I would also get a hold of the formal written policy they should have created around this new policy, especially since this is a privacy issue.

Read through to see if there are any loop holes, eg, this policy does not apply to individuals in certain positions or does not apply if you have not been issued a company device.

Generally, you can’t launch these kind of new rules across an organization without multiple levels of signatures and a formal publication. All of this is typically formal because it’s generally used to terminate people when they violate a policy. If there’s no standard, that means there is subjectivity. Subjectivity means they’re opening themselves up to lawsuits.

If they’re asking you to comply with whatever, ask them for the written policy. If they don’t have one, I would check whatever governing statutes applicable for this presumably state university and see if they are mandated to write policies. If they are, and they haven’t, they’re technically in violation of state law. If it’s a private university, I would see if they have any other policies related, such as how they handle issuing new policies.