As I understand UPN, their intended use was for data matching, so exporting them for that purpose is legitimate. However they are a "blind identifier" so are not to be used in printed reports.
Just found the DfE guidance on this:
The UPN must be a ‘blind number’ not an automatic adjunct to a pupil’s name. It must be held electronically and only output when required to provide information to the LA, central government or another school/academy to which the pupil is transferring. Under the Data Protection Act 1998, the UPN is designated as a ‘general identifier’ making its use for any purpose unrelated to education illegal. A pupil’s admission number, rather than the UPN, should be used as the general pupil reference number on the admission register or paper files.
Full guidance is here. General advice is to use admission numbers to avoid illegal use of UPN.