Having worked in higher ed for a number of years, I'm frankly surprised that this doesn't happen more often. At least, to the level of being reported like this.

Faculties regularly operate independently and have their own ideas about the proper way to secure the information they have access to (which, in some cases, is not at all). As a security representative in the central IT department, I was often tasked with finding, reporting and attempting to work with the various faculties that did not follow posted data access and privacy policies but, almost every time my efforts were superseded by "academic freedom".

Incredibly frustrating experience.