IV may voluntarily participate in the postsecondary student data system under this subsection by collecting and submitting data to the Commissioner, as the Commissioner may request to carry out this subsection. (C) Personally identifiable information In accordance with paragraph (2)(C)(i), if the submission of an element of student-level data is prohibited under paragraph (2)(F) (or otherwise prohibited by law), the institution of higher education shall submit that data to the Commissioner in the aggregate. (7) Unlawful willful disclosure (A) In general It shall be unlawful for any person who obtains or has access to personally identifiable information in connection with the postsecondary student data system described in this subsection to willfully disclose to any person (except as authorized in this Act or by any Federal law) such personally identifiable information. (B) Penalty Any person who violates subparagraph (A) shall be subject to a penalty described under section 3572(f) of title 44, United States Code, and section 183(d)(6) of the Education Sciences Reform Act of 2002 ( 20 U.S.C. 9573(d)(6) ). (C) Employee of officer of the united states If a violation of subparagraph (A) is committed by any officer or employee of the United States, the officer or employee shall be dismissed from office or discharged from employment upon conviction for the violation. (8) Data security The Commissioner shall produce and update as needed guidance and regulations relating to privacy, security, and access which shall govern the use and disclosure of data collected in connection with the activities authorized in this subsection. The guidance and regulations developed and reviewed shall protect data from unauthorized access, use, and disclosure, and shall include— (A) an audit capability, including mandatory and regularly conducted audits