The "General Data Protection Regulation" (GDPR) is a strict data protection law that took effect in the European Union in 2018. Although it does not apply to the United States, it does apply to any company that targets or collects data about any person living in the EU, which includes many companies that also operate in the U.S.
The "Federal Educational Rights and Privacy Act" guarantees college students the right to access their educational record, and keeps "educational" records of the student confidential. It DOES allow schools to release "directory" information without consent; this includes name address, phone number, and awards, although students may opt out of this release.