Are there limitations as to how the community-based organization may use the personally identifiable information (PII) from education records it receives from a school under the school official exception?

Yes

FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party:

1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records;
3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

It is a best practice to enter into a written agreement with the community-based organization prior to sharing any PII from education records.