The University of Melbourne (UoM) breached Victoria’s Privacy and Data Protection Act when it used its wifi network to surveil students and staff holding a pro-Palestine protest last May, which could have resulted in a “significant breach of trust”, the state’s deputy information commissioner has found.
The investigation, released on Wednesday, was prompted by media reports alleging UoM digitally tracked people at the sit-in to uncover potential misconduct.
The deputy commissioner found the university used a combination of wifi location data, student card photographs and CCTV footage to identify 22 students who failed to comply with orders to leave the university’s Arts West building on 20 May. The investigation found the university did not give adequate notice or justification for how the data would be used.
Sign up: AU Breaking News email
It took less than a day for the university to authorise the use of data for surveillance purposes and only “superficial” consideration was given to privacy protection, the report found.
The UoM used analysis of wifi location data, CCTV footage, and a review of 10 staff members’ email accounts to identify staff involved in the protest, the report found. As a result, three staff members received formal written warnings.
Misconduct proceedings were brought against 20 of the students, with 19 receiving a “reprimand and caution”.
The deputy commissioner found the UoM had not contravened information privacy principles (IPPs) in the state’s Privacy and Data Protection Act with its CCTV footage use.
But it found the UoM had breached two IPPs by failing to adequately inform students and staff about how their personal information had been used, and because using wifi location data to identify individuals in a misconduct investigation was an unauthorised reason.
It also found that the university’s accessing of staff email accounts for disciplinary proceedings “fell below the standard” expected.
“The university failed to obtain a social licence for the use of this technology,” the report found. “Because the collection and use of the data involved the surveillance of students and staff, and surveillance by its nature is antithetical to human rights, the breach was serious.”
The deputy commissioner did not issue a compliance notice because of the remedial steps taken by the UoM during the investigation, including developing a new surveillance policy and amending its terms of use and associated policies.
The chief operating officer of the UoM, Katerina Kapobassis, said the university acknowledged it could have provided “clearer active notice” to students and staff about its use of wifi location data.
“However, we maintain that the use of Wi-Fi location data in student misconduct cases was reasonable and proportionate in the circumstances, given the overriding need to keep our community safe and conduct our core activities of teaching, learning and research,” she said.
“The university takes its privacy obligations seriously and has cooperated openly and responsively to the deputy commissioner in the conduct of her investigation.
“The university has already completed a number of actions that are proposed in the final report, and all others are progressing.”
The investigation also found the university’s wifi terms of use, IT policies and privacy statements were “poorly presented, contained misleading headings and titles, and contained information that made the purpose of collection and use unclear”.
“The extent of the impact on the individuals whose Wi-Fi location data was used to determine their physical whereabouts was significant,” the report found. “Each was subjected to a form of surveillance … They are likely to have experienced a significant breach of trust.
“The deputy commissioner remains concerned by the university’s practices … and will continue to seek evidence and assurance that it has completed the actions it has agreed to.”
The Unimelb for Palestine group welcomed the investigation’s findings, which it said exposed the “deep structural failures in how the university governs data, communicates … and respects fundamental human rights”.
The group said it found the decision not to issue a compliance notice “deeply disappointing”.
“The report does not undo the harm the university has inflicted – through both its past mishandling of misconduct proceedings against Mahmoud’s Hall [Arts West] protesters, and its ongoing efforts to expel and suspend other student protesters based on unauthorised and unlawfully obtained data,” the group said.
“So-called liberal institutions – including the UoM - have acted exceptionally to suppress solidarity with Palestine amidst a genocide.”
In April, the Human Rights Law Centre, Human Rights Watch and Amnesty International wrote to the UoM’s vice chancellor, citing serious concerns over its wifi policy, which they said permitted the surveillance of all users without suspicion of wrongdoing or misuse of the network.
Principal lawyer Berndaette Zaydan is appealing the suspensions and expulsions of UoM student protestors and said she would use the findings to strengthen their legal fight.
The UoM branch president of the National Tertiary Education Union, David Gonzalez, said the deputy commissioner had reinforced what staff had been saying “all along”, that “they were misusing this information, and it was wrong”.
“There was never an expectation that we would be tracked using Wi-Fi previously,” Gonzalez, who sat in on disciplinary proceedings with staff as a result of the protest, said.
“A large amount of my members are very concerned with their privacy. This is validating for a lot of people who felt gaslit … It’s just an erosion of trust.”
