Correct!

FERPA states that you may not redisclose information without prior written consent.

General Rule: There are some occasions when this is allowable, such as release to organizations conducting educational studies, accrediting agencies, and judicial orders. Check with the Registrar before releasing information.