It depends. In general, a written release is recommended, not required, for letters sent to other educational institutions to which the student is applying and to professional school admission services. The release is required, however, when the recommendation is sent to an employer or to an individual for another purpose. (A release form is provided for your use; refer to the PDF at top of this page.)
Faculty may include information from personal observation or knowledge without the student's consent, but it is not acceptable for faculty to access a student's record to view grades/information from other classes and terms. If the recommendation will include non-directory/personally identifiable information (grades, GPA, class rank, etc.) obtained from the student’s academic record, you should obtain a signed release from the student. Releases should specify the information that may be disclosed, the identity of the party(ies) to whom the disclosure can be made, the student's signature and the date.