The University of Melbourne has been found in breach of students’ privacy after campus Wi-Fi was used to track students and bring disciplinary action against student protesters, according to a report by the Deputy Commissioner of the Office of the Victorian Information Commissioner (OVIC).  

The investigation opened in July 2024, responding to use of CCTV and Wi-Fi to track student movements during the pro-Palestine Arts West/Mahmoud’s Hall sit-in. Additionally, student card photographs and ten staff members’ emails were used to identify and reprimand protesters. 

The function creep perpetrated by the University was described as “serious” and “antithetical to human rights” by OVIC and multiple Information Privacy Principles (IPP’s) were broken in their activities. IPP’s are “the core of privacy law in Victoria” and outline standard practices for how public sector organisations manage personal information under their radar.  

The breaches were found as OVIC sought to determine whether the University “properly informed students and staff about how their personal information would be used” and whether the use of collected data was “consistent with the primary purpose of collecting this information or was for an authorised secondary purpose”. 

Despite a violation against students’ privacy outlined in the report, OVIC did not conclude that any breaches were committed in relation to the use of staff email accounts for tracking.  

The University of Melbourne has responded to the report, with Vice-President and Chief Operating Officer, Katerina Kapobassis, maintaining that the University “was reasonable and proportionate” in their use of student data, yet have “cooperated openly and responsively” with OVIC’s investigation. Kapobassis states that the University acted appropriately “given the overriding need to keep [the] community safe”. 

In response to the investigation findings, the University of Melbourne has updated its UniWireless terms of use to explicitly outline the potential use of student data for location-tracking purposes. The report also requires the University to create a separate “Surveillance Policy” to aid transparency for students and staff.  

In short, the capabilities of the University to use Wi-Fi data to track students and faculty will remain unchanged following the investigation. 

Since the updates to the UniWireless Terms of Use, UMSU has fielded a significant number of enquiries from concerned students. 

“Some students worry for example, that just being near a protest may see them caught up in the university’s surveillance,” UMSU shared in a statement on their website. 

This worry may be unlikely to shift as the University is not bound by a compliance notice to make changes to its policies within a specified window. The Deputy Commissioner ruled not to issue a compliance notice following the University of Melbourne’s adoption of the new “Surveillance Policy”, a decision described by student protest group U4P as “deeply disappointing”.