The Rule organises its rules around a small set of recurring legal and administrative concepts that determine what is regulated and how decisions are made. These concepts are:

• Information infrastructure and information services (cl 4). The Rule treats physical spaces (libraries, laboratories, theatres), hardware, software, networks, cabling and services collectively as the “information infrastructure”. “Information services” is defined to include library, archive, records, computer, network and analogue and digital services. The breadth of these definitions converts a wide range of campus assets into regulated objects (cl 4, definitions of information infrastructure and information services).
• Authorised user accounts and authentication (s 6). Access is controlled by responsible officers who assign accounts and issue authentication credentials (s 6(2)-(3)). Accounts are defined to mean accounts assigned under s 6(2). Passwords and other credentials supplied by a responsible officer are the primary gating mechanism (cl 4, definitions; s 6).
• Responsible officers and the responsible executive (ss 6, 31, 43). These are the operational decision-makers. Responsible officers grant access and may apply further conditions (ss 6, 15). A responsible executive determines whether breaches are managed under this Rule or by other university/industrial frameworks (s 31(1)). The Vice‑Chancellor appoints responsible officers and may direct them (s 43).
• Prohibited conduct categories (Divisions 2.1 and 2.2). The Rule groups prohibitions: unauthorised access and account misuse (s 7), system security (s 10), professional presentation (s 11), limits on software and equipment use (s 12-13), interference with remote services (s 14), unethical or unlawful use (s 16), personal gain without VC approval (s 17), copying and copyright compliance (s 18), subversion of security (s 19), reputational material and spam (s 20), misrepresentations and impersonation (s 21), damage (s 22), nuisance/disturbance (s 23). Many prohibitions cross-reference other laws or policies; for example, s 12(3) requires compliance with the Copyright Act 1968 and relevant licence terms.
• Procedural controls for investigation, notice and penalties (Part 4). The Rule sets out how contraventions may be dealt with (s 31), the forms of penalties available to responsible officers (s 33), requirements for notice and an opportunity to make written representations before monetary penalties (s 35), the process and timeframes to impose suspensions (s 36), and the mechanics for compensation for damage up to specified caps (s 34).
• Internal appeal machinery with restricted representation and finality (Part 5). The Appeals Committee composition, time limits for appeals, procedural discretion for the committee, restricted external legal representation (s 41), and the Rule’s declaration that the Appeals Committee’s decision is final (s 42(4)) form a closed internal review loop.
• Interaction with other laws and instruments. The Rule expressly preserves coordination with the Copyright Act 1968 (ss 12(3), 18(d)-(e), 32(2)); the Privacy Act 1988 applies to examinations of information except where disclosure is required for substantiation of a contravention (s 25(2)). The Rule is made under the Governance Statute and interacts with other university legislation and orders made under the Governance Statute (ss 3, 31(1), 45).

These concepts convert operational choices into legal obligations. The Rule gives broad institutional actors (the Vice‑Chancellor, responsible executive and responsible officers) delegated power to define access, credentials, further conditions, investigatory processes (including examination of stored information, s 25), and to impose immediate exclusion and monetary penalties within statutory caps.

The Rule applies to any “user”, defined as a person, wherever located, who accesses the information infrastructure (cl 4, definition of user). That broad definition captures a range of stakeholders with differing legal status and incentives.

• Students and staff. These are obvious primary targets. The Rule repeatedly distinguishes students and staff from other users, for instance when defining “priority users” (s 9). Staff have additional obligations, for example duties to comply with intellectual property and licence requirements when using university-provided software and when developing commercially valuable software (ss 12(3), 13). The Vice‑Chancellor and responsible executive are decision-makers with delegated authority that affects staff and students in differing ways.
• Visitors, contractors and remote users. The definition of user is location-neutral. The Rule therefore applies to contractors, visiting researchers and remote users who access university systems from off-site. Section 9 addresses access priority when a user is not a staff member or student, although the drafting of that section is ambiguous in labelling who is the “priority user” (see “Gotchas”).
• People who use Library premises or borrow items. Part 3 applies to everyone who uses Library collections and premises, including the power to recall borrowed items, require return and to impose penalties for late return, loss, destruction or damage (ss 26-30). The librarian has powers to inspect bags and require identity, and to direct a person to leave the Library (s 30).
• People who create material on the information infrastructure. Creators face professional presentation obligations (s 11), copyright and licence compliance (ss 12(3), 18), and rules about personal gain requiring written Vice‑Chancellor approval (s 17).
• Users whose conduct implicates system security or the Privacy Act. Where the Vice‑Chancellor reasonably believes the infrastructure is being used contrary to law or University legislation, the Vice‑Chancellor may appoint staff to examine information stored on the infrastructure (s 25). Those appointed must comply with the Privacy Act 1988 in relation to information obtained through the examination, except for disclosure needed to substantiate or take action on the contravention (s 25(2)).

Who pays, concretely. Monetary penalties up to $500 may be imposed by a responsible officer for contraventions (s 33(1)(f)). Additional penalties for library borrowing, loss or damage are “prescribed by order” (ss 27(5), 28(1)(b), 29(2)) and are therefore amounts set outside this instrument. Compensation for repair or replacement is determined by the responsible officer within statutory caps (s 34). If unpaid, the University may bring recovery proceedings in a court as a debt (s 34(2)).

Who decides. Operational decisions about access, conditions and initial sanctions are vested in responsible officers and the responsible executive. The Appeals Committee hears appeals and its decisions are final within the Rule (s 42(4)). The Vice‑Chancellor appoints responsible officers and the Appeals Committee members for each appeal (ss 37, 43). The Rule therefore centralises decisive power in the university hierarchy while providing an internal appeal route.

Practical exclusions. The Rule excludes practising lawyers as “relevant persons” for representation at Appeals Committee hearings, allowing representation only by students, staff or registered trade union members (s 41(3)). The Rule also contemplates overlap with other frameworks, allowing the responsible executive to channel matters to disciplinary or industrial processes instead of this Rule (s 31(1)).

The Rule sets out a mixture of duties binding users, procedural rights for those facing sanctions, and administrative duties on responsible officers and the Vice‑Chancellor.

Duties on users

• Access and authentication: Users must not use the infrastructure unless authorised, must not permit others to use it unless authorised, must not use another person’s account, and must not use infrastructure for unauthorised purposes (s 7). Users must provide proof of identity when required by staff (s 8).
• Password and security duties: If a password is personal, the user must not disclose it (s 10(1)). Users must report inadvertently obtained unauthorised information or known security breaches immediately in the way prescribed by order (s 10(2)). Users must not find out passwords they are not authorised to know, introduce malicious software, copy or access others’ information without permission except where their duties as staff require it, or do anything that adversely affects system security (s 10(3)-(4)).
• Professional conduct and intellectual property: Users who create material sent over or published on the infrastructure must present it professionally (s 11). Users must obey Copyright Act requirements and licence terms for software provided by the University (s 12(3)). Users developing potentially commercially valuable software must comply with University IP legislation and policies (s 13).
• Behavioural constraints: Users must not use the infrastructure unethically, unlawfully or in ways detrimental to others’ rights or property (s 16). Using infrastructure for personal or third‑party financial gain requires prior written approval of the Vice‑Chancellor (s 17). Publishing spam, obscene, harassing, threatening or defamatory material is prohibited, including if published off‑site in a way that associates the University with the material (s 20). Misrepresentation of identity or authorship is prohibited (s 21). Causing nuisance or disturbing other users is prohibited (s 23).

Duties and powers on University officers

• Granting access and conditions: Responsible officers may grant access to all or parts of the infrastructure according to individual work or study requirements, may assign accounts and supply authentication, and may apply further conditions to the use of particular parts or services (s 6(1)-(3), s 15).
• Investigation: The Vice‑Chancellor may appoint a staff member to examine information stored on the infrastructure where the Vice‑Chancellor reasonably believes the infrastructure is being used in contravention of law, University legislation or an industrial agreement (s 25(1)). Appointees must comply with the Privacy Act in relation to information obtained, except for disclosure needed to substantiate contraventions (s 25(2)).
• Enforcement measures and penalties: Responsible officers may take a range of actions on finding contraventions, including reprimand, suspension of access for up to 20 working days, account closure, financial penalties (up to $500), determining conditions for access, and deciding compensation for damage within the caps in s 34 (ss 33-36). For suspensions, the responsible officer must give written notice and may extend the suspension until the contravention is finally dealt with, including appeal (s 36(2)-(4)).
• Procedural safeguards: The Rule requires notice of proposed penalties, a minimum 20 working day period to make written representations (unless a shorter period is agreed), and that responsible officers consider any representations before imposing penalties (s 35). A responsible officer who decides on a penalty must give written notice of the decision to the person and the responsible executive within 7 working days (s 33(7)).

Rights of persons facing sanctions

• Right to notice and to make written representations before a penalty is imposed (s 35(a)-(d)).
• Right of internal appeal to the Appeals Committee within 20 working days of written notice of the responsible officer’s decision (s 38).
• Right to be represented at the Appeals Committee hearing by a “relevant person” other than a practising lawyer, who may address and cross‑examine witnesses (s 41).
• The Appeals Committee must give an opportunity to present evidence and must provide written reasons within 7 working days of its decision (s 40(4), s 42(3)).

Interaction rights and limits

• The Rule allows concurrent immediate measures (directions to leave, suspensions) even if the matter is to be dealt with under other university legislation or industrial instruments (s 31(3)). However, such immediate measures must not be taken into account later when imposing penalties under the Rule or other instruments (s 31(4)). This creates an operational separation between immediate exclusion and later substantive sanction.
• Infringement interplay with Copyright Act 1968: if an act is both a contravention under the Rule and an offence under the Copyright Act, s 32(2) prevents imposition of a financial penalty under s 33(1)(f) if the person will be prosecuted under the Copyright Act.

The Rule sets out a graduated enforcement toolkit with both non-monetary and monetary sanctions, immediate exclusion powers, investigatory powers, and recoverable compensation for damage. The enforcement regime is operationalised by responsible officers, with an internal appeals route to the Appeals Committee.

Available sanctions and monetary limits

• Immediate directions to leave premises. Any member of staff may direct a person to leave University premises if the person contravenes a provision of Part 2. The person must leave immediately and not re-enter for 24 hours without a responsible officer’s permission (s 24(1)-(2)). Library staff may direct persons to leave the Library under s 30(5)-(6).
• Suspensions from information infrastructure. A responsible officer may suspend a person from using the information infrastructure, or a stated part of it, for an initial period not exceeding 20 working days (s 36(1)). Notice must be given before or within 1 working day after the suspension takes effect (s 36(2)). The suspension may be extended while the contravention is finally dealt with, including during appeal (s 36(3)-(4)).
• Administrative sanctions by responsible officers. On finding a contravention, a responsible officer may take a range of actions, including reprimand, recommend referral to other university or industrial processes, direct non-use of the infrastructure or Library for a period not exceeding 20 working days (s 33(1)(c)-(d)), close the person’s account (s 33(1)(e)), determine conditions for continued access (s 33(1)(g)), or combine these measures (s 33(1)(i)).
• Financial penalty ceiling. A responsible officer may impose a financial penalty not exceeding $500 (s 33(1)(f)). However, other monetary penalties for Library borrowing, loss, damage and late return may be “prescribed by order” under the Governance Statute and are not specified in the text of the Rule (see ss 27(5), 28(1)(b), 29(2)).
• Compensation for damage. If a responsible officer decides compensation is payable for damage, s 34 prescribes calculation rules and caps. For reparable damage, compensation is the lesser of the responsible officer’s estimated cost of repair and $5,000. For irreparable damage, compensation is the lesser of the responsible officer’s estimated cost (including reasonable administrative costs) of replacement and $5,000 (s 34(1)). The University may still recover any unpaid portion of repair or replacement costs in court in addition to recovery costs (s 34(2)).
• Enforcement of payment via service restrictions. If a person is liable to pay financial penalties or compensation and does not pay within the time required, the University may bar the person from borrowing from the Library, using the Library or using the information infrastructure until payment is made, unless a responsible officer grants permission (s 33(6), s 27(6), s 28(5), s 29(5)).

Procedural guardrails

• Notice and opportunity to be heard. A penalty under ss 33(1)(c)-(i) may be imposed only if the person has been given written notice of the contravention and the penalty proposed, accompanied by a copy of s 35 and Part 5, and a period of not less than 20 working days (or a shorter agreed period) has elapsed to permit written representations, which the responsible officer must consider (s 35(a)-(d)). This creates a pre‑imposition procedural right to make written representations.
• Time limits for decision communication. A responsible officer must notify the person and the responsible executive in writing of a decision under s 33 within 7 working days of making the decision (s 33(7)).
• Appeal process. The internal appeal route is s 38 for persons found to have contravened the Rule, with a 20 working day window to lodge an appeal following notice of the responsible officer’s decision (s 38(2)). The Appeals Committee’s decision is final under the Rule (s 42(4)).
• Representation limits at appeals. At Appeals Committee hearings, appellants may be accompanied by a “relevant person”, defined to exclude practising lawyers, i.e. representation is limited to students, staff or members of registered trade unions (s 41(1)-(3)). The relevant person may advise, address the Committee and examine witnesses (s 41(2)).

Enforcement discretion and overlapping frameworks

• Choice of forum. The responsible executive may decide whether a contravention is dealt with under this Rule or referred to other University legislation or industrial instruments (s 31(1)). The Rule provides that a person may not be held accountable more than once for the same contravention (s 31(2)), while also permitting immediate directions or suspensions regardless of which instrument deals with the matter (s 31(3)). Importantly, such directions or suspensions must not be taken into account in imposing later penalties under this Rule or other instruments (s 31(4)).
• Interaction with external law. If an act is both a contravention and an offence under the Copyright Act 1968, the Rule bars imposing a financial penalty under s 33(1)(f) if the person is to be prosecuted under the Copyright Act (s 32(2)). The Rule also requires compliance with the Privacy Act 1988 during information examinations, except where disclosure is necessary to substantiate or take action on the contravention (s 25(2)).

Practical enforcement implications

• Immediate exclusion powers are relatively simple for staff to deploy: direction to leave (s 24) and suspension (s 36) require limited procedural steps and can be applied quickly. Suspensions may be extended pending final determination, including appeal, which can prolong exclusion from services (s 36(3)).
• Financial penalties are small in absolute terms (maximum $500), but the Rule supplements monetary measures with operational penalties (account closure, suspension, access conditions, denial of borrowing or use of facilities) which can have operational impact on users.
• Compensation for damage carries higher caps, up to $5,000 per incident for repair or replacement, with court recovery possible for unpaid amounts (s 34). The University retains avenues to recover larger costs through external courts beyond the responsible officer’s capped decision.

The Rule expressly interacts with a narrow set of external statutes, university statutes and orders. The instrument references and defers to other legal regimes where applicable; it both imports obligations and sets limits to avoid incompatible double penalties.

Explicit statutory interactions

• Copyright Act 1968. The Rule repeatedly cross-references the Copyright Act. Section 12(3) obliges users to comply with the Copyright Act and licence terms for software provided by the University. Section 18(d)-(e) and (f) make it an offence under the Rule to make available material or otherwise contravene the Copyright Act using university infrastructure. Critically, section 32(2) prevents the imposition of a financial penalty under s 33(1)(f) for conduct that is to be prosecuted under the Copyright Act, preserving the prosecution option under federal copyright law.
• Privacy Act 1988. Section 25(1) empowers the Vice‑Chancellor to appoint staff to examine information stored on the infrastructure where there are reasonable grounds to suspect contraventions of law or University legislation. Section 25(2) imposes a duty to comply with the Privacy Act in relation to information obtained through any such examination, except for disclosure for the purpose of substantiating or taking action in relation to the contravention. This balances investigatory powers with the Privacy Act’s protections but allows disclosure necessary for enforcement.
• Governance Statute and Legislation Statute. The Rule is made under the Governance Statute s 68(1) (cl 3). Transitional provisions reference the Legislation Statute s 26 concerning repeal of previous university legislation and preservation of savings (ss 44-46). Orders made under the Governance Statute s 68(1) can prescribe transitional matters and the amounts or processes for penalties that are “prescribed by order” under the Rule (s 45).

Interactions with internal university instruments

• Other University legislation and industrial instruments. The responsible executive may elect to have a contravention dealt with under the Discipline Rule, Medical Leave Rules or other relevant University legislation, or under a relevant industrial award, enterprise agreement or workplace agreement (s 31(1)). The Rule prevents double punishment for the same contravention (s 31(2)), but permits immediate directions or suspensions regardless of which instrument handles the matter (s 31(3)). Those immediate measures cannot be counted in later penalty calculations (s 31(4)).
• Orders under the Governance Statute. Several amounts and procedures are left to be prescribed by order under the Governance Statute. For example, penalties for failing to return Library items, loss or destruction, and damage are prescribed by order (ss 27(5), 28(1)(b), 29(2)). Reporting processes for security incidents are to be prescribed by order (s 10(2)). These orders will determine many operational details that the Rule itself leaves open.
• University policies and IP rules. The Rule mandates compliance with University legislation and policies regarding intellectual property where a user develops software with commercial potential (s 13), and requires compliance with licence terms for software provided (s 12(3)). Those separate policies will define obligations and potential revenue or ownership arrangements but are not contained within the Rule.

Conflict resolution and limits

• The Rule constrains the imposition of financial penalties in the presence of external criminal prosecution under the Copyright Act 1968 (s 32(2)). Otherwise, it leaves the responsible executive broad discretion to select the most appropriate internal mechanism (disciplinary, industrial or this Rule) for addressing contraventions (s 31(1)).
• For information examinations, the Rule requires compliance with the Privacy Act but permits disclosure necessary to substantiate contraventions (s 25(2)). This operates as an internal carve-out for specific enforcement needs while retaining statutory privacy obligations as the general rule.

What the Rule does not do

• The Rule does not specify criminal penalties or expressly create offences prosecutable in external courts except insofar as behaviours may also be offences under external statutes referenced by the Rule (for example the Copyright Act). The Rule’s penalties are primarily administrative and financial within an internal governance framework (Part 4).
• The Rule leaves amounts and some procedural details (e.g., reporting processes, certain monetary penalties) to be set by order under the Governance Statute (s 45). This means that the full operational impact cannot be assessed without those orders.

The text provided records the origin and immediate transitional disposition of the Rule, but contains no subsequent amendments. The instrument as enacted contains the following temporal and legislative history items.

• Making and date. The Rule is dated 22 December 2020 and states that the Vice‑Chancellor Professor Brian P. Schmidt made the Rule (opening lines). The Rule commences on 1 January 2021 (cl 2).
• Authority. The instrument is made under the Governance Statute s 68(1), the University’s general power to make rules and orders (cl 3).
• Transitional treatment of the prior rule. Section 44 preserves the application of the Information Infrastructure and Services Rule 2015 to acts or omissions that occurred before the commencement of the 2020 Rule. The 2015 Rule was repealed by the Australian National University (Repeal) Statute 2020, and s 44(2) confirms that the repealed 2015 Rule continues to apply to pre-commencement acts or omissions where it previously applied.
• Transitional orders and statute application. Section 45 allows orders under the Governance Statute s 68(1) to prescribe transitional matters, including savings and application provisions relating to the repeal of the 2015 Rule and the making of the 2020 Rule. Section 46 applies the Legislation Statute s 26 to the repeal of the 2015 Rule, treating provisions of Part 7 of the 2020 Rule as transitional provisions. Section 47 confirms that Part 7 is additional to other transitional provisions available under relevant statutes (Governance Statute Part 10, Legislation Statute s 26 and Part 6, and Acts Interpretation Act s 7 as applied by the Legislation Act).
• No further history in the instrument. The instrument text contains no amendments, side notes of subsequent changes, or delegated legislation text. The amounts of certain penalties and some reporting or procedural details are delegated to orders, but those orders are not included in the instrument text provided.

In short, the Rule replaces the 2015 Rule for acts from 1 January 2021 onwards, while maintaining the 2015 Rule for pre-commencement acts. Any changes to monetary penalties or operational procedures are implementable by orders under the Governance Statute, but no actual orders appear in this instrument.

The Rule as provided contains no litigation history, and names no cases. The instrument does not reference judicial decisions, tribunal determinations, or any litigation arising from its provisions. It does not cite or rely upon case law.

Because the Rule establishes internal administrative procedures and internal appeal mechanisms whose decisions are final within the Rule (s 42(4)), any litigation would be external to the instrument text. The instrument itself does not reserve or exclude judicial review rights in superior courts, nor does it provide for external review mechanisms. The Rule specifies that the Appeals Committee decision is final, but this statement operates within university legislation and does not, in and of itself, define the availability of external judicial review under public law; the instrument contains no text addressing litigation rights or limitations.

Consequently, from the instrument alone there is no recorded litigation history to report. Any actual litigation relating to the Rule or to the earlier 2015 Rule would need to be identified from court or tribunal records, which are not part of this instrument.

Several features and drafting choices in the Rule create practical risks, procedural uncertainties and potential implementation traps that a practitioner or compliance officer should note.

1. Broad definitional scope of “information infrastructure”. The Rule defines information infrastructure to include buildings, permanent installations, cabling, capital equipment, and services used to hold or carry information (cl 4). That breadth brings physical spaces such as laboratories and theatres within the Rule’s reach. It also blurs the boundary between IT rules and general campus conduct rules, potentially creating uncertainty about whether a particular physical activity falls under Part 2 or another instrument.

2. Delegated and concentrated discretion. Responsible officers and the responsible executive have wide discretion: they grant access, assign accounts and authentication (s 6); apply further conditions to particular parts of the infrastructure (s 15); decide whether contraventions are handled under this Rule or under other University or industrial processes (s 31(1)); and impose penalties within statutory caps (s 33). The Vice‑Chancellor appoints responsible officers and may direct them (s 43). These concentrated delegations require robust internal procedural controls to avoid inconsistent application.

3. Ambiguity in “priority user” drafting. Section 9’s drafting is confusing: it begins “If a user of the information infrastructure is not a member of staff or student of the University (a priority user), the user must, if requested by a priority user, cede use …” The parenthetical appears to mislabel non-staff/non-student as “priority user”, which is likely unintended and may cause interpretive disputes about who must cede use to whom. Practitioners should treat s 9 with caution and seek clarification in orders or policy.

4. Penalty amounts partly delegated to orders. Several penalties are “prescribed by order” (ss 27(5), 28(1)(b), 29(2)) but the Rule does set a $500 ceiling for financial penalties imposed under s 33(1)(f). Because orders under the Governance Statute may set other monetary amounts, the full penalty regime cannot be assessed without reviewing those orders. This delegation also creates a potential temporal mismatch where penalties in orders change without corresponding update to staff or users.

5. Suspension extension pending appeal. A responsible officer may extend a suspension until the contravention is finally dealt with, including during appeals (s 36(3)). This means a user can be kept from access for extended periods pending internal appeal resolution, even if the appeal succeeds. The Rule does not provide a clear reinstatement remedy pending appeal.

6. Limited external representation at appeals. Practising lawyers are excluded from the definition of “relevant person” for representation at Appeals Committee hearings, limiting legal advocacy in appeals (s 41). Parties must rely on students, staff or registered trade union members to act for them. The Rule also declares Appeals Committee decisions final (s 42(4)), which can reduce avenues for re‑argument within university processes.

7. Immediate measures not counted in later penalties. The Rule allows immediate directions to leave and suspensions irrespective of which instrument deals with the substantive contravention, but expressly bars treating those measures as part of subsequent penalties (s 31(3)-(4)). That separation can produce short-term enforcement but may result in perceived low net penalties if immediate exclusions are not reflected in final sanctions.

8. Privacy carve-out for enforcement disclosures. Section 25(2) requires compliance with the Privacy Act 1988 when examining information, except in relation to disclosure for substantiating or taking action on a contravention. That exception authorises disclosure for enforcement but could create conflict about what disclosures are necessary and proportionate, particularly when sensitive personal data are involved.

9. Reporting and procedural requirements left to orders. The Rule requires security incidents to be reported “in the way prescribed by order” (s 10(2)), but the order is not included. Absent an accessible order, users and staff may lack clarity on incident reporting channels and timeframes.

10. Interaction with criminal prosecutions under the Copyright Act. Section 32(2) prevents imposition of a financial penalty if the person is to be prosecuted for an offence under the Copyright Act. This may produce strategic choices for the University between civil administrative penalties and criminal referral, and could affect consistency of enforcement.

11. Potential operational consequences for commercialisation. Section 13 obliges users who develop commercially valuable software on university infrastructure to comply with University IP legislation and policies. Those policies may require disclosure or assignment of rights; the Rule does not state the policy details, so developers must consult IP policies to understand ownership, revenue sharing or approval processes.

12. Finality language may be interpreted as internal only. The Rule states Appeals Committee decisions are final (s 42(4)). That is a statement of internal finality; it does not address external legal remedies such as judicial review. However, stakeholders may read “final” as foreclosing other remedies. Clarification from the University would be prudent.

Compliance requires operational controls, clear policies, and training that align with the Rule’s specific obligations, procedural rights and delegated discretion. The following practical checklist maps Rule provisions to actions a University unit, responsible officer, or user should take.

For University governance and responsible officers

1. Appointments and delegations.

   • Ensure the Vice‑Chancellor’s written appointments of responsible officers comply with s 43, and set any conditions, limitations or directions in writing (s 43(1), (3)). Record delegated authorities to grant access, suspend users and impose sanctions.

2. Policies and orders.

   • Publish orders prescribed under the Governance Statute that the Rule relies on, including prescribed penalties for Library items (ss 27-29), reporting procedures for security incidents (s 10(2)), and any transitional orders (s 45). Make these orders publicly available alongside the Rule to avoid uncertainty.
   • Adopt, publish and maintain clear IP and software licence policies referred to in ss 12(3) and 13, indicating reporting obligations and ownership arrangements for commercially valuable software developed on university infrastructure.

3. Access control and account management.

   • Implement account lifecycle processes matching s 6: account creation, authentication issuance, account suspension and closure rules, and password policies that enforce the prohibition on disclosure for personal passwords (s 10(1)).
   • Use logging and audit trails to support investigations and to provide evidence when issuing notices under s 35 and s 33.

4. Incident reporting and response.

   • Establish incident reporting channels and a response playbook reflecting the form “prescribed by order” (s 10(2)). Ensure staff know to report inadvertent access or security breaches immediately, and that responsible officers act promptly under s 10(2).

5. Investigations and privacy.

   • Create a checklist for s 25 examinations, ensuring any appointed investigator complies with the Privacy Act 1988 in collecting, storing and using information, and documents any disclosure made for the purpose of substantiating or taking action.

6. Training and communications.

   • Provide regular training to staff, students and contractors on authorised use, password responsibilities, copyright and licence compliance, the prohibition on using infrastructure for financial gain without VC written approval (s 17), and Library obligations (Part 3).
   • Publish clear guidance on what constitutes “professional presentation” for materials (s 11) and on acceptable behaviour regarding spam, harassment and defamatory material (s 20).

7. Consistency and decision records.

   • Maintain written records of all notices under s 35 and decisions under s 33, including the responsible officer’s reasons, copies of any written representations, and the date the decision was communicated to the person and responsible executive (s 33(7)). These records are essential for appeals and for demonstrating procedural fairness.

For Library managers

1. Borrowing and recall.
   • Publicise borrowing periods as prescribed by order for s 27(1), the conditions for recall (s 27(2)), and the penalties prescribed by order for late return, loss and damage (ss 27(5), 28(1)(b), 29(2)).
2. On‑site inspections and behaviour.
   • Implement ID production processes and bag inspection procedures consistent with s 30, training staff on conducting inspections lawfully and courteously and documenting incidents, directions to leave (s 30(5)) and any resulting penalty notices.

For individual users (students, staff, contractors)

1. Authentication and passwords.

   • Do not disclose personal passwords issued by the University (s 10(1)). Use only accounts authorised to your role, and ask a responsible officer if uncertain (s 6(4)). Do not use another person’s account or permit others to use your account (s 7).

2. Security and reporting.

   • Report inadvertently accessed information or suspected breaches immediately in the prescribed way (s 10(2)). Do not attempt to discover passwords you are not authorised to know or introduce malware (s 10(3)(a)-(b)).

3. Intellectual property and software use.

   • Comply with the Copyright Act and any licence terms for software supplied by the University (s 12(3)). If developing potentially commercially valuable software using university infrastructure, follow the University’s IP policies and declaration procedures (s 13).

4. Professional conduct and communications.

   • Present materials professionally (s 11). Do not publish spam or obscene, harassing, threatening or defamatory material, including off‑site material that associates the University with such content (s 20). Do not impersonate another person or misrepresent your university role (s 21).

5. Library responsibilities.

   • Return borrowed items within prescribed periods, comply with recall notices from the University Librarian, report lost or destroyed items in writing, and pay prescribed penalties or risk suspension of Library privileges (ss 27-29). Produce ID and permit inspections when required (s 30).

If subject to enforcement action

1. Notice and making representations.

   • If you receive written notice under s 35, prepare and lodge written representations within the 20 working day period or a shorter agreed period, and keep proof of submission. Responsible officers must consider written representations before imposing penalties (s 35(d)).

2. Appeals.

   • If a penalty or finding is made, note the 20 working day window to lodge an appeal to the Appeals Committee (s 38(2)). Arrange for a “relevant person” (student, staff or registered union member) to assist at the hearing because practising lawyers are excluded from being relevant persons (s 41).

3. Payment and access consequences.

   • If a financial penalty or compensation is imposed, pay within 20 working days of the notice, or the person’s access to the Library and information infrastructure may be restricted until payment is made (s 33(5)-(6)).

Risk mitigation and governance controls

• Publish a consolidated guidance pack combining the Rule, any orders made under the Governance Statute, the IP policy, software licence rules and the privacy and incident response procedures, so users and staff can find all operational requirements in one place.
• Define and publish service level agreements for account provisioning, suspension procedures, notice templates and timelines for appeal handling to reduce variability in application of discretionary powers.
• Keep forensic and audit logs to support s 25 examinations and to document chain of custody for evidence that may be required to substantiate contraventions, while ensuring Privacy Act compliance for any personal data accessed.

Following these steps aligns operational practice with the Rule’s specific statutory requirements, reduces uncertainty caused by delegated orders and discretionary powers, and preserves users’ procedural rights under ss 35 and 38.