The data belongs to the students and there was an agreement not to mine it; the complaint is that this agreement was ignored and the data was mined.

That kind of thing carries regulatory fines in EU. There may be a bit of culture clash happening in this thread between Europeans ("this is my data and you need my permission to use it") and SV ("this data is gathered by the company and it's theirs to do with what they wish")