Because they are part of the same institution, if it’s actually being used in the admission process, I don’t see where there would be legal problems. It might be more of a problem if they asked more specific questions. It’s been a few years since I’ve filed financial aid forms (both FAFSA and Profile), but there is probably a disclaimer allowing the financial aid office to share information with the admissions office. Otherwise, we wouldn’t have conversations about admission being need blind vs. need-aware at any schools