On the privacy matter, I am sure that there are some colleges and universities that do engage in such sales. The question of whether that sort of material should be restricted is in flux, but the general practice seems to be to treat it as if it is not protected. The law, when it is confronted with a new paradigm, looks first to see what the community expects and accepts and then translates those expectations and pronouncements into something normative. Thus, unless a group with particular interests and sufficient power manages to usurp that translation with legislation, the community’s expectations win out.
When we think about what the “law” is today and will be tomorrow with respect to privacy of personal data – such as addresses etc., I think it is clear that our postmodern society has a different set of expectations than those held by those of us who grew up in the waning days of modernity. The sum, I think, is that we will continue to see lesser degrees of protection for personal data than we have in the past. Despite the present difference, I think we will see the same sort of progression in both the United States and Europe