The sharing might not be a direct violation, but profiling the students for this purpose most likely is. They probably didn't sign up with something that said "

The sharing might not be a direct violation, but profiling the students for this purpose most likely is. They probably didn't sign up with something that said "you are being profiled with the purpose to share this information with the Government if you meet some arbitrary archetype"