I'm going to tell you a secret, data protection law only exists on paper.

I'm a senior developer at a large Brazilian private university and all student data is visible to anyone in the area, including the newly hired intern. We do not delete records even with request. I particularly take care of the financial part and I have access to all data, I mean all. It's bizarre!