I've owned a small business for a number of years now and struggle with the lack of info/what to tell on a regular basis.  As far as I know there is no specific law against giving info, but it comes from an abundance of caution/risk management to avoid any potential lawsuits for defamation/violation of employee confidentiality.  In today's litigious society fear of lawsuits, legitimate or not, drives a lot of employment policies.