The University of Melbourne breached Victoria’s Privacy and Data Protection Act when it used its wifi network to monitor students and staff taking part in a pro-Palestine protest last May, the state’s deputy information commissioner has found. The investigation, released on Wednesday, was prompted by media reports alleging the university had digitally tracked people at a sit-in to uncover potential misconduct.
The deputy commissioner found the university used wifi location data, student card photographs and CCTV footage to identify 22 students who failed to comply with orders to leave the Arts West building on 20 May. The university did not give adequate notice or justification for how the data would be used. It took less than a day to authorise the surveillance, with only ‘superficial’ consideration given to privacy protection.
The report also found the university accessed ten staff email accounts to identify staff involved in the protest, resulting in three formal written warnings. Misconduct proceedings were brought against 20 students, with 19 receiving a reprimand and caution. The deputy commissioner said the surveillance was ‘antithetical to human rights’ and the breach was serious, though she did not issue a compliance notice due to remedial steps already taken by the university.
University chief operating officer Katerina Kapobassis acknowledged it could have provided ‘clearer active notice’ but maintained the use of wifi data was reasonable and proportionate for safety. The Unimelb for Palestine group called the findings a ‘deeply disappointing’ lack of accountability, saying the report exposed ‘deep structural failures’ in data governance and respect for human rights.
