(1) An entity is authorised to collect, use or disclose a student identifier of an individual if the individual consents (expressly or impliedly) to the collection, use or disclosure.
( 2) However, the individual cannot consent to the entity using the individual's student identifier as the entity's own identifier of the individual.