(1) Each postsecondary institution in Colorado shall assign to each student enrolled in the institution a unique primary identifier that may be a series of numbers or characters.

(2) On and after July 1, 2003, each postsecondary institution in Colorado shall take reasonable and prudent steps to ensure the privacy of a student's social security number.

(3) (a) On and after July 1, 2004, a postsecondary institution in Colorado shall not use a student's social security number or part of a student's social security number as the student's primary identifier.

(b) Notwithstanding the provisions of paragraph (a) of this subsection (3), the Colorado commission on higher education may allow a postsecondary institution in Colorado to use a student's social security number or part of a student's social security number as the student's primary identifier if:

(I) The institution demonstrates to the satisfaction of the commission that the institution is unable to comply with the provisions of paragraph (a) of this subsection (3) because of the financial cost of compliance; and

(II) The institution submits to the commission and the commission approves a plan and timetable for phasing out the use of a student'ssocial security number or part of a student's social security number as the student's primary identifier.

(4) (a) Notwithstanding the provisions of paragraph (b) of subsection (3) of this section, for each student who graduates from or was enrolled in a Colorado high school, a postsecondary institution in Colorado that is eligible for the college opportunity fund program created in section 23-18-201 shall use the unique student identifier assigned, in accordance with rules adopted pursuant to section 22-11-104, C.R.S., to the student while he or she was enrolled in the elementary to secondary public education system, including public prekindergarten programs, as an alternative student identifier at the postsecondary institution.

(b) Adams state university, Colorado Mesa university, Western state Colorado university, and Metropolitan state university of Denver shall implement the provisions of paragraph (a) of this subsection (4) on or before July 1, 2008. All other postsecondary institutions shall implement the provisions of paragraph (a) of this subsection (4) on or before July 1, 2009.