I guess main the problem is the secrecy. Even the article is unable to say exactly what information the app has, and who has access to it—they mention safeguarding leads being the users, but then talk about how "schools" get notified when a student has an encounter with the police. Does this information get sent only to qualified professionals with clear accountability, or does it get sent to a shared email address that the administrators' receptionist reads?

The secretive approach to this is unsettling, because it implies they know they're doing something they'd get in trouble for. It sounds like the administration's response was "well, this app was public, parents could have read up on it if they wanted", which resembles the old better to ask forgiveness than permission tactic. Clearly, every part of this plan should have been proactively explained to parents beforehand.