Data protection: Melbourne University not allowed to track protesters via Wi-Fi

Last year, the University of Melbourne used Wi-Fi location data to identify students following protests. Now, a privacy commissioner in the Australian state of Victoria has found that the use of this data constituted an invasion of privacy.

The university used closed-circuit television (CCTV) footage and Wi-Fi location data to identify students. On the one hand, it was investigated whether the university had sufficiently informed students and employees about how their personal data – in the form of Wi-Fi location data and emails – was being used. Secondly, the question arose whether the use of data for identification purposes constituted an "authorized secondary purpose".

In July 2024, sit-ins took place at the University of Melbourne. The university told students to leave the building. Otherwise, the university threatened them with disciplinary measures such as suspension or reporting them to the police. 22 people remained seated.

Use of Wi-Fi location data counts as data misuse

The Information Commissioner found that the use of CCTV was not a breach of privacy, but the use of Wi-Fi location data was, as the university's policy was not detailed enough. The report says: “Given that individuals would not have been aware of why their Wi-Fi location data was collected and how it may be used, they could not exercise an informed choice as to whether to use the Wi-Fi network during the sit-in, and be aware of the possible consequences for doing so”.

During the course of the investigation, the University changed its policies regarding the use of location data, including secondary use. The Office of the Data Protection Commissioner therefore decided not to issue a formal request for compliance with the original rules. It will merely continue to check whether the university is fulfilling its obligations.

(mma)