Strictly speaking data protection law treats parents of adult students as third parties and so the information provided to them should be considered on that basis.
The Data Protection Act 1998 states that processing of personal data must be done in accordance with the eight DP principles and also one of the schedule 2 conditions. The most likely schedule 2 conditions which might apply in this situation are either (1) consent of the data subject or (2) legitimate interest of the data controller. We would expect that for DP purposes, the amount of a student's personal debt falls within the definition of personal information.
Consent
It is doubtful whether a university as data controller can routinely assume that where a third party has obtained the student ID number/invoice that consent has been given by the student to disclosure. However, if the third party is in possession of an invoice and the payment process discloses no personal data - merely accepts payment against an invoice, it may be difficult to see where DP applies. A second example perhaps better illustrates the problem which could arise (albeit hopefully in the minority of cases) - is where a parent accidentally opens a reminder letter addressed to the student and decides to check (and pay) the outstanding debt. He is under the impression that perhaps only £20 is due as funds had previously been provided to the student to make the payment, but learns that £2000 is outstanding. It is clear that personal information has been divulged and probably against the wishes or expectation of the student. On this basis, returning to the first example above, it may also be arguable that accepting the payment in the first place confirms the amount outstanding.
Legitimate interest
It is likely that it is in the legitimate interest of a university to collect its outstanding fees, but it may be doubtful whether this would outweigh the interests of the data subject in not having his personal data disclosed by the university.
Thus it seems to us that despite the fact that in most cases divulging the information is likely to be extremely advantageous and not a problem to the data subject, consent is required (perhaps incorporated into fees/payment information supplied to students) in terms of DP law to release this information to a third party to whom there is no obligation in law to otherwise release.