1. In early 2011, the complainant, Amber Kudleck, began a Graduate Diploma in Primary Teaching at Victoria University (VU). VU is the respondent in this proceeding.
2. Dr Greg Neal was one of Ms Kudleck's teachers and her course coordinator during Ms Kudleck's first semester.
3. Between 2 June 2011 and 3 June 2011, Dr Neal sent two emails containing personal information about Ms Kudleck to Colleen Vale, Bill Eckersley and Jeanne Carroll (the initial emails[1]). Ms Vale and Mr Eckersley were the acting heads of school and Ms Carroll was the BEd (P-12) coordinator and student progress coordinator at the time.
4. On 3 June 2011, Dr Neal emailed the initial emails and the email replies from Bill Eckersley and Jeanne Carroll (the email chain[2]) to all of the students enrolled in the Graduate Diploma in Primary Teaching (the Graduate Diploma students).
5. Ms Kudleck claims that VU has breached section 16 of the Information Privacy Act 2000 (the IP Act) because the sending of the initial emails and the email chain contravened Information Privacy Principles (IPPs) 2.1 and 4.1. She is seeking compensation of $100,000.[3]

1. The purposes of the IP Act are (among other things) to establish a regime for the responsible collection and handling of personal information in the public sector, to provide individuals with a right of access to information held by organisations, to provide individuals with a right to require information about them held by an organisation to be corrected, and to provide remedies for interference with an individual's information privacy.[4]
2. The IP Act's objectives indicate that the IP Act balances competing aspects of the public interest.[5] The competing aspects are the free flow of information and the protection of the privacy of personal information in the public sector. It is also an objective of the IP Act to promote the responsible and transparent handling of personal information in the public sector.
3. An act or practice of an organisation is an interference with the privacy of an individual (relevantly) only if it is contrary to or inconsistent with an IPP.[6] The IPPs are set out in Schedule 1.
4. An organisation must not do an act or engage in a practice that is contrary to an IPP "in respect of personal information collected, held, managed, used, disclosed or transferred by it".[7] There are a number of exceptions to these general propositions.
5. Division 1 of Part 2 of the IP Act sets out the organisations to which the IP Act applies. It is common ground that VU is one of these. It is a body constituted by an Act for a public purpose.
6. The IP Act does not regulate the conduct of individuals. However, an organisation is taken to have done any act done by an employee of the organisation unless the organisation can show the employee was acting outside the scope of his or her authority or that it took reasonable precautions and exercised due diligence to avoid the act being done.[8]
7. Personal information is defined (relevantly) as "information or an opinion (including information or an opinion forming part of a database) that is recorded in any form and whether true or not about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion...".[9]
8. Information Privacy Principal 2.1 (IPP 2.1) provides that, subject to a number of exceptions, an organisation must not use or disclose personal information about an individual for a purpose other than the primary purpose of collection. Information Privacy Principle 4 (IPP 4.1) provides that an organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.
9. VU admits that it is an organisation for the purposes of the IP Act and that the emails in question contained personal information as defined in section 3 of the IP ACT. However, it denies that the sending of the initial emails or the email chain breached IPP 2.1 or IPP 4.1.

1. On 2 June 2011, Dr Neal sent the following email (Ms Kudleck's personal information as identified by Fiona Spencer, counsel for VU, is in bold text[10]):

I have a student I firmly believe has a 'ghost writer'. Her academic assignments are beyond her capabilities when compared to her real time written communication work samples.

This is the same student (Amber Kudleck - Grad Dip Primary) I raised at the recent meeting Bill and Jeanne but since then I have had two sessional staff share further anecdotes about their concerns. They believe Amber has not addressed the assessment criteria and has presented work that is loosely aligned to the topic but has not been able to discuss what she has written when asked to speak to it.

She has failed her placement (with two different mentors this semester) and believes she was given no feedback - - we have email evidence to suggest otherwise.

We can fail her but I think it is more serious and consideration needs to be about exclusion from the course.

I would like to share the assessments with you and discuss the way forward. Can we meet next Tuesday or Wednesday please about this student?

This email, including any attachment, is intended solely for the use of the intended recipient. It is confidential and may contain personal information or be subject to legal professional privilege. If you are not the intended recipient any use, disclosure, reproduction or storage of it is unauthorised. If you have received this email in error, please advise the sender via return email and delete it from your system immediately. Victoria University does not warrant that this email is free from viruses or defects and accepts no liability for any damage caused by such viruses or defects.

1. The next day, Bill Eckersley replied to Dr Neal's email as follows:

I think there is sufficient evidence at this stage but if we can have evidence of plagiarism then we are on stronger ground

I can meet btw 12-3pm on Tuesday or Wed btw 8.30-lOam

I have attached a copy of the VU policy on Student Assessment and Progress: p.17+ seems relevant

http://gpps.vu.edu.au/studentdiscipline/cid/1l/parent/1/t/studentdiscipline

1. The reply email included the 2 June email from Greg Neal.
2. Dr Neal then sent the following email (Ms Kudleck's personal information is in bold text):

I worked out turnitin and for two assignments they disclose the use of multiple sources in both papers (one paper has over 50 cited references which is far beyond the norm for this sort of work) but NO plagiarism.

1. This email included the 2 June email from Greg Neal and the reply email from Bill Eckersley.

1. Dr Jeanne Carroll sent the next email. It stated:

Assignment [sic] that have been cobbled together from references still come under the academic integrity policy. You need to look at what proportion of the work is original as well.

I don't know how you establish that someone else wrote the work.

Can you send me though the list of Grad Dip student so that I can let them know we are starting early, please

1. Dr Carroll's reply email also included all of the previous emails.
2. The last email in the chain was Dr Neal's reply to Dr Carroll (Ms Kudleck's personal information is in bold text):

I used turnitin on two assignments. Both hadjust over 30% cited but that included a large reference list in both. Evidence suggests it is not plagiarized.

The other way forward is to give her marks and she will receive fails in probably 3 of the 4 subjects. Through our normal assessment process she will need to attend a meeting but I think we need to be preempt and have her with a student advisor and exclude her asap.

Lawry will have the St Albans students and will need to be informed about the plans for next semester.

1. This email also included all of the previous emails referred to above.
2. When Dr Neal sent the email set out in paragraph 22 above to Dr Carroll, he inserted into the blind carbon copy (BCC) field the email addresses of all of the Graduate Diploma students. This resulted in each student receiving a copy of all of the emails set out above (the email chain).
3. Dr Neal told the Tribunal that he inserted the Graduate Diploma students' email addresses into the BCC field because Dr Carroll had requested a list of the students she was teaching the following semester. Dr Neal explained that he used the BCC field in order to protect the privacy of the students, that is, he used the BCC field in order to prevent each student from seeing the email address of the other students.
4. Dr Neal told the Tribunal that it was not until he received an email from one of the Graduate Diploma students at 10:34 am on 3 June 2011 stating "Not sure why I received this email?"[11] that he realised that he had mistakenly sent the email chain containing Ms Kudleck's personal information to the Graduate Diploma students. Dr Neal immediately contacted VU's IT department, which, less than half an hour later, sent emails to the Graduate Diploma students with the subject heading "Recall: need to meet" and which stated:

Greg Neal would like to recall the message, "need to meet".

This email, including any attachment, is intended solely for the use of the intended recipient. It is confidential and may contain personal information or be subject to legal professional privilege. If you are not the intended recipient any use, disclosure, reproduction or storage of it is unauthorised. If you have received this email in error, please advise the sender via return email and delete it from your system immediately. Victoria University does not warrant that this email is free from viruses or defects and accepts no liability for any damage caused by such viruses or defects. [12]

1. Dr Neal also sent a further email to the Graduate Diploma students at 3:16 pm on 3 June 2011 that stated:

Please ignore the previous email and delete it as you are not the intended recipient.

The previous email, including any attachment, is intended solely for the use of the intended recipient. It is confidential and may contain personal information or be subject to legal professional privilege. If you are not the intended recipient any use, disclosure, reproduction or storage of it is unauthorised. If you have received this email in error, please advise the sender via return email and delete it from your system immediately. Victoria University does not warrant that this email is free from viruses or defects and accepts no liability for any damage caused by such viruses or defects.

This email, including any attachment, is intended solely for the use of the intended recipient. It is confidential and may contain personal information or be subject to legal professional privilege. If you are not the intended recipient any use, disclosure, reproduction or storage of it is unauthorised. If you have received this email in error, please advise the sender via return email and delete it from your system immediately. Victoria University does not warrant that this email is free from viruses or defects and accepts no liability for any damage caused by such viruses or defects.[13]

DID THE SENDING OF THE INITIAL EMAILS CONTRAVENE IPP 2.1?

1. VU denies that the sending of the initial emails contravened IPP 2.1 for two reasons. First, it submitted that VU used or disclosed Ms Kudleck's personal information that was contained in the initial emails for the primary purpose of collection.[14]
2. Secondly, it submitted that if the Tribunal finds that Ms Kudleck's personal information was used or disclosed for a secondary purpose, the secondary purposed is related to the primary purpose of collection and Ms Kudleck would reasonably expect VU to use or disclose the information for the secondary purpose.[15]

Was the personal information collected by VU used or disclosed for the primary purpose of collection?

1. Ms Kudleck submitted that:
   • (a) VU collects information about its students for the primary purpose of enabling them to enrol in their chosen course of study and to deliver the course to them.[16]
   • (b) The use to which Dr Neal put the information in sharing it with other staff members was not to deliver the course but was instead a related "secondary purpose", being allegations that Ms Kudleck had submitted work that was not her own.
2. VU submitted that:
   • (a) Ms Kudleck's personal information was used and/or disclosed for the primary purpose for which the information was collected, that is, VU delivering a course of study and related services to Ms Kudleck.
   • (b) The expression "delivering a course of study and related services" should not be construed in a confined or restricted manner. Rather, the Tribunal should construe the expression to include marking and assessing a student's work and ensuring that a student submits work that is the student's own.
   • (c) When Dr Neal disclosed the personal information in the initial emails to the acting heads of school and the student progress coordinator, he acted reasonably and appropriately.

1. VU's Privacy policy states that VU collects information about students for the primary purpose of enabling the students to enrol in their chosen course of study and for VU to deliver that course and related services to them.[17]
2. Attachment 1 of VU's Privacy policy is headed "Students". Under the heading "Information Privacy Collection Statement", it states "[t]his document lets you know how we use your personal information that we collect from enrolment related forms".[18]
3. The document goes on to states that VU collects information from enrolment related forms for the primary purpose of enabling students to enrol in their chosen course of study and for VU to deliver that course and related services to them.
4. Under the heading "Personal information about you we may hold", the document states "[t]ypically, the University may collect and hold information related to your contact details, academic performance, admissions, attendance, enrolment, progression, assessment, misconduct and financial information associated with your enrolment".
5. I find that the primary purpose for the collection of personal information from students is to enable VU to deliver the course that the student has enrolled in and any related services, as stated on pages 10 and 17 of VU's Privacy policy.
6. In order for VU to deliver the course that the student has enrolled in, VU must employee people to teach the course and assess the students. VU's Student Assessment and Progress policy sets out principles and procedures for assessing VU students and managing their progress.[19] Under the heading "Assessment", the policy (relevantly) states that:

Academic honesty is an essential foundation for student assessment. Students must ensure that the work they submit for assessment is their own and that they acknowledge the work of others appropriately...[20]

1. VU's Academic Honesty and Preventing Plagiarism policy also states that it is related to VU's Student Assessment and Progress policy.[21]
2. Accordingly, I find that that ensuring that students submit their own work in accordance with VU's Student Assessment and Progress policy and Academic Honesty and Preventing Plagiarism policy is an integral part of assessing a student's work and managing their progress and forms part of the primary purpose of delivering a course that a student has enrolled in.

Was Ms Kudleck's personal information disclosed for the primary purpose of collection, that is, to enable VU to deliver the course to Ms Kudleck?

1. VU relied on the evidence of Dr Neal as to the purpose for which Ms Kudleck's personal information was used or disclosed.
2. Dr Neal gave evidence that Ms Kudleck had approached him about concerns she had that she was being mistreated and disadvantaged by her mentor and to request that she change her mentor and school.[22] At around the same time, the school principal expressed concerns about Ms Kudleck's performance to Dr Neal. The school principal had taken what Dr Neal described as an unusual step of personally observing Ms Kudleck's performance because of the concerns raised by her mentor. Ms Kudleck was then allocated a different mentor and class. Other students also raised concerns with Dr Neal about Ms Kudleck's contribution to a group presentation and her not working collegially.
3. Dr Neal told the Tribunal that the three other teachers in the course approached him about their concerns with respect to plagiarism and Ms Kudleck not meeting the assessment standards necessary for her to pass the course of study.[23] Dr Neal also believed that Ms Kudleck's work was not her own based on his moderation of two of Ms Kudleck's assignments[24], his observations of her in class and his perception of a discrepancy between the standard of her "real-time" work and the standards of her assignments.[25] In addition, Dr Neal and his colleagues had observed that Ms Kudleck was unable to justify orally what was contained in the assignments, he doubted whether Ms Kudleck had had sufficient time to prepare the assignments and he was concerned about the large amount of copying and pasting of references.[26] Dr Neal also observed noticeable differences between Ms Kudleck's English in her "real time" work compared with her assignments and had suspicions that the work was not her own because Dr Neal considered the assignments were on subjects only loosely connected to the topics the students had been asked to address.[27]
4. Dr Neal gave evidence that by 30 May 2011, both of Ms Kudleck's mentors had given her an unsatisfactory grading[28] and that he had held a meeting with Ms Kudleck to discuss his concerns about her progress in the course.[29] Dr Neal's evidence was that, as course coordinator, he was faced with a situation where a student was on track to fail three of the four subjects in the semester and there was reason to believe that she had submitted important assignments that were not her own work or all her own work. Dr Neal had serious and real concerns about the capacity of Ms Kudleck to complete the course.
5. Dr Neal's evidence was that due to the seriousness of the situation, he disclosed the personal information in the initial emails to the acting heads of school and the student progress coordinator in order to inform them about the situation and to seek their guidance as to how to proceed. The assessment of one of the acting heads of school was that there was sufficient evidence to proceed to a formal meeting with Ms Kudleck.[30] The scheduled meeting did not go ahead because Ms Kudleck said she was unable to attend.[31]
6. Ms Kudleck strongly denied that her progress was unsatisfactory and that she had submitted work that was not her own. However, these were not facts in dispute.

1. I am satisfied that, as Dr Neal was one of Ms Kudleck's teachers and her course coordinator, he was responsible for managing her progress under the Student Assessment and Progress policy, which included identifying the fact that she was not making satisfactory progress, communicating with her about this and intervening in a supportive manner.[32] Dr Neal was also responsible for ensuring that the management of Ms Kudleck's progress was open and fair.
2. I am satisfied that, at the time Dr Neal disclosed Ms Kudleck's personal information by sending the initial emails, he was very concerned about Ms Kudleck's progress, which he considered to be unsatisfactory, due to, amongst other things, his suspicion that Ms Kudleck had submitted work that was not her own. I am also satisfied that all of the personal information contained in the initial emails was information about Ms Kudleck's progress in the course.
3. In addition, I am also satisfied that, when Dr Neal sent the initial emails about Ms Kudleck's unsatisfactory progress to the acting heads of school and the student progress coordinator, he did so in accordance with his obligation to manage Ms Kudleck's progress under the Student Assessment and Progress policy[33], which included ensuring that she had complied with VU's Academic Honesty and Preventing Plagiarism policy.[34]
4. I am satisfied that the purpose for sending the emails was twofold. First, Dr Neal was informing the acting heads of school and the student progress coordinator, who had responsibilities in relation to a student's progress under the Student Assessment and Progress policy,[35] that Dr Neal considered Ms Kudleck's progress to be unsatisfactory and that this included a suspicion that Ms Kudleck had submitted work that was not her own. Secondly, Dr Neal was seeking advice from the acting heads of school and the student progress coordinator on to how to manage Ms Kudleck's unsatisfactory progress.
5. As I have found in paragraph 38 above that the primary purpose for the collection of a student's personal information is delivering the course the student has enrolled in, which includes managing a student's progress under the Student Assessment and Progress policy, which in turn includes ensuring a student complies with VU's Academic Honesty and Preventing Plagiarism policy as set out in VU's Student Assessment and Progress policy, I find that the disclosure of Ms Kudleck's personal information in the initial emails was for the primary purpose of collection.

Was the secondary purposed related to the primary purpose of collection and would Ms Kudleck reasonably expect VU to use or disclose the information for the secondary purpose?

1. As I have found that Dr Neal disclosed Ms Kudleck's personal information for the primary purpose of collection, that is, to enable VU to deliver a course to her, I do not need to consider whether the exception to IPP 2.1 contained in 2.1(a) of Schedule 1 of the IP Act applies. However, I will do so for the sake of completeness.

1. Ms Kudleck did not dispute that the disclosure of her personal information related to the primary purpose of collection, that is, to enable VU to deliver a course to her. She also admitted that an individual might reasonably expect that personal information of this kind would be disclosed as part of a formal investigation into allegations that she had submitted work that was not her own as specified in VU's Academic Honesty and Preventing Plagiarism policy.
2. However, Ms Kudleck submitted that an individual would not reasonably expect that VU would disclose such allegations as part of a discussion with other colleagues about her broader performance issues in applying VU's Student Assessment and Progress policy.
3. In support of this submission, Ms Kudleck relied on the evidence of Dr Neal that this email to staff was not part of a formal investigation into the allegations.
4. Ms Kudleck also submitted that the disclosure of the initial emails to the three other staff members was a breach of IPP 2.1 because none of the exempting subsections apply.
5. VU submitted that:
   • (a) Ms Kudleck's personal information was used and or disclosed for a secondary purpose related to that primary purpose, namely for assessing Ms Kudleck's performance and progress in the course and or investigating suspected plagiarism or academic misconduct.
   • (b) Ms Kudleck should reasonably have expected VU to have used and or disclosed the information for that purpose. VU relied on the evidence of Dr Neal as to why Ms Kudleck's personal information was disclosed in the emails.
6. Specifically, VU submitted that investigating suspicions that a student had submitted work that was not her own is a purpose clearly related to VU delivering the course (and in the course of doing so necessarily assessing work submitted as part of that course of study). VU relied on Ms Kudleck's evidence that she accepted that when she submitted assignments, she expected that they would be assessed, feedback would be given and that VU would deal with any disciplinary issues such as allegations of plagiarism. Her evidence was that she understood that they were important issues that VU needed to deal with. Ms Kudleck's objection was to the emails being sent to teachers who did not know her and to a teacher who was meant to be teaching her in the following semester. Ms Kudleck told the Tribunal that she was worried that the teacher who was meant to be teaching her in the following semester would be biased against her.
7. VU submitted that these objections do not amount to a breach of the IP Act. VU also submitted that Dr Neal acted reasonably and appropriately in alerting the acting heads of school and the student progress coordinator of his suspicions that a student had submitted work that was not her own.

1. I am satisfied that, if the disclosure of Ms Kudleck's personal information in the initial emails was not for the primary purpose of collection, that is to enable VU to deliver the course to Ms Kudleck, it was clearly related to the primary purpose of collection. The management of a student's progress and consideration of whether or not a student has submitted work that is not her own is clearly related to the delivery of a course. Ms Kudleck did not dispute this.
2. I am also satisfied that Ms Kudleck would reasonably expect her teacher and course coordinator to disclose his suspicions that she had submitted work that was not her own to the joint heads of the school of Education. This is because, as Ms Kudleck's teacher, Dr Neal was required to report his suspicions that Ms Kudleck had submitted work that was not her own in accordance with his obligations under the Academic Honesty and Preventing Plagiarism policy. Specifically, the Academic Honesty and Preventing Plagiarism policy states that all teachers are responsible for detecting and referring plagiarism.[36] It also states that if a teacher has evidence pointing to a student having plagiarised work, the teacher should discuss the basis of these concerns with the program manager or course co-ordinator and that further discussions may take place with the head of school.[37] Teachers who have reason to believe that a student has committed an offence under the Academic Honesty and Preventing Plagiarism policy must also write to the Pro Vice-Chancellor, Academic and Students, for referral to the relevant head of school.[38] Ms Kudleck did not dispute this either.
3. I am also satisfied that Ms Kudleck would reasonably expect her teacher and course coordinator to disclose his suspicions that she had submitted work that was not her own to the acting heads of school and the student progress coordinator for the purpose of managing her progress, including considering whether or not she had submitted work that was not her own in accordance with VU's Student Assessment and Progress policy.
4. As stated in paragraphs 46 and 48 above, I have already found that, as Dr Neal was one of Ms Kudleck's teachers and her course coordinator, he was responsible for managing her progress under the Student Assessment and Progress policy, which included managing any issues arising from the possibility that Ms Kudleck had submitted work that was not her own.
5. This is because, as I have already found in paragraph 39 above, ensuring that students submit their own work is an integral element of assessing a student's work and managing his or her progress under VU's Student Assessment and Progress policy.
6. In these circumstances, I find that Ms Kudleck would reasonably expect that VU would disclose suspicions that she had submitted work that was not her own to the acting heads of school and the student progress coordinator in order to consider her broader performance issues in accordance with VU's Student Assessment and Progress policy.
7. I am also satisfied that Ms Kudleck would reasonably expect a teacher or course coordinator to inform the acting heads of school and the student progress coordinator about such serious matters before arranging a formal meeting under the Student Assessment and Progress policy and or initiating a formal investigation under the Academic Honesty and Preventing Plagiarism policy. Dr Neal gave evidence that he informed the acting heads of school and the student progress coordinator that he considered that Ms Kudleck was not making satisfactory progress and may have submitted work that was not her own because of the seriousness of the situation and in order to seek guidance as to how to proceed. I accept Dr Neal's evidence that the situation was serious and his reasons for informing the acting heads of school and the student progress coordinator. I find this was a reasonable step to take and that Ms Kudleck would reasonably expect her teacher and course coordinator to disclose her personal information in these circumstances.
8. I also find that Dr Neal did not disclose the allegations to mere "colleagues" or "staff members" as submitted by Ms Kudleck. Dr Neal disclosed the allegations to the acting heads of school and the student progress coordinator, who, as I have found in paragraph 49 above, had responsibilities in relation to a student's progress under the Student Assessment and Progress policy.
9. Accordingly, I find that the exception contained in 2.1(a) of Schedule 1 of the IP Act applies to the disclosure of Ms Kudleck's personal information in the initial emails and that VU has not breached IPP 2.1.

THE EXCEPTION TO IPP 2.1 CONTAINED IN 2.1(E) OF SCHEDULE 1 OF THE IP ACT

1. VU also submitted that in any event, the exception to IPP 2.1 contained in 2.1(e) of Schedule 1 of the IP Act applies.
2. VU relied on the evidence of Dr Neal that he suspected that Ms Kudleck had been or may have been engaged in conduct amounting to academic misconduct. VU submitted that such conduct is "unlawful activity" because it amounts to a disciplinary offence contrary to regulation 2.7, which was made pursuant to Part 5 of the Victoria University Act 2010 (Vic) (VU Act).
3. VU submitted that the Tribunal should not narrowly construe the concept of "unlawful activity" to encompass only breaches of statutory obligations. The concept includes breaches of delegated legislation and the common law. Whilst VU acknowledged that VU regulations are not considered statutory rules or subordinate instruments,[39] VU submitted that it does not follow that a disciplinary offence, which can result in penalties pursuant to Regulation 2.7, is not "unlawful activity" for the purposes of IPP 2.1 (e).
4. VU also submitted that the use and or disclosure of Ms Kudleck's personal information in the initial emails was a necessary part of the investigation of the matter and Dr Neal's obligations to report his concerns to relevant persons.[40]
5. Ms Kudleck denied that this exception applies.
6. In light of my findings above, I do not need to consider whether the exception contained in 2.1(e) of Schedule 1 of the IP Act applies. Again, I will do so for the sake of completeness.

1. The exception to IPP 2.1 contained in 2.1(e) of Schedule 1 of the IP Act allows an organisation to use or disclose personal information about an individual for a purpose other than the primary purpose of collection if the organisation has reason to suspect that unlawful activity has been, is being or may be engaged in, and uses or discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities.
2. The expression "unlawful activity" is not defined in the IP Act.
3. The Macquarie Dictionary defines "unlawful" as "not lawful; contrary to law; illegal; not sanctioned by law"[41]. In a criminal context, an "unlawful act" has been defined as "an action that infringes a statutory or common law prohibition"[42] and an "unlawful activity" has been defined as "an act or omission constituting an offence against domestic or foreign law"[43].
4. I consider that the expression "unlawful activity" should be construed as encompassing acts that breach the statutory laws of Victoria or Australia. Accordingly, I am not satisfied that the expression "unlawful activity" includes activities that may constitute disciplinary offences created through regulations made under Part 5 of the VU Act. As acknowledged by VU, a regulation made under Part 5 of the VU Act is not statutory rule for the purposes of the Subordinate Legislation Act 1994 (Vic) or a subordinate instrument for the purposes of section 32 of the Interpretation of Legislation Act 1984 (Vic) let alone a statutory law.

DID THE SENDING OF THE INITIAL EMAILS CONTRAVENE IPP 4.1?

1. It follows from my findings in paragraphs 46 to 50 and 59 to 67 above that the sending of the initial emails containing Ms Kudleck's personal information did not contravene IPP 4.1 because the sending of the initial emails did not amount to "misuse", "loss" or "unauthorised access, modification or disclosure" of Ms Kudleck's personal information for the purposes of IPP 4.1.
2. The sending of the initial emails to the acting heads of school and the student progress coordinator were for the primary purpose of collection, that is, to enable VU to deliver the course of study. Accordingly, there was no "misuse" or "unauthorised disclosure" of Ms Kudleck's personal information. In addition, it is clear that Ms Kudleck's personal information was not lost, accessed or modified in an unauthorised manner when the initial emails were sent to the acting heads of school and the student progress coordinator.

DID THE SENDING OF THE EMAIL CHAIN CONTRAVENE IPP 2.1?

1. In its submissions dated 9 September 2013, VU acknowledged that "the accidental disclosure of personal information is capable of constituting a breach of IPP 2.1 (and 4.1) in an appropriate case".
2. However, as Ms Kudleck's personal information was disclosed by an employee of VU, VU will only be taken to have made the disclosure if the Tribunal finds that it failed to take reasonable precautions and exercise due diligence to avoid the act being done by its employee, that is, to avoid Dr Neal disclosing personal information of a student by emailing that information to other students.
3. This is because section 68 (1) of the IP ACT states that an act of an employee of an organisation is taken to have been done by the organisation unless the organisation can establish that it took reasonable precautions and exercised due diligence to avoid the act being done by its employee. VU bears the onus of proving that in this instance, it took reasonable precautions and exercised due diligence to avoid Dr Neal accidently sending the email chain to the Post Graduate students.

1. Ms Kudleck submitted that VU was unable to establish that it had taken reasonable precautions and exercised due diligence to avoid the email chain being accidently sent to the Graduate Diploma students by Dr Neal because it did not have a "robust" email policy that specifically addresses:
   • (a) the particular care that must be taken with emails containing allegations that a student had submitted work that was not his or her own
   • (b) the particular care that must be taken when staff members are using student email lists.
2. Ms Kudleck submitted that an email policy dealing with such important issues is clearly necessary to protect personal information from unauthorised disclosure.
3. Ms Kudleck relied on the fact that VU's email policy does not deal with these important issues at all. The Ms Kudleck submitted that this demonstrates that VU has not shown that it took reasonable precautions or exercised due diligence because the very policy that deals with email use does not deal with this obvious and serious risk to privacy.
4. VU submitted that it took reasonable precautions and exercised due diligence to avoid staff members breaching students' privacy. It had policies and procedures directed to ensuring its privacy obligations under the IP Act were met.[44] It required staff members to use email disclaimers that included warnings that the email was intended solely for the use of the intended recipient, was confidential and could contain personal information and which advised that use, disclosure, reproduction of storage of emails received by persons other than the intended recipient was unauthorised and that recipients were to advise senders via return email of an email received in error and to immediately delete it.[45]
5. VU also relied on the evidence of Dr Neal in relation to the circumstances surrounding the forwarding of the email chain to the Graduate Diploma students in support of its submission that it had taken reasonable precautions and exercised due diligence to avoid staff members breaching students' privacy.
6. Specifically, VU relied on the evidence that Dr Neal gave in relation to how he came to send the email chain to the Graduate Diploma students in Ms Kudleck's course. Dr Neal explained to the Tribunal that Dr Carroll had requested him to send her a list of the Graduate Diploma students, who she was teaching the following semester so she could provide them with some information.[46] Dr Neal understood Dr Carroll to be requesting the students' email addresses and he intended to attach this list to his email to Dr Carroll dated 3 June 2011, as stated in that email.[47] However, instead of attaching a list of the email address, Dr Neal put all of the Graduate Diploma students' email addresses in the BCC field of his email to Dr Carroll so that Dr Carroll would have all of their email addresses but they would not be able to see each other's email address. This action resulted in the email chain being sent to the Graduate Diploma students.
7. Dr Neal realised his mistake when he received an email from one of the Graduate Diploma students shortly after he sent the email chain to them.[48] Dr Neal immediately contacted VU's IT department, which sent emails to the Graduate Diploma students with the subject heading "Recall: need to meet" and which stated "Greg Neal would like to recall the message, "need to meet".". He also sent an email to each student that asked the student to ignore and delete the email because the student was not the intended recipient.[49] The both emails included a copy of the disclaimer that Dr Neal told the Tribunal is automatically attached to all VU emails (see paragraph 18 above). Dr Neal received emails from five students stating they had deleted the email.
8. VU also relied on Dr Neal's evidence on that he had read and was familiar with VU's Privacy policy and Appropriate Use of Email policy prior to him accidentally sending the email chain to the Graduate Diploma students. Dr Neal told the Tribunal that he had used and reviewed the Privacy policy on a yearly basis in the context of student progress meetings. Dr Neal also stated that he had taught other staff members about their privacy obligations whilst training them on the Staff Code of Conduct, which requires staff members to observe and comply with all VU policies, particularly VU's Privacy policy.[50] Dr Neal also gave evidence that he had been an "IT person" and regular email user for many years. He stated that he had often dealt with sensitive information and had never made a mistake like this before.
9. VU also relied on the fact that its staff members must comply with the Privacy policy and IP Act.[51]
10. VU submitted that Dr Neal's act of putting the Graduate Diploma students' email addresses into the BCC field was a mistake and an unfortunate accident. VU submitted whilst this accident resulted in the disclosure of Ms Kudleck's personal information, Dr Neal did not disclosure the personal information because he was not sufficiently aware of his privacy obligations or because of a lack of any deficiencies in VU's privacy or email policies or the way in which it trained or instructed staff members about those policies. VU submitted that Dr Neal accidently disclosed Ms Kudleck's personal information despite being very aware of his privacy obligations and how to use VU's email system, including the BCC field. VU submitted that in these circumstances, it is not apparent how VU could reasonably have prevented the accident from happening or why it should be found responsible for the accidental disclosure of the personal information. VU also submitted that this is not a case where deficiencies in training and instruction or policies amount to a failure to take reasonable precautions or exercise due diligence on VU's behalf leading to the accidental disclosure.

1. VU's Privacy policy is a 21 page document that appears to have come into effect in 2008 and was last updated on 7 July 2010. Section 1 of the Privacy policy is headed purpose and relevantly states:

The policy refers to the collection and handling of personal and health information by the University in a way that establishes a reasonable balance between an individual's right to control the use of their personal information, with the University's need to ensure that it can collect and use information with confidence in order to perform its functions.

The University must comply with privacy laws, principally the:

• Information Privacy Act (Vic) (2000)
• Health Records Act (Vic) 2001....

Victoria University has adopted the Information Privacy Principles and the Health Privacy Principles as minimum standards in relation to handling personal and health information which form part of the Information Privacy Act (Vic) (2000) and the Health Records Act (Vic) (2001).

1. The policy defines personal information,[52] sets out in what circumstances it will collect, use and disclose personal information[53] and states that compliance with policy is mandatory.[54] It also sets out an implementation and training plan, which includes a reference to on-going Privacy Awareness Training Sessions.[55]
2. VU's Privacy policy clearly states that personal information collected and held by VU will, wherever possible, be only accessed and handled as required by staff authorised to do so for the purposes of carrying out their duties and that on the whole, VU only uses or discloses information according to the purposes for which it was collected. The Privacy policy also states that occasionally VU may need to use or disclose personal information for another purpose but will only do so in ways consistent with the Information Privacy Principles.[56]
3. As stated in paragraph 32 above, Attachment 1 is a document headed "Students" and explains why VU collects personal information about students, what types of personal information it holds and in what circumstances personal information may be disclosed.

1. VU's Appropriate Use of Email policy is a five page document that came into effect in May 2005 and was last updated on 13 May 2009 (VU's Email policy). Section 2 of the email policy is headed background and relevantly states:

Email is a business communication tool and users are obliged to use this tool in a responsible, effective and lawful manner...

[I]t is important that users are aware of the legal risks of email:

• If you send emails with any libellous, defamatory, racist or obscene remarks, you and the University can be held liable.
• If you forward emails with any libellous, defamatory, racist or obscene remarks, you and the University can be held liable.
• If you unlawfully forward confidential information, you and the University can be held liable

By following the guidelines in this policy, the email user can minimise the legal risks involved in the use of e-mail. [57]

1. Section 5 is headed "Policy" and relevantly states:

Under no circumstances is any e-mail user authorised to engage in any activity that is illegal under state, federal or international law whilst utilising the University's owned or managed resources....

Avoid sending sensitive and restricted official information by email...

1. Sensitive information is defined as "information for internal University use and not for external distribution" and restricted information is defined as "information which is protected by University, Commonwealth and/or State regulation or legislation".[58] Ms Kudleck's personal information is clearly information that is protected by State legislation. It could also come within the definition of "confidential information".
2. The Email policy requires staff members to include the disclaimer set out at paragraph 26 above in emails that they send[59] and states that the Privacy Act 1988 (the predecessor to the IP Act) is relevant legislation.[60] It also states that training will be given in Staff Induction programs.[61]

1. I accept Dr Neal's evidence that he was familiar with and understood VU's Privacy and Email Policies and that he understood how to use the BCC field of an email. I also accept Dr Neal's evidence that when he sent the email chain to the Graduate Diploma students, he did so accidentally. Ms Kudleck did not dispute this.
2. Accordingly, I am satisfied that the disclosure of Ms Kudleck's personal information was not a result of Dr Neal being unaware of his privacy obligations or due to him misunderstanding his privacy obligations. I note that Ms Kudleck did not make any submissions that VU should have done more in relation to its Privacy policy.
3. I am also satisfied that the disclosure of Ms Kudleck's personal information was not a result of Dr Neal being unaware of VU's Email policy or due to him misunderstanding how to send information via email.
4. In these circumstances, I disagree with the submission of Ms Kudleck that a more "robust" email policy that specifically addressed the particular care staff members must take with emails containing allegations that a student had submitted work that was not his or her own work and when using student email lists was required in order for VU to be able to satisfy the Tribunal that it had taken reasonable precautions and exercised due diligence to avoid Dr Neal accidently disclosing personal information.
5. Rather, I am satisfied that VU had taken reasonable precautions and exercised due diligence to avoid an accidental disclosure of personal information via email by:
   • implementing a Privacy policy that sets out VU's staff members' obligations under the IP Act, particularly Information Privacy Principle 1 which deals with the collection of personal information and Information Privacy Principle 2, which deals with the use and disclosure of personal information
   • ensuring that VU staff members are made aware of the Privacy policy through training
   • implementing an email policy that sets out the legal risks associated with unlawfully forwarding confidential, sensitive or restricted information in an email and referring to the Privacy Act 1988 (albeit, the predecessor to the IP Act)
   • ensuring that VU staff members are made aware of the email policy through training, and
   • ensuring staff members understand how to use functions such as the BCC field of an email.
6. For these reasons, I find that VU did not contravene IPP 2.1.

DID THE SENDING OF THE EMAIL CHAIN CONTRAVENE IPP 4.1?

1. Ms Kudleck submitted that the sending of the email chain also contravened IPP 4.1 because VU failed to take reasonable precautions to protect the personal information it holds from misuse and from unauthorised disclosure.
2. For the reasons set out in paragraphs 101 to 105 above, I find that VU did not contravene IPP 4.1 because I am satisfied that VU took reasonable precautions and exercised due diligence to avoid Dr Neal misusing or disclosing Ms Kudleck's personal information in an unauthorised manner.

1. Ms Kudleck gave evidence that she suffered hurt, humiliation and mental anguish as a result of Dr Neal disclosing her personal information to the Graduate Diploma students when he forwarded the email chain to them. Dr Neal acknowledged and apologised for his mistake during the hearing.
2. However, under the IP Act, individuals cannot make claims against other individuals and organisations are not strictly liable for every mistake made by an employee. Whilst the mistake made by Dr Neal was a very unfortunate one and Ms Kudleck's response is entirely understandable, the IP Act does not provide her with a remedy in these circumstances.

1. For these reasons, I order that Ms Kudleck's application is dismissed.

[3] This is maximum amount of compensation that the Tribunal may order a complainant is entitled to under section 43(1)(a)(iii) of the IP Act.

[10] Ms Kudleck did not dispute what counsel for VU identified as being the personal information contained in the initial emails.

[12] See document 30 in the folder entitled "Documents replied on by the Respondent.

[16] As set out on pages 10 and 17 of VU's Privacy policy, Exhibit R41.

[18] See page 17, Exhibit R41. This is also a requirement under IPP 1.3.

[21] See section 6 on page 6 of Exhibit R40, which states that the Student Assessment and Progress policy is a related policy.

[22] Exhibit R4, emails from Ms Kudleck to Dr Neal dated 27 March 2011, 2 and 4 April 2011.

[23] See also Exhibits R30, R31, R35, R36, R43 and R44.

[25] Dr Neal referred to Exhibit R34 as an example of this.

[26] Dr Neal's oral evidence on 6 September 2013.

[27] Dr Neal's oral evidence on 4 September 2013.

[28] Exhibits R18 and R19. See also exhibit R45 and R4, the email of 4 April 2011 from Ms Kudleck to Dr Neal, which refers to the complaint made by the principal Meenah Marchbank.

[30] See the email of Bill Eckersley dated 3 June 2011 exhibit R37.

[31] See exhibits R20 and R21 and the evidence of Ms Kudleck that she was asked to attend two meetings subsequent to the email disclosure because of her academic performance in the course.

[35] See for example exhibit R20, which is a letter sent by Colleen Vale, one of the acting heads of school to Ms Kudleck requesting a meeting to discuss her progress and exhibit R21, which is a letter requesting a meeting between Jeanne Carroll, the student progress coordinator and Ms Kudleck to discuss her progress.

[40] As to the meaning of "necessary" in this context, VU relies on Ng v Department of Education [2005] VCAT 1054 [76]-[84].

[41] Macquarie Dictionary, 3rd Edition, 2002.

[43] See section 4 the Proceeds of Crime Act 1987 (Cth).

[45] See exhibit R38. Dr Neal's evidence was that the disclaimer was automatically inserted at the end of every email he sent using his Victoria University email address.

[46] See exhibit R37 and paragraph 12 above.

[47] See exhibit R37 and paragraph 14 above.

[48] See document 32 in the folder entitled "Documents replied on by the Respondent.

[50] See pages 9 and 11 of exhibit R42.

[51] See section 11.3 of page 9 of exhibit R41.

[52] See section 3.6 of exhibit R41.

[53] See sections 6.3 and 6.4 of exhibit R41.

[56] See section 6.4 of exhibit 41.

[57] Page 1 of document 3 in VU's folder entitled "Documents relied on by the Respondent".

[58] "Sensitive information" is also defined in Schedule 1 of the IP Act but Ms Kudleck's personal information does not come within that definition.

[59] See section 5.5 of the document referred to in footnote 57.

[60] See section 7.2 of the document referred to in footnote 57.

[61] See section 11.3 of the document referred to in footnote 57.