The Family Education Rights and Privacy Act of 1974 requires that educational institutions including colleges keep non-directory educational records, including testing records such as SAT scores, confidential. Non-directory records may only be released with the student's written consent, except to a minor student's parent with proper documentation.
Under FERPA, even the administrators of the SAT, the College Board, can't release a student's test scores to anyone other than the student without prior written permission. For this reason, the College Board requires students to enter the codes of the schools to which they want their scores sent. People viewing non-directory educational records must have a legitimate educational interest.