Student Privacy Statement
The University of Melbourne is governed by the Privacy and Data Protection Act 2014 (Vic), the Health Records Act 2001 (Vic), and to the extent that it applies to our activities, the Privacy Act 1988 (Cth) (together, Privacy Laws) when collecting and managing personal and health information (referred to collectively in this statement as personal information).
The University is also subject to the requirements of the European Union General Data Protection Regulation 2016/679 (GDPR) when it processes the personal information of individuals located in the European Union (EU) while undertaking certain activities.
"Personal information" is defined broadly in the Privacy Laws and GDPR as recorded information or opinion that relates to an identified or identifiable individual.
The University collects and processes personal information from a student at enrolment, and throughout their studies and engagement with the University, as part of their student record and for a number of purposes. Such purposes mainly relate to the proper administration of an individual's course of study at the University, the University's internal planning requirements, the administration of relevant health and welfare programs, and for government reporting.
Personal information collected and processed may include:
- your name, date of birth and home address
- details of prior qualifications
- course/s studied
- fee payments, and financial aid and scholarships
- information about your academic progress and standing, examinations, assessments, results, and details of practical and clinical placements (if applicable)
- your student number (unique identifier)
- Tax File Number and financial institution information, for the purposes of fees and financial support programs (if applicable)
- details of any disciplinary or conduct matters
- other information relevant to your enrolment and education, to facilitate appropriate academic and student services.
The University will collect the personal information of students lawfully and fairly and in a non- intrusive way. We will collect this information directly from the student wherever possible. For instance, you provide us with information when completing enrolment forms, or course applications, when providing supporting documentation, and when entering data directly into student systems.
However, the University may also collect students' personal information indirectly for specific purposes where direct collection is not practicable. Such purposes include:
- the collection of data via the University's wireless network "UniWireless" for the purposes of space utilisation and campus management, and to develop and refine student services and support; and
- the collection of data from the University's Learning Management System (LMS), Library Services, and other student information and relationship systems, to enable analytics for reporting purposes, such as academic performance and student progress, and to improve student support and service provision.
If you choose not to provide your personal information, the University may not be able to enrol you, provide you with your course of study, or provide you with the specific information, assistance, facilities or services that you have requested, and it may limit opportunities available to you.
In accessing academic and non-academic facilities and services that we offer, the University may also process personal information about you that is classed as sensitive or special category data (for example, when you access our health services or student welfare services), and which requires additional protections under the law. For certain courses of study, other types of sensitive information or special category data may also be processed by us, such as information about past criminal convictions, working with children or vulnerable adults, and your fitness to practise in certain regulated professions. Access to, and the sharing of, this type of information is carefully controlled.
You will be given details about our collection and management of such information at the time that we collect it from you.
Where you provide the University with the personal information of others (e.g. emergency contact details) you are encouraged to inform them that:
- you are disclosing that information to the University
- the information will be retained
- and that they can access that information by contacting student services
The primary purpose for collecting the information is to establish and maintain student entitlements and obligations as part of their enrolment, and to properly administer an individual's course of study.
Individual faculties collect personal information to administer courses and programs and to facilitate the teaching, learning and research functions of the University.
The personal information of graduates is provided to the University's Advancement Office for the purpose of fostering alumni relationships, maintaining and facilitating alumni networks, and promoting University activities.
Personal information is also collected to enable the University's internal and strategic planning, for example to provide student support and health and wellbeing programs, and to provide infrastructure and sustainable resources.
The collection of students' personal information is required under Commonwealth and State Government legislation for the purposes of government reporting and for the administration of, but not limited to, the Higher Education Loan Programme (HELP) and the Youth Allowance (Austudy and Abstudy). For example, the University provides limited personal information of sample students to the Department of Education or its authorised representatives to administer the Quality Indicators for Learning and Teaching (QILT) suite of surveys under the Higher Education Support Act 2003 (Cth). This research is aimed at improving higher education, quality assurance and planning.
The University manages personal information in a variety of electronic and paper forms in multiple University systems. Your personal information is treated the same as any other personal information, regardless of your geographic location or jurisdiction.
We take all reasonable steps to ensure that any personal information we (or third parties operating on our behalf) collect, transmit, store or otherwise process, is accurate and complete, and that appropriate technical and organisational measures are implemented and maintained to protect it from accidental or unlawful destruction, misuse, loss, alteration, or unauthorised access or disclosure.
Access to your personal data is limited to authorised University staff and contracted third parties, or affiliates' representatives, who have a legitimate interest in it for the purpose of carrying out their duties. In some instances, your personal information may be transferred outside of Victoria or Australia, for example where our contracted service providers are not located in Victoria, or to facilitate your participation in an exchange visit, or to report to an overseas funding provider. We take all reasonable steps to ensure that the interstate or overseas transfer of personal information is in accordance with this privacy statement, relevant University policies, and the Privacy Laws and GDPR requirements, as applicable.
Where appropriate, examples of third parties the University provides personal information to, and for what purposes, are captured in more detailed privacy collection notices provided to you at the time your personal information is collected for that purpose.
Your academic record is retained indefinitely so that the details of your academic achievements can be confirmed and for statistical or historical research purposes. Typically, other personal information we hold about you will only be retained for as long as it is required for the purpose it was collected and in accordance with our other legislative obligations. This information is then securely destroyed in accordance with the University's retention and disposal authority.
On course completion, and while you are still a student, your contact details will be passed to the Advancement Office to place you on the University's alumni database so that you can be informed of alumni news, events and activities. If you do not wish to be contacted as an alumni, please contact the Advancement Office at email@example.com.
The Office of the Provost is responsible for maintaining the information of currently enrolled students.
The lawful basis for the University collecting and otherwise processing the personal information of students is that it is necessary for the pursuit of the legitimate interests of the University. Specifically, to provide you with the course of study in which you are enrolled, and because it is necessary for the tasks we carry out in the public interest (such as teaching, learning and research).
The University will only use or disclose your personal information under the following circumstances:
- for the purpose for which it was collected
- for a related purpose which you might reasonably expect
- where you have consented (provided your permission) to do so
- if we are required or permitted to do so by law; or
- where we have engaged a contracted service provider or partner to perform legitimate functions on our behalf, such as those outlined in this statement.
We will obtain your consent for specific use of your personal data not covered by this statement, or where that personal information includes sensitive or special category data, which we will collect from you at the appropriate time. You can withdraw your consent to our specific use of such data at any time.
The University will not disclose personal information it holds about you, including results, addresses or other information, to your relatives (including parents or spouse) without your explicit consent. The University may engage with you to determine the validity and appropriateness of such consent before accepting it. The University will not confirm that you are or have been a student of the University, except as outlined in this statement, unless you have a record of graduation, as that is a public document.
The following examples are instances where the University will use and disclose your personal information for legitimate purposes:
- providing information to the Department of Human Services (e.g. Centrelink);
- releasing statistical or participation information to relevant government bodies such as the Department of Education, or third parties acting on their behalf;
- releasing relevant information to the Department of Home Affairs, the Department of Education and the Australian Taxation Office (ATO);
- releasing relevant information to the Department of Foreign Affairs and Trade (DFAT) and other external parties engaged by the University to provide services under the Australia Awards Scholarship program (such as the University's preferred travel agency and health insurance provider) for the administration of Australia Awards Scholarships;
- providing information for law enforcement purposes where required or authorised by law;
- space utilisation and campus management purposes, and developing or refining services offered by the University;
- releasing to another tertiary institution or tertiary admission centre information about your academic progress at this University and any Government funded research training entitlement, where relevant, if you apply to transfer studies;
- providing a list of enrolled students to the returning officer or other appointed electoral bodies to enable students who wish to vote at elections for student organisations to be able to do so (but not for the purpose of contacting students for marketing or promotional purposes);
- providing relevant personal information to external companies or individuals that have been engaged under legal contract to perform some of the University's functions such as student surveys or academic services;
- exchanging relevant personal information and context between appropriate academic and student services staff for the purpose of offering and providing student support services;
- releasing the names of recipients of prizes, scholarships or similar awards to the respective official student sponsors or scholarship providers;
- providing information in response to a subpoena, summons or other written demand from a government department or authority, or a court or tribunal with the power to demand the information;
- to protect a student or someone else from a serious and imminent threat to their life or health;
- releasing examination results, academic and administrative information, to another institution where the student is enrolled under an official student exchange, cross-institutional study, dual degree, shared teaching, industry or clinical experience or multi-institutional arrangement with that institution to facilitate the collaboration or arrangement; and
- when you graduate, providing relevant information to the Advancement Office so that you can be contacted about services for University alumni.
- to maintain academic integrity and assist authorised staff in investigating any potential breaches, in accordance with the Student Academic Integrity Policy.
In many instances you will be able to access and correct your personal information directly. In some circumstances, requests for access will need to be managed in accordance with the Freedom of Information Act 1982 (Vic).
Data obtained via course application or online enrolment, that is reported to the Commonwealth Government, can be viewed at my.unimelb.edu.au. If this information is incorrect, or needs to be updated, you will be able change it. Depending on the type of change, this can be done online or via application at Stop 1.
For access to other personal information that the University holds about you, you should contact the department that holds the information in the first instance. In some circumstances, the department or area of the University that holds that information may need to liaise with the University's Legal and Risk area before determining whether they can provide the information directly to you.
At times, the University may require requests for access to or correction of personal information to be made in accordance with the Freedom of Information Act 1982 (Vic). Further information about this process is available on our Freedom of Information web page.
The University Secretary is the University's designated Privacy and Data Protection Officer (PDPO). The privacy team in Legal and Risk provide guidance on privacy obligations and responsibilities.
We will endeavour to inform you of any substantive changes to this Privacy Statement, however, we may occasionally make changes without notice, particularly where there are changes in the relevant laws or we adopt new working practices. We therefore encourage you to regularly review this statement for any updates. The most recent substantive changes were made 11 November 2019.