Yes and no. Essentially with prospective employers, I think it works this way:
Prospective employers do sometimes ring up universities to confirm records like transcripts and testamurs. What they are effectively doing is not asking about a student's information (which would be a violation of privacy laws, I would assume) but actually confirming the authenticity of a document (which is legal). Ie you're not saying "Did James get x marks with y degree?", but you're saying "I have a document which said that James got x marks with y degree, can you confirm this is an accurate, official university document?"
If you ring up a uni without a record, though, they won't give you anything, but rather suggest that you get a transcript/testamur from the student, which you can then confirm yourself (based on the fact that they're usually difficult to forge) or ring up to confirm.