University of Melbourne found to be in breach of privacy laws amid student protests

A state investigation has found The University of Melbourne breached Victoria’s Privacy and Data Protection Act 2014 when it used its wi-fi network to identify students involved in a Pro-Palestine protest last May.

According to a report released in August by the Office of Victorian Information Commission (OVIC) The University of Melbourne (UoM) violated two key privacy principles when the organisation failed to give adequate notice or justification for how students data would be collected and used.

The breach involved a combination of wi-fi location data, student card photographs and CCTV footage to identify 20 students who failed to comply with orders to leave the university’s Arts West building last May.

Disciplinary action by the university was taken against all 20 students, with 19 receiving a reprimand and caution.

Staff email was also accessed during the disciplinary procedures. Although this did not breach privacy laws, it “fell below the standards” expected.

“Because the collection and use of the data involved the surveillance of students and staff, and surveillance by its nature is antithetical to human rights, the breach was serious,” the report found, adding the university failed to obtain social licence to use this technology.

Since the report was published, the university amended both its rules guiding how information is handled, and its collection notice for personal data.

According to vice-president and chief operating officer at University of Melbourne Katerina Kapobassis, all other proposed steps to increase protection of student and staffs’ data made in the final report were “progressing,” with the institution “[ensuring] the university community is kept informed as these changes are made.”

Due to what the report calls “remedial steps,” with “remaining ones to be completed soon,” the deputy commissioner did not issue a compliance notice.

The investigation was prompted by media reports in July 2024 revealing the university had tracked students who ignored the vice-chancellors’ instructions to vacate the Arts West Building on the Parkville campus during a sit-in pro-Palestine protest last May.

According to OVIC's report, some demonstrators ignored the direction, resulting in the university starting an investigation into potential student misconduct.

Ms Kapobassis acknowledged the institution “could have provided clearer active notice in relation to use of wi-fi data” but defended the actions as “reasonable and proportionate, given the overriding need to keep our community safe and conduct our core activities of teaching, learning and research.”

“The University takes its privacy obligations seriously and has cooperated openly and responsively to the Deputy Commissioner in the conduct of her investigation,” Ms Kapobassis said. •