My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not.
If I change the password, it sends a confirmation via email with both userid and password.
The portal has info on all students like birthdays, addresses, grades, etc. It also has information on school events, teacher addresses, etc.
This absolutely feels like they are breaking some rules, but inquiries to the IT Director at the school have not been returned. I plan to escalate but would like to be armed with specifics on true violations and/or risks.