This information is so detailed it's difficult, but a lot of it seems like 'common sense' and I will always err on the side of caution - asking for written consent. 

This is very similar to HIPAA rules and regulations in order to protect information. Seems it would be best to always inform the student and get written consent before disclosing information. 

An institution has 45 days to respond to a records request.