Institution can access my email (inbox/sent items/etc) and edit it?
<p>First of all, I have thoroughly read the answers to the following questions and none of them answer my queries:</p>

<ul>
<li><a href="https://security.stackexchange.com/q/111544/199633">Can Google Chrome read/scan my ProtonMail inbox page?</a></li>
<li><a href="https://security.stackexchange.com/q/65766/199633">Can my IT department read my Google Hangouts chats while at work?</a></li>
<li><a href="https://security.stackexchange.com/q/67338/199633">Does company email can access hangouts and private emails?</a></li>
</ul>

<p>I am a student at one of the highest ranking universities of the UK (even though I avoid giving much credence to rankings). A couple of days ago, someone found a way to send emails to <strong>every single student</strong>, masquerading as the Vice Chancellor (the emails appeared to be from his own university email address).</p>

<p>The email body was basically a silly hoax, appearing to have been executed by teenagers ("<em>Dear students, just got off the phone with the prime minister, the University of [<strong><a href="https://www.southampton.ac.uk/" rel="nofollow noreferrer">censored</a></strong>] will close indefinitely, exams are cancelled, go out and party, etc</em>"). </p>

<p>The same day after a few hours, all the received emails had been deleted from all of our inboxes; a few people had replied to that email though and still had the original 'hoax' email. The next day, the email they had sent was deleted as well.</p>

<hr>

<p><strong>The University evidently has access to our email accounts, but</strong>:</p>

<ol>
<li>Are they allowed to Access/View/Edit out accounts? </li>
<li>Is this legal?</li>
<li>Do I have any say in it? As in, can I refuse using the University email for any type of correspondence and can I demand that they contact me only through my personal email address? If not, is there any way I can preserve my privacy?</li>
<li>If this was not disclosed clearly to any form of "Terms &amp; Conditions" that I agree to by studying here, then what are my rights?</li>
<li>Does GDPR have any effect here, or is the university allowed to do whatever they feel like?</li>
<li>What else do they possibly have access to?</li>
</ol>

<hr>

<p>The university uses Office365 (Outlook).</p>

<blockquote>
  <p>If this was not disclosed clearly to any form of "Terms &amp; Conditions"
  that I agree to by studying here...</p>
</blockquote>

<p>It was absolutely disclosed; read the contract(s) you (or your parents signed, depending on your age) for admission and to enroll and to take classes. You signed and agreed to the IT usage policies, which will include an email account and any monitoring the U chooses to do.</p>

<p>If you don't like the terms and conditions, you have no recourse other than to opt out of the contract by resigning from the U.</p>

<h2>Your email: no. But this is the University’s email</h2>
<p>You say they use Microsoft Office 365. When you signed up, you signed up to the ToS which are clear that this is a <em>corporate</em> email account that belongs to the University.</p>
<blockquote>
<ol>
<li>Are they allowed to Access/View/Edit out accounts?</li>
</ol>
</blockquote>
<p>Yes</p>
<blockquote>
<ol start="2">
<li>Is this legal?</li>
</ol>
</blockquote>
<p>Yes</p>
<blockquote>
<ol start="3">
<li>Do I have any say in it? As in, can I refuse using the University email for any type of correspondence and can I demand that they contact me only through my personal email address? If not, is there any way I can preserve my privacy?</li>
</ol>
</blockquote>
<p>Yes, you can stop sending emails through this account. However, the University is free to not respond to emails sent from other accounts. As always, if you want to maintain your privacy, don’t put private things on the internet and particularly not through an account you don’t own. Use this account for what it was intended for - correspondence in your role as a university student and use a private account for everything else.</p>
<blockquote>
<ol start="4">
<li>If this was not disclosed clearly to any form of &quot;Terms &amp; Conditions&quot; that I agree to by studying here, then what are my rights?</li>
</ol>
</blockquote>
<p>It was, move along, nothing to see here.</p>
<blockquote>
<ol start="5">
<li>Does GDPR have any effect here, or is the university allowed to do whatever they feel like?</li>
</ol>
</blockquote>
<p>Of course the GDPR applies, however, the University has a pretty clear legitimate interest so I can’t see any obvious breach of GDPR. GDPR is not a panacea for people who don’t read what they agree to. Remember, you are not a member of the public here; you are affiliated with the University.</p>
<blockquote>
<ol start="6">
<li>What else do they possibly have access to?</li>
</ol>
</blockquote>
<p>Your user profile. Anything you stored through that account on OneDrive or Sharepoint. If you downloaded Office software through the account, they would know which ones. When, how long and where you logged on.</p>

united-kingdom contract-law privacy gdpr consent