A Melbourne university that violated student privacy by using location data to track students over Gaza protests will continue to use the technology in future misconduct cases.
The University of Melbourne committed a serious breach of legislative privacy principles when it used the location data of students connected to the institution’s internet network to identify those participating in a protest in May 2024, the state’s privacy authority said on Wednesday.
University of Melbourne students protest against the war in Gaza last year.Credit: Eamon Gallagher
But the university defended its conduct, arguing it had acted in the interests of campus safety.
The National Tertiary Education Union (NTEU) said the university acted like “Big Brother”, and students felt the watchdog didn’t go far enough.
The Age previously reported that students who faced suspension over the protest against the Gaza war had been emailed CCTV images of themselves inside the Arts West Building at the university’s Parkville campus during the multi-day sit-in.
Along with the stills were details of the students’ use of the campus Wi-Fi network, which the university said was evidence of alleged wrongdoing.
Privacy and Data Protection deputy commissioner Rachel Dixon found the university had introduced the tracking capability with the “reassurance it would not be used to surveil individuals”.
Dixon noted Melbourne had used the capability for disciplinary purposes without considering “the human rights or privacy impacts of doing so”.
The investigation into the use of the technology found the information within the university’s terms of use and other policies was “poorly presented, contained misleading headings and titles, and contained information that made the purpose of collection and use unclear”.
Staff emails were also accessed after the protests, which the deputy commissioner found happened “after the urgency of protest passed, and could have been dealt with more carefully”.
“The collection and use of the data involved the surveillance of students and staff, and surveillance by its nature is antithetical to human rights, the breach was serious,” Dixon wrote.
She found there were circumstances where the institution could have achieved the same outcomes with fewer impacts on privacy to those involved and those “incidentally caught up” in the inquiries.
“Surveillance of individuals should only ever be undertaken in the most serious of circumstances, where clear guidelines are available, authorising processes are well managed, and individuals understand the purpose and limitations of the use of the information.”
But the deputy commissioner did not issue a compliance notice, which would have forced the university to take action to ensure compliance with privacy provisions in a dedicated time frame.
A university spokesperson said a “new surveillance policy” we being developed, and Melbourne wanted to improve communication and enhance governance around data use.
“We are implementing changes to our policies and procedures, including a new surveillance policy that will be openly communicated to all staff and students.
“Our use of Wi-Fi location data was to investigate potential breaches of our rules or policies. These rules and policies strike a balance between rights to protest and the need to manage safety and other risks.”
In March 2025, updated IT terms of use were published detailing the Wi-Fi network could be used to detect, identify and investigate users, “including by using network data to infer the location of an individual via their connected device”. Wi-Fi data can also be used to investigate any unlawful or antisocial behaviour, or breach of university policy.
The university’s vice president Katerina Kapobassis said Melbourne could have provided clearer notice to students and staff in relation to the use of Wi-Fi location data, but she defended the move.
“We maintain that the use of Wi-Fi location data in student misconduct cases was reasonable and proportionate in the circumstances, given the overriding need to keep our community safe and conduct our core activities of teaching, learning and research,” she said in a statement published on the university’s website.
In an email sent in August included in the report, university vice chancellor Emma Johnston said the use of Wi-Fi location data was a “necessary part” of the investigation into potentially unlawful activity.
“The use of this technology in the circumstances was reasonably proportionate, given the limited personal information involved, the small number of people who had access to that information and the overriding need to keep our community safe and conduct our core activities of teaching, learning and research,” Johnston wrote.
NTEU national president Alison Barnes said university surveillance was a direct threat to academic freedom and the right to protest, dissent and debate.
“Universities should not be operating like Big Brother,” Barnes said in a statement.
“Universities must not quietly roll out surveillance programs and only tidy up their policies once caught out.”
She said it highlighted a chilling effect surveillance had on the right to protest, dissent and debate.
The university did not comment on whether it would be withdrawing reprimands against students as a result of the data use.
Activist group University Melbourne for Palestine said the decision to not issue a compliance notice was deeply disappointing, and said it was a missed opportunity.
“These breaches are not minor. They expose deep structural failures in how the university governs data, communicates with its community, and respects fundamental human rights,” the group said.
“But acknowledgement of these breaches alone does not equal accountability.”
The group said the report didn’t undo harm the university had inflicted, nor address the broader breach of trust between the institution, its students and staff.
“We strongly believe a compliance notice should have been issued – not just as a reprimand, but as a clear signal that institutions must be held accountable when they violate privacy laws.”
Start the day with a summary of the day’s most important and interesting stories, analysis and insights. Sign up for our Morning Edition newsletter.