Investigation into the use of surveillance by the University of Melbourne
In July 2024, the Privacy and Data Protection Deputy Commissioner commenced preliminary inquiries into the University of Melbourne’s tracking of students involved in a sit-in protest, and whether the University complied with the Information Privacy Principles (IPPs) as outlined in the Privacy and Data Protection Act 2014. Given her concerns specifically relating to the use of Wi-Fi location data, the Deputy Commissioner commenced an investigation under section 8C(2)(e) of the PDP Act in August 2024.
The Deputy Commissioner found that the University failed to take reasonable steps to make individuals aware of the purposes for which their Wi-Fi location data was collected and may be used, in contravention of IPP 1.3.
In terms of IPP 2.1, the Deputy Commissioner found that the University’s investigation of misconduct was not a primary purpose of collecting Wi-Fi location data, and that using the Wi-Fi location data to identify individuals was not for a related secondary purpose that individuals would have reasonably expected.
Based on the University’s improvements to its policies and practices during the course of the investigation, the Deputy Commissioner decided it was not necessary to issue a compliance notice.
