Universities and students' unions have been warned that they risk breaching data protection laws if they disclose students' personal details to anti-terror police without a warrant.
The Federation of Student Islamic Societies (Fosis) claims that students' names, addresses and phone numbers have in the past been handed to police in the absence of a warrant.
In new guidance, it criticises the students' union at University College London for handing over the mobile phone numbers and email addresses of members of the Islamic Society and the Medical Islamic Society to the Metropolitan Police in January.
The force's counterterrorism command was investigating Umar Farouk Abdulmutallab, who is accused of attempting to blow up a passenger jet over Detroit in December 2009.
Mr Abdulmutallab, a Nigerian national, is a former president of UCL Union Islamic Society.
Fosis also claims that a university department gave out students' home addresses. It says consent was not sought from the individuals and the police did not produce a warrant.
The names of the students will now be stored on police databases for at least seven years.
Last month, the London Student newspaper carried an apology from James Hodgson, student activities officer for the UCL students' union, for the "mistakes made".
The National Union of Students told students' unions in January that if they receive a request for information from the police, they should ask for the request to be made in writing and take legal advice before responding.