Regulating Student Data Privacy: Don't Throw the Baby out with the Bathwater