A) by inserting who are employees, officers, or volunteers of the agency or institution after of this subsection ; (B) by striking or organizations and inserting organizations, or outside parties ; (C) by striking or organization and inserting organization, or outside party ; and (D) by inserting and will describe the information shared with such person, outside party, agency, or organization after obtaining this information .