FERPA is the big one.http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html
FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31): ... - Organizations conducting certain studies for or on behalf of the school; - Accrediting organizations;
And additionally:
Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.