The College Board is licensing the personal data of students taking the SAT to colleges

I know this is legal and caveat emptor and all that, but I don’t see how any college could view this as “best practices.”