What your sister-in-law is going through is truly absurd! It's one thing for a company to visit your social media profile, but it's entirely different for them to have direct access to your phone! I’m not sure how the laws work in your country, but here in Brazil, that would easily result in a winning lawsuit.
Not all the school has this rule but some have this rule as it's awkward and can't tolerate it, i never give anyone my password