You must get explicit consent from individuals before using their data in a publicly available document – whether electronic, in hard copy or online. For example, you can't make module registration lists publicly available on your departmental websites without first acquiring the students' permission.
Also, you must make the subject of the personal data (ie the student) aware as to where data will be used. The data should only be used for the purpose the student has mutually agreed with you.
It's important to remember that images can contain personal details, as well as text or other data relating to individuals.
Failure to seek permission could result in legal action being taken against the University, department or the person responsible for publishing the information and the University may also consider it a serious disciplinary matter.
In the case of web-based publications referring to students, you must restrict the information to University members so that it is not available in the public domain.