I absolutely agree that private and especially sensitive information that could specifically identify and prove potentially injurious to students should not be disclosed. Despite any weakening of privacy laws, this sounds and is in fact criminal. Misappropriating information, especially information that could unfairly prejudice educational institutions and potential employers against a student is unethical.
I am a champion of education reform, including development of educational products that could improve student performance, but means of development of those products should not pose threat of harm to the very students that they’re supposedly designed to help. If the inBloomers are really serious about improving student performance, why not select a few schools to offer products that they’ve developed to improve academic performance, and without compromising student confidentiality. Seeing that any successes or failures of students utilizing their products would also demonstrate the effectiveness or ineffectiveness of their products, exposing any information that might demonstrate ineffectiveness would be bad for business.