(2) A public university listed in ORS 352.002 may enter into a contract with a private contractor to provide the service of facilitating the disbursement of funds to students. If a student’s personally identifiable information is necessary to administer the disbursement of funds under the contract, the public university:
(a) Shall obtain from a student a written election to receive the contracted services;
(b) Shall provide any alternative method of disbursement of funds at no additional cost to a student who does not elect to receive those services from a private contractor;
(c) May not release to a private contractor personally identifiable information about a student who elects to receive disbursement services from the private contractor without first obtaining from the student a written consent to release the personally identifiable information; and
(d) Shall provide to a student a written description of the purposes for which a private contractor may use the student’s personally identifiable information. [Formerly 352.017]