1. Any contract entered into by the Department, a school district, a sponsor of a charter school, the governing body of a university school for profoundly gifted pupils or any public school that provides for the disclosure of data that includes any personally identifiable information of a pupil must include, without limitation:
(a) Provisions specifically to protect the privacy and security of the personally identifiable information; and
(b) A penalty for intentional or grossly negligent noncompliance with the terms of the contract, including, without limitation, provisions for termination of the contract and for the payment of monetary damages for any breach of the terms of the contract.
2. As used in this section, “personally identifiable information” has the meaning ascribed to it in 34 C.F.R. § 99.3.