Student Privacy Statement
Our students are important to us. We need to stay in touch with you and ensure that the information we hold about you is accurate and current. We ask that you please keep this updated during your studies and engagement with us. Your personal information will be managed in accordance with our obligations.
The University of Melbourne is governed by the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) when processing your personal and health information. To the extent that they apply to our activities, the University is also subject to the requirements of the Privacy Act 1988 (Cth) and the European Union General Data Protection Regulation 2016/679 (which relates to individuals located in the European Economic Area). (Together, ‘Privacy Laws’).
For the purposes of this statement, health and personal information are referred to collectively as “personal information” (sometimes known as “personal data”), which is defined broadly in the Privacy Laws as recorded information or opinion that relates to an identified or identifiable individual.
The “processing" of personal information refers to all activities relating to the management of personal information by the University, from its collection and use, through to its storage and disposal, and everything in between.
We are committed to protecting your privacy and processing your personal information fairly and lawfully in compliance with the Privacy Laws as applicable.
The University collects and processes the personal information of students at enrolment and throughout their studies and engagement with the University, as part of their student record and for a number of other purposes related to this engagement.
The University collects and processes students’ personal information through lawful and fair means and in a non-intrusive way. We will collect this information directly from the student wherever possible. For instance, you provide us with information when completing enrolment forms, or course applications, when providing supporting documentation, and when entering data directly into student systems.
Personal information processed may include:
- name, date of birth and home address;
- details of prior qualifications;
- course/s studied;
- fee payments, financial aid, and scholarships information;
- citizenship and or visa status;
- information about your academic progress and standing, examinations, assessments, results, and details of practical and clinical placements (if applicable);
- any assigned student numbers (unique identifiers);
- Tax File Number and financial institution information, for the purposes of fees and financial support programs (if applicable);
- details of any disciplinary or conduct matters; or
- other information relevant to your enrolment and education, to facilitate appropriate academic and student services.
In some instances, the University may collect students' personal information indirectly for specific purposes, where direct collection is not practicable. Such purposes include:
- the collection of data via the University's wireless network "UniWireless" for the purposes of space utilisation and campus management, and to develop and refine student services and support; and
- the collection of data from the University's Learning Management System (LMS), Library Services, and other student information and relationship systems, to enable analytics for reporting purposes, such as academic performance and student progress, and to improve student support and service provision.
When individuals access academic and non-academic facilities and services that we offer, the University may also process personal information classed as sensitive or special category data (for example, when you access our health services or student support services), which require additional protections under the law. For certain courses of study, other types of sensitive information or special category data may also be processed by us, such as information about past criminal convictions, working with children or vulnerable adults, and fitness to practise in certain regulated professions. Access to, and the sharing of, this type of information is carefully controlled, and it is processed in compliance with our legislative obligations. You will be given details about our collection and management of such information at the time that we collect it from you.
If you register for events, campus tours, newsletters or are a supporter of, or a volunteer at, the University, we will hold the personal information provided by you during your interactions with us. You may also provide us with your personal information when you agree to participate in user experience research or provide other feedback. This is explained in the relevant privacy collection notices specific to those activities.
Where you provide the University with the personal information of others (such as details of your emergency contacts) you are encouraged to inform those parties whose information you provide that:
- you are disclosing that information to the University;
- the information will be retained in accordance with relevant University policies; and
- and that they can access that information by contacting student services.
Most of the personal information we hold is information that you have provided to the University. We only process personal information for specified purposes and in accordance with the Privacy Laws as relevant.
In general terms, we process your personal information to establish and maintain student entitlements and obligations as part of your enrolment and study with the University, and to help us engage with you and improve your experience with the University.
The personal information processed by us, or on our behalf, is necessary to properly administer a student’s course/s of study, provide and administer relevant health and student support services, to facilitate internal and strategic planning requirements (such as providing appropriate infrastructure and sustainable resources), and for government reporting purposes relating to the provision of education.
Your personal information may also be used for the purposes of benchmarking, analysis, quality assurance and planning, and to ensure that we can provide you with the services and information requested by you.
We also process personal information for the following purposes:
- individual faculties collect and process personal information to administer courses and programs;
- the personal information of graduates is provided to the University's Advancement Office for the purpose of fostering alumni relationships, maintaining and facilitating alumni networks, and promoting University activities;
- the collection of students' personal information is required under Commonwealth and State Government legislation for the purposes of government reporting and for the administration of, but not limited to, the Higher Education Loan Program (HELP) and the Youth Allowance (Austudy and ABSTUDY); and
- the University provides limited personal information of sample students to the Department of Education, Skills and Employment (DESE), or its authorised representatives, to administer the Quality Indicators for Learning and Teaching (QILT) suite of surveys under the Higher Education Support Act 2003 (Cth). This research is aimed at improving higher education, quality assurance and planning.
The lawful basis for the University processing the personal information of students is that it is necessary:
- to establish and maintain students' entitlements and obligations and to properly administer students’ course/s of study, as part of their enrolment with the University;
- to meet and facilitate internal and strategic planning requirements, such as providing appropriate infrastructure and sustainable resources, and meeting public health requirements;
- to provide and administer relevant health and student support services;
- to fulfil and monitor our responsibilities to comply with legislative reporting requirements;
- for government reporting purposes relating to the provision of education; and
- very occasionally, when it is needed to protect your or another person’s vital interests and you are not capable of giving your consent (for example, in an emergency).
In some circumstances we will need to obtain your consent for specific use of your personal information not covered by this statement, or where that personal information includes sensitive information or special category data. For example, if, because of a disability, we need to make reasonable adjustments for you, or when you access our health or student support services. You can withdraw your consent to our specific use of such information at any time.
If you choose not to provide your personal information, the University may not be able to enrol you, provide you with your course of study, or provide you with the specific information, assistance, facilities or services that you have requested, and it may limit opportunities available to you.
The Office of the Provost is responsible for maintaining the information of currently enrolled students.
The University will only use or disclose your personal information under the following circumstances:
- for the purpose for which it was collected;
- for a related purpose which you might reasonably expect;
- where you have consented (provided your permission) to this;
- if we are required or permitted to do so by law; or
- where we have engaged a contracted service provider or partner to perform legitimate functions on our behalf, such as those outlined in this statement.
The University will not disclose personal information it holds about you, including results, addresses or other information, to your relatives (including parents or spouse) without your explicit consent unless required or permitted to do so by law. The University may engage with you to determine the validity and appropriateness of such consent before accepting it. The University will not confirm that you are, or have been, a student at the University, except as outlined in this statement, unless you have a record of graduation, as that is a public document.
The following examples are instances where the University will use and disclose your personal information for legitimate purposes:
- providing information to Services Australia (formerly the Department of Human Services) (e.g. Centrelink);
- releasing statistical or participation information to relevant government bodies such as the Department of Education, Skills and Employment (DESE), or third parties acting on their behalf;
- releasing relevant information to the Department of Home Affairs, DESE, and the Australian Taxation Office (ATO);
- providing DESE with the information required to support and report on Commonwealth assistance schemes (Commonwealth Supported Place (CSP) and/or HELP loan), including the Unique Student Identifiers (USI) we collect from eligible students;
- releasing relevant information to the Department of Foreign Affairs and Trade (DFAT) and other external parties engaged by the University to provide services under the Australia Awards Scholarship program (such as the University's preferred travel agency and health insurance provider) for the administration of Australia Awards Scholarships;
- providing information for law enforcement purposes where required or permitted by law;
- space utilisation and campus management purposes, and developing or refining services offered by the University;
- releasing to another tertiary institution or tertiary admission centre information about your academic progress at this University and any Government funded research training entitlement, where relevant, if you apply to transfer studies;
- providing a list of enrolled students to the returning officer or other appointed electoral bodies to enable students who wish to vote at elections for student organisations to be able to do so (but not for the purpose of contacting students for marketing or promotional purposes);
- providing relevant personal information to external companies or individuals that have been engaged under legal contract to perform some of the University's functions such as student surveys or academic services;
- exchanging relevant personal information and context between appropriate academic and student services staff for the purpose of offering and providing student support services;
- releasing the names of recipients of prizes, scholarships or similar awards to the respective official student sponsors or scholarship providers;
- releasing examination results and academic and administrative information to another institution where the student is enrolled under an official student exchange, cross-institutional study, dual degree, shared teaching, industry or clinical experience or multi-institutional arrangement with that institution to facilitate the collaboration or arrangement;
- when you graduate, providing relevant information to the University’s Advancement Office so that you can be contacted about services for University alumni;
- to maintain academic integrity and assist authorised staff in investigating any potential breaches, in accordance with the Student Academic Integrity Policy;
- providing information in response to a subpoena, summons or other written demand from a government department or authority, or a court or tribunal with the power to demand the information; or
- where it is necessary to protect a student or someone else from a serious and imminent threat to their life or health
Where personal information is disclosed to third parties, it will be done so only to the extent necessary to fulfil the purpose of such disclosure. Wherever possible, we ensure appropriate information sharing practices and/or processing agreements are in place, as necessary, before sharing your personal information with any third parties.
Where appropriate, examples of third parties the University provides personal information to and for what purposes are captured in privacy collection notices specific to particular activities, which are provided to you at the time your personal information is collected (or as soon as reasonably possible thereafter).
The University takes great care to ensure that personal information is handled, stored and disposed of confidentially and securely. Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats. This includes databases that are shared across the University. Accordingly, your personal information is not segregated or treated differently from any other personal information based on your geographic location or jurisdiction.
Our staff receive regular privacy and data protection training, and the University has implemented organisational and technical measures so that personal information is processed in accordance with the Privacy Laws as applicable.
We take all reasonable steps to ensure that any personal information we (or third parties operating on our behalf) collect, transmit, store or otherwise process, is accurate and complete, and that appropriate technical and organisational measures are implemented and maintained to protect it from accidental or unlawful destruction, misuse, loss, alteration, or unauthorised access or disclosure.
Access to your personal information is limited to authorised University staff and contracted third parties, or affiliates' representatives, who have a legitimate interest in it for the purpose of carrying out necessary duties. In some instances, your personal information may be transferred outside of Victoria or Australia, for example where our contracted service providers are not located in Victoria, or to facilitate your participation in an exchange visit, or to report to an overseas funding provider. We take all reasonable steps to ensure that the interstate or overseas transfer of personal information is in accordance with this privacy statement, relevant University policies, and the Privacy Laws, as applicable.
Where appropriate, examples of third parties the University provides personal information to, and for what purposes, are captured in more detailed privacy collection notices provided to you at the time your personal information is collected for that purpose.
Your academic record is retained indefinitely so that the details of your academic achievements can be confirmed and for statistical or historical research purposes. Once your personal information is no longer required for the purpose it was collected, and in accordance with our other legislative obligations, it is securely destroyed in compliance with the University’s retention and disposal authority.
You may request access to, or correction of, your personal information we hold, or exercise your individual rights as applicable, unless providing you with access would have an unreasonable impact on the privacy of others or would contravene the University’s other legislative obligations.
In many instances you will be able to access and correct your personal information directly via the student portal or by contacting Student Services at Stop 1. Information obtained via course application or online enrolment, that is reported to the Commonwealth Government, can be viewed at my.unimelb.edu.au. If this information is incorrect, or needs to be updated, you will be able change it. Depending on the type of change, you can do this online or by contacting Stop 1.
For access to other personal information that the University holds about you, you should contact the department that holds the information in the first instance. In some circumstances, the department or area of the University that holds that information may need to liaise with the University's Legal and Risk area before determining whether they can provide the information directly to you.
At times, the University may require requests for access to or correction of personal information to be made in accordance with the Freedom of Information Act 1982 (Vic). Further information about this process is available on our Freedom of Information web page.
The University Secretary is the University's designated Privacy and Data Protection Officer (PDPO). The privacy team in Legal and Risk provide guidance on privacy obligations and responsibilities.
If you are dissatisfied with our response to a complaint, you may lodge a complaint with the applicable supervisory authority:
- Office of the Victorian Information Commissioner (in relation to personal information and/or sensitive information)
- Health Complaints Commissioner (in relation to health information)
- Office of the Australian Information Commissioner (to the extent that the Privacy Act 1988 (Cth) applies)
- Data Protection Authority (to the extent that GDPR applies)
The University periodically refines its privacy statements. The overall level of privacy protection is maintained when changes or inclusions are made. We will inform you of any substantive changes to this Privacy Statement, however, we may occasionally make changes without notice, particularly where there are changes in the relevant laws or we adopt new working practices.
We therefore encourage you to regularly review this statement for any updates. The most recent substantive changes were made 11 November 2020.