; and (ii) comply with the security and privacy protections described in all applicable Federal data protection protocols. (D) Review Not less often than once every 5 years after the establishment of the postsecondary data system under this subsection, the Commissioner shall review methods for streamlining data collection from postsecondary institutions and minimizing duplicative reporting with the Department of Education and across Federal agencies that provide data for the postsecondary data system. (4) Information sharing (A) Aggregate information The Commissioner shall make summary aggregate information publicly available and user-friendly. Such aggregate information shall— (i) include, at a minimum, for each institution of higher education, measures of student access, progression, completion, student costs, and postcollegiate student outcomes; and (ii) not include any personally identifiable information. (B) Research and evaluation The Commissioner shall develop and implement a secure process— (i) for making student-level, non-personally identifiable information from the postsecondary data system described in this subsection available for research and evaluation purposes approved by the Commissioner in a manner compatible with practices for disclosing National Center for Education Statistics data as in effect on the day before the date of enactment of the Aim Higher Act; (ii) through which any institution of higher education or a State that fully participates in the postsecondary data system under this subsection may request and receive from the Commissioner non-personally identifiable information, and aggregate summary data, related to students who have attended such institution or any institution in such State, as applicable, for purposes of institutional or State improvement and program evaluation