; (B) access controls; (C) requirements to ensure sufficient data security, quality, validity, and reliability; (D) confidentiality protection in accordance with the applicable provisions of subchapter III of chapter 35 of title 44, United States Code; (E) appropriate and applicable privacy and security protection, including data retention and destruction protocols and data minimization, in accordance with the most recent Federal standards developed by the National Institute of Standards and Technology; and (F) protocols for managing a breach, including breach notifications, in accordance with the standards of National Center for Education Statistics. (9) Data collection The Commissioner shall ensure that data collection, maintenance, and use under this subsection complies with section 552a of title 5, United States Code. (10) Definitions In this subsection: (A) Institution of higher education The term institution of higher education has the meaning given the term in section 102. (B) Minority-serving institution The term minority-serving institution means an institution of higher education listed in section 371(a). (C) Personally identifiable information The term personally identifiable information means personally identifiable information within the meaning of section 444 of the General Education Provisions Act. . 114. Database of student information prohibited (a) In general Section 134(b) of the Higher Education Act of 1965 ( 20 U.S.C. 1015c(b) ) is amended to read as follows: (b) Exception The provisions of subsection (a) shall not apply to a system (or a successor system)— (1) that— (A) is necessary for the operation of programs authorized by title II, IV, or VII; and (B) was in use by the Secretary, directly or through a contractor, as of the day before the date of enactment of the College Cost Reduction Act