The use of the act remains voluntary. It is to facilitate the exchange of information.
As for protection, the act stipulates that the agency providing the information must make sure that the information is relevant to the recipient institution's jurisdiction.