There is an assumption of privacy at universities; however, the university I worked for was subject to the public's open records requests. When requested, our IT department had to hand over the email of any employee (maybe student?). I believe this is a federal law (in the US).

Expanding on that concern, I wonder if online services allow IT departments to perform what is necessary for open records requests, or would that be a violation of TOS?