It is a massive FERPA violation, according to the the following from a student privacy organization:

https://studentprivacycompass.org/pasco/