An operator may use or disclose covered information of a student under the following circumstances:
(1) if other provisions of federal or State law require the operator to disclose the information and the operator complies with the requirements of federal and State law in protecting and disclosing that information;
(2) for legitimate research purposes as required by State or federal law and subject to the restrictions under applicable State and federal law or as allowed by State or federal law and under the direction of a school, school district, or the State Board of Education if the covered information is not used for advertising or to amass a profile on the student for purposes other than for PreK-12 school purposes; and
(3) disclosure to a State or local educational agency, including schools and school districts, for PreK-12 school purposes as permitted by State or federal law.