UNSW Found to Have Breached Privacy Act

The University leaked an email by a student preparing a complaint against staff

UNSW is in potentially serious trouble after a hearing of the New South Wales Civil and Administrative Tribunal (NCAT) found last week that the University had breached Section 17 of the Privacy and Personal Information Act 1998.

S Montgomery, a Senior Member of the Tribunal, found the breach occurred in the handling of a complaint by a student whose PhD candidature at the UNSW Graduate Research School (GRS) had been terminated.

The Original Complaint

The student, CWI*, had their PhD candidature terminated by the University after the abrupt resignation of their supervisor.

CWI told Honi that Laura Poole-Warren, the Dean of Graduate Research, informed them a ‘candidature administrator’ needed to be found within university staff, but a new supervisor could be sourced from anywhere.

Despite finding an ‘eminently-qualified’ supervisor from outside the university, Ms Poole-Warren terminated CWI’s candidature, citing that the University was unable to internally source a ‘head supervisor’, an additional requirement that had not been communicated to CWI in the original advice.

Along with their PhD candidature, CWI held a University International Postgraduate Award Scholarship (UIPA), which was also terminated. This included tuition fees for the 3.5 years of PhD study and a stipend, which in 2018 is $27,082.

CWI intended to submit an official complaint against members of GRS staff who were involved in the termination of their candidature. On the advice of Kimberly Dickinson, the manager of UNSW’s Conduct and Integrity Unit, CWI sent an email to Paul Serov, UNSW’s Right To Information Officer.

The email, which was intended as a ‘GIPA’ request for information under the Government Information (Public Access) Act 2009, asked for their student file and any records of decision making processes on CWI’s case. It included a list of 19 GRS staff members who were in some way involved.

The Case Against UNSW

The NCAT hearing revealed Mr Serov had leaked information included in the email to two of the employees named in the list: Laura Poole-Warren, whom CWI had approached for advice, and Dominic Mooney, Assistant Director of the UNSW Graduate Research School.

The hearing further found that Mooney had discussed the request in an email thread and phone call with Serov. Mooney further requested a meeting with Serov to discuss the email, and Serov CC’d Poole-Warren in his reply. Serov also later provided the entire email, including the employee list, to Dominic Mooney.

CWI made a complaint about Serov’s behaviour to UNSW, but on 11 July 2016 the University made the primary decision that they had not breached the Privacy Act. The Tribunal ordered UNSW to re-open this complaint, and on 7 July 2017 the University maintained the Act had not been breached.

This redetermination was reviewed by NCAT and overturned, with the Tribunal finding that Mr Serov’s actions on behalf of the university constituted a breach of the Act.

Under the current laws, a public sector agency cannot use personal information for any purpose other than that for which it was collected, unless the alternative use of information is directly related to the primary purpose for which it was collected, with the consent of the individual, or is necessary to prevent or lessen  an imminent threat to the life and health of the individual. The Tribunal found Mr Serov’s actions did not fall into any of these categories.

CWI* told Honi that the protracted appeals process has had a “terrible effect” on their health “both mentally and physically” and noted their career “would be in a much different place right now” had they turned down UNSW’s offer.

UNSW faced a similar complaint before the NCAT last year regarding the sharing of an employee’s personal details, but no breach was found to have occurred.

What Does UNSW Do Now?

As the NCAT decision was the resolution of an external appeal, UNSW can not make an appeal within the NCAT. If UNSW wishes to challenge the finding, the case will be escalated to the Court of Appeal or the Supreme Court.

The matter will resume Tuesday, 6 March 2018 at 9.30am for determination of what remedies the Tribunal will order the University undertake.  CWI is seeking further legal assistance after representing themselves in the NCAT appeal.

Honi understands that remedies sought by CWI may include:

  • That the original complaint (over forced Phd discontinuation) be properly considered by UNSW including by way of third party arbitration;
  • That UNSW publish a public explanation/apology to CWI.

But Wait, There’s More

The Privacy and Personal Information Act 1998 also states that in breaches of the act, if an employee of a public sector agency was found not to have acted “in good faith” they may be referred to the “responsible minister.”

The outcome of these remedies may set a precedent for the Australian university sector.

Should the original complaint about CWI’s PhD discontinuation be accepted by the University, it could be a breach of their consumer obligations. If the matter is referred to the Minister for Education, it could be found to be a breach of their privacy obligations. In either case, there may be serious legal repercussions for the University.

No legal precedent exists under the Higher Education Support Act 2003 as to whether the deregulated industry’s’ provision of higher education constitutes a “trade or commerce” relationship with students.

Her Honour Justice Collier of the Federal Court noted by consideration in Mbuzi v Griffith University 2014 that under the act,

  • Universities now compete for students on the basis of price (tuition fees and other costs of attendance) and service (courses offered, teaching quality, the standard of facilities and research opportunities).
  • Educational services supplied to full fee and part fee students are supplied in trade or commerce.

This consideration is supported by a 2012 article from the UNSW Law Journal by QUT Professor Stephen Corones, who has chaired three separate Commonwealth reviews of Consumer Protection legislation.

Corones notes that as a result of the Act, “since 1 January 2005, universities provide services to HECS paying [and international] students ‘in trade or commerce’” and that “there is no doubt that educational services supplied to full fee and part fee students are supplied in trade or commerce.”

Any precedent regarding a university’s consumer obligations to students under the Act would have also applied to students such as those affected by the Sydney College of the Arts saga at USyd.

A UNSW spokesperson told Honi the University does not wish to comment on the matter.

* CWI is anonymised in this article subject to Section 64 (1) of the Civil and Administrative Tribunals Act 2013.