Serious question: what aspects of student privacy can't be covered by "Access Control" mentioned above?

I could see a company doing something shady like collecting metrics on students across different types of classes to eventually sell to someone. I can't for the life of me understand why that kind of data would be valuable, but I'm sure someone could make use of student metrics for advertising purposes.

A company that creates discussions boards for courses is already doing that. They are called Piazza (https://piazza.com/) and used the student data they have been collecting to Piazza Careers: https://recruiting.piazza.com/

It has caused some heated discussions at our university regarding student privacy.

Yep, I used Piazza extensively in school. As a tool, it was actually pretty good and students used it heavily. Unfortunately when they shifted their focus to selling students to top companies it soured the taste in my mouth a bit.

I see a lot of positives in that system, but it feels like a way for companies to more easily ignore candidates who aren't from top schools. My concern would be further ostracizing qualified students who don't go to top schools.

Companies might want to look at data, but so long as they aren't bribing teachers into sharing data from private repos, what can they do?