Skip to content

http://www.monash.edu/privacy-monash http://www.monash.edu/privacy-monash

Case Studies

Case Study 1: Student Application Forms May Need Revising

Arising from a recent case of the NSW Administrative Decisions Tribunal, you may wish to consider amending your current application form for students.

A summary of the decision is provided below, with possible consequences for Monash University and suggested recommendations. If you would like to read the full text of the decision please go to the NSW Lawlink website. The decision was upheld on appeal.

DO -v- University of New South Wales [2002] NSWADT 211

Facts: Mr DO applied for admission to a PhD in optometry in the University of New South Wales (UNSW). Mr DO signed a declaration which stated in part that:

I authorise the University to obtain official records from any tertiary institution previously attended by me.

UNSW accepted Mr DO's application and he was also awarded a scholarship. Subsequently, UNSW requested academic transcripts in relation to Mr DO from Adelaide University, the University of Queensland, Macquarie University and the University of Tasmania. His enrolment was cancelled as he did not disclose on his application form admission to the PhD program his previous enrolments at the other universities.

Mr DO complained that his privacy had been breached, as he had never authorised UNSW to obtain information from universities he had not included on the application form.

Decision: The complaint was considered by the NSW Administrative Decisions Tribunal in late 2002 and upheld on appeal in March 2003. The Tribunal found that Mr DO signed the authorisation stating that ‘I authorise the University to obtain official records from any tertiary institution previously attended by me. This authorisation is not qualified in any way. It applies to any tertiary institution which Mr DO has attended. It is clear on the face of this document that Mr DO did authorise UNSW to collect information about his previous academic record from other universities. Mr DO cannot subsequently seek to restrict the scope of this authorisation. There is no breach of the privacy laws.

What this means for Monash University:

Currently, application forms at Monash contain the following types of statements:

  • Information on this form may be disclosed to the relevant bodies for verification of qualifications

OR

  • I acknowledge Monash University reserves the right to seek from other relevant bodies verification of the standing of my claimed qualifications

Based on the results of the above case, if an applicant signed a form with a statement such as those outlined above, Monash University would only have consent to verify qualifications. The second statement is even more restrictive as it only allows us to verify those qualifications included by the applicant on the application form.

Recommendations:

If Monash would like to obtain consent to collect information from any educational institution attended by applicants which extends beyond qualifications eg enrolments, then it is recommended that application forms are amended to include the following sentence:

I authorise the University to obtain official student records from any educational institution necessary to make an informed decision about the application or matters that concern the student’s enrolment.

This statement allows Monash to obtain information about students from both tertiary institutions and other educational institutions (eg secondary schools) which may be relevant to the decision about the application or ongoing enrolment.

If employment is also taken into account in determining whether an applicant is suitable for course acceptance (eg MBA) it is also important to obtain consent to verify employment. The following statement could be included on application forms where past or current employment is taken into account when determining an applicant's suitability for a position in a course.

I authorise the University to verify my past and current employment for the purpose of making an informed decision about the application or matters that concern the student's enrolment.

Case Study 2: Reference Complainant Wins Privacy Case

A recent case note reported on the website of the Office of the Federal Privacy Commissioner has highlighted the importance of taking into account the reasonable expectations of individuals before using or disclosing their personal information.

According to the case note, a federal government employee provided the name of a referee in the course of an interview for a position with another federal agency. The referee, who was the complainant's supervisor, disclosed during the course of the conversation that the employee suffered from epilepsy and depression and the length of time on sick leave. The referee also disclosed that the complainant did not cope well under stress. The complainant alleged that failure to be selected for the position was due to the referee disclosing this information.

The Commissioner took the view that the disclosure of the illnesses and sick leave information was in breach of the privacy laws because the individual would not reasonably expect that the referee would disclose medical information.

It was acknowledged that the complainant provided implied consent to disclosure of information relating to skills, work experience and personal attributes relevant to the position, however, the implied consent did not extend to disclosure of medical information.

The disclosure of information relevant to the individual's ability to cope with stress was found to be within the expectations of the individual as stress is a normal human characteristic properly relevant to employment. As a result of the Federal Privacy Commissioners investigation the agency issued an apology to the complainant and paid compensation of $7,000.

In view of this case, the Monash University Privacy Officer, recommends that when providing references for employees, Monash staff who are asked to give references, and who are authorised to should:

  • Ascertain the factors that are relevant to the position;
  • Only disclose information about the job applicant that is within the applicant’s reasonable expectations eg. skills, work experience and personal attributes relevant to the position; and
  • Do not disclose personal information that the job applicant has requested not be disclosed.