I believe that it's fine if the university wants to regulate, for example, bandwidth access, but they should treat the students data as private data.