Your college can - and will - hand over your personal details to anyone who asks, warns a researcher who is calling for better protection for students