This is already the law, but the shell company signs the ownership of the data and the security responsility. The university in this case is just using APIs to load and store stuff to someone else's servers.

If this is not possible no cloud storage would ever be possible to be liable for anything. Your Google drive got hacked? Your responsibility.