Your answer is CORRECT!
If any non-directory information is included in the letter of recommendation, the student’s written permission is required. Grades and class rank are not directory information. Personal observations about the student are acceptable comments for inclusion without the student’s permission.
General principle:
Specific written consent is required to disclose personal academic information to a third party.