0

First of all, I have thoroughly read the answers to the following questions and none of them answer my queries:

I am a student at one of the highest ranking universities of the UK (even though I avoid giving much credence to rankings). A couple of days ago, someone found a way to send emails to every single student, masquerading as the Vice Chancellor (the emails appeared to be from his own university email address).

The email body was basically a silly hoax, appearing to have been executed by teenagers ("Dear students, just got off the phone with the prime minister, the University of [censored] will close indefinitely, exams are cancelled, go out and party, etc").

The same day after a few hours, all the received emails had been deleted from all of our inboxes; a few people had replied to that email though and still had the original 'hoax' email. The next day, the email they had sent was deleted as well.

The University evidently has access to our email accounts, but:

  1. Are they allowed to Access/View/Edit out accounts?
  2. Is this legal?
  3. Do I have any say in it? As in, can I refuse using the University email for any type of correspondence and can I demand that they contact me only through my personal email address? If not, is there any way I can preserve my privacy?
  4. If this was not disclosed clearly to any form of "Terms & Conditions" that I agree to by studying here, then what are my rights?
  5. Does GDPR have any effect here, or is the university allowed to do whatever they feel like?
  6. What else do they possibly have access to?

The university uses Office365 (Outlook).

Improve this question
1
  • Doesn't outlook contain a feature that lets you recall sent messages, i.e. delete them from other people's outlook inboxes? If that feature was used there never was any access to your email account in any GDPR-relevant sense.
    – amon
    Jan 20, 2020 at 19:43

2 Answers 2

Reset to default
2

Your email: no. But this is the University’s email

You say they use Microsoft Office 365. When you signed up, you signed up to the ToS which are clear that this is a corporate email account that belongs to the University.

  1. Are they allowed to Access/View/Edit out accounts?

Yes

  1. Is this legal?

Yes

  1. Do I have any say in it? As in, can I refuse using the University email for any type of correspondence and can I demand that they contact me only through my personal email address? If not, is there any way I can preserve my privacy?

Yes, you can stop sending emails through this account. However, the University is free to not respond to emails sent from other accounts. As always, if you want to maintain your privacy, don’t put private things on the internet and particularly not through an account you don’t own. Use this account for what it was intended for - correspondence in your role as a university student and use a private account for everything else.

  1. If this was not disclosed clearly to any form of "Terms & Conditions" that I agree to by studying here, then what are my rights?

It was, move along, nothing to see here.

  1. Does GDPR have any effect here, or is the university allowed to do whatever they feel like?

Of course the GDPR applies, however, the University has a pretty clear legitimate interest so I can’t see any obvious breach of GDPR. GDPR is not a panacea for people who don’t read what they agree to. Remember, you are not a member of the public here; you are affiliated with the University.

  1. What else do they possibly have access to?

Your user profile. Anything you stored through that account on OneDrive or Sharepoint. If you downloaded Office software through the account, they would know which ones. When, how long and where you logged on.

Improve this answer
4
  • Thank you for this answer. However, (just a personal point of view) when you say "[...] you signed up to the ToS which are clear [...]", I'm going to have to disagree on the context of the word 'clear' :)
    – Soutzikevich
    Jan 20, 2020 at 20:28
  • 1
    You signed them - that legally means you understood them. You surely didn’t sign something you didn’t understand (or even read)? Anyway, the law doesn’t care if they were clear to you, only if they were clear to a reasonable person who read them, took the time (and sought legal advice if necessary) to understand them. It’s each persons legal duty to understand the commitments they make.
    – Dale M ♦
    Jan 20, 2020 at 20:31
  • Absolutely, I'm not debating any of the points you've made. You've helped me comprehend how corporate emails differ from personal email. My understanding up to now, was that the University email account, was just another personal email account, which also facilitates authentication and access control purposes (necessary productivity tools/services/etc). Never have I thought that they could access and modify anything they wanted
    – Soutzikevich
    Jan 20, 2020 at 20:35
  • 2
    Fair enough, a lot of people are surprised when they find this out about their work email - particularly if it gets them fired.
    – Dale M ♦
    Jan 20, 2020 at 20:38
2

If this was not disclosed clearly to any form of "Terms & Conditions" that I agree to by studying here...

It was absolutely disclosed; read the contract(s) you (or your parents signed, depending on your age) for admission and to enroll and to take classes. You signed and agreed to the IT usage policies, which will include an email account and any monitoring the U chooses to do.

If you don't like the terms and conditions, you have no recourse other than to opt out of the contract by resigning from the U.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .