; (B) access controls; (C) requirements to ensure sufficient data security, quality, validity, and reliability; (D) student confidentiality protection in accordance with the Confidential Information Protection and Statistical Efficiency Act; (E) appropriate and applicable privacy and security protection, including data retention and destruction protocols and data minimization, in accordance with the most recent Federal standards developed by the National Institute of Standards and Technology; and (F) protocols for managing a breach, including breach notifications, in accordance with the standards of National Center for Education Statistics. (9) Data collection The Commissioner shall ensure that data collection, maintenance, and use under this subsection complies with section 552a of title 5, United States Code. (10) Definitions In this subsection: (A) Institution of higher education The term institution of higher education has the meaning given the term in section 102. (B) Personally identifiable information The term personally identifiable information has the meaning given the term in section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g ). . (b) Effective date