Disclaimer: Discussion of IRB’s and human subjects research ahead, so delete now! 
I think this is an interesting read. For our research in TLT, we have to consider the questions we want to answer and the minimum amount of private data we need to answer those questions. We have no research study in place that simply allows us to download and use the entire students records database.
I think the discussion of the Common Rule is very timely because the federal government is considering a revision to better allow some researchers (like those in education) to be able to study educational practices. I’m really looking forward to the changes.
But the author’s interpretation of the Common Rule protecting human subjects is not as nuanced as it could be. First, there are many research studies that use de-identified data (like the CIC Learning Analytics project that we use to study TILE courses and the downstream outcomes of TILE students) for which we are not required to consent students. If there is no possibility that the record can be connected to a student, we can often classify these studies as exempt from full board review and not have to obtain informed consent. You could argue that a lot of analytics research can be carried out with de-identified data sets that pose less of a risk to students (and indeed the IRB smiles upon such research designs).
Some schools are much more permissive when it comes to using student records for research purposes. If you read a recent study of a learning analytics intervention by researchers at Michigan, you’ll note that the researchers were able to use data from students even though they had DECLINED to participate. This is because of the particular policies that govern research with student data at that institution. The Common Rule may inform institutions about how to oversee research with human subjects, but, in the end, the IRB has the final say.