(1) An agency or institution as defined in s. 1002.22(1) may not:(a) Collect, obtain, or retain information on the political affiliation, voting history, religious affiliation, or biometric information of a student or a parent or sibling of the student. For purposes of this subsection, the term “biometric information” means information collected from the electronic measurement or evaluation of any physical or behavioral characteristics that are attributable to a single person, including fingerprint characteristics, hand characteristics, eye characteristics, vocal characteristics, and any other physical characteristics used for the purpose of electronically identifying that person with a high degree of certainty. Examples of biometric information include, but are not limited to, a fingerprint or hand scan, a retina or iris scan, a voice print, or a facial geometry scan. Notwithstanding the provisions of this paragraph, a school district that used a palm scanner system for identifying students for breakfast and lunch programs on March 1, 2014, may continue to use the palm scanner system through the 2014-2015 school year.
(b) Provide education records made confidential and exempt by s. 1002.221 or federal law to:1. A person as defined in s. 1.01(3) except when authorized by s. 1002.221 or in response to a lawfully issued subpoena or court order; 2. A public body, body politic, or political subdivision as defined in s. 1.01(8) except when authorized by s. 1002.221 or in response to a lawfully issued subpoena or court order; or 3. An agency of the Federal Government except when authorized by s. 1002.221, required by federal law, or in response to a lawfully issued subpoena or court order. (2) The governing board of an agency or institution may only designate information as directory information in accordance with 20 U.S.C. s. 1232g and applicable federal regulations. Such designation must occur at a regularly scheduled meeting of the governing board. The governing board of an agency or institution must consider whether designation of such information would put students at risk of becoming targets of marketing campaigns, the media, or criminal acts. An agency or institution may charge fees for copies of designated directory information as provided in s. 119.07(4). 
