This is not about advertising or any kind of misuse of the data. Rather, IT's role is very much one where they they setup and maintain systems and procedures that process data. It's certainly true that GDPR compliance is something an IT person will have to think about, but making the same employee responsible for auditing that things are compliant is quite a bit of a conflict. Auditing versus accounting is a similar concept.
We're talking about a school here.
If a school has to say, "We can't appoint our IT-person, because they're also the one aggregating and profiling the data-profiles of our students for advertisers, so it would be a conflict of interest," that school has bigger problems than GDPR compliance.