I understand that opinion, but the opposite view is now conventional. Corporate/college directories are usually not available in public, but only with a local auth. Even if the scraping site restricted signups to local email addresses, the college is responsible for the distribution of its directory PII so could not allow this.

Leaking PII like this would be illegal in Canada for example.

I don't understand how the word "leaking" would apply here. Unless there was an unmentioned login wall for the directory he scraped, the site is mirroring the names and faces off of a much larger and already public site that nobody has said a single word in complaint of.