This proposed federal legislation would provide similar protections to U.S. consumers as the GDPR does in Europe. it is currently "stuck in committee." Check back for updates!
The "General Data Protection Regulation" (GDPR) is a strict data protection law that took effect in the European Union in 2018. Although it does not apply to the United States, it does apply to any company that targets or collects data about any person living in the EU, which includes many companies that also operate in the U.S.
The "Federal Educational Rights and Privacy Act" guarantees college students the right to access their educational record, and keeps "educational" records of the student confidential. It DOES allow schools to release "directory" information without consent; this includes name address, phone number, and awards, although students may opt out of this release.
Libraries follow the general schedule instead of the colleges schedule. Most library records can be destroyed after there is no longer a business use for them. See page 111.