Correct!

That is a violation of the privacy rule because it is inappropriate for students to have access to other students' information.

General Rule: You cannot leave personally identifiable materials in a public place.