Protect private data

[Isak-Kallini]

Description

After investigating #550, we discovered that the problem is larger than we thought. Currently anyone can access data that should be private, for example food preference and email (alumns can set a private email).
So we need to:

1. Decide what data should be private
2. Decide who should have access to it
3. Restrict access to it in some way, probably through access policies

Steps to reproduce

No response

Further information

No response