It wasn’t so long ago that I made a confession. In response to a phone call from a prospective employer of one of our students, I disclosed nondirectory information without obtaining the student's written consent first. And although FERPA required the student's written consent for me to disclose, the circumstances justified my disclosure. The student got the job. And later, the student thanked me for what I had done.
Richard Rainsberger (Wed,) studied this question.