institutions. (G) Rule of construction Nothing in this paragraph shall be construed to prevent the use of individual categories of aggregate information to be used for accountability purposes, such as for the calculation of the cohort default rate under section 435(m). (6) Submission of data (A) Required submission Each institution of higher education participating in a program under title IV, or the assigned agent of such institution, shall, in accordance with section 487(a)(17), collect, and submit to the Commissioner, the data requested by the Commissioner to carry out this subsection. (B) Voluntary submission Any postsecondary institution not participating in a program under title IV may voluntarily participate in the postsecondary student data system under this subsection by collecting and submitting data to the Commissioner, as the Commissioner may request to carry out this subsection. (7) Unlawful willful disclosure (A) In general It shall be unlawful for any person who obtains or has access to personally identifiable information in connection with the postsecondary student data system described in this subsection to willfully disclose to any person (except as authorized in this Act or any Federal law) such personally identifiable information. (B) Penalty Any person who violates subparagraph (A) shall be fined not more than $5,000, imprisoned not more than 5 years, or both, together with the costs of prosecution. (C) Employee of officer of the United States If a violation of subparagraph (A) is committed by any officer or employee of the United States, the officer or employee shall be dismissed from office or discharged from employment upon conviction for the violation. (8) Data security The Commissioner shall produce and update as needed guidance and regulations relating to privacy, security, and access which shall govern the use and disclosure of data collected in connection with the activities authorized in this subsection. The guidance and regulations developed and reviewed shall protect data from