A naked photo of a female student taken secretly by another student on a mobile phone has sparked internal inquiries at the University of Sydney and a police investigation.

The inquiries have uncovered a minefield of ethical and legal questions, while the female student has accused the university of dealing inadequately with her complaint.

In written apologies to the complainant and her parents, the male student admitted he took a naked photo of them both during consensual sex in his campus accommodation and "showed it to other students".

The second-year students, now aged 20, were involved in a casual relationship until about May last year. The female student said she was worried copies of the photo might be online, although she had found no evidence of this.

Newtown police conducted an investigation into the incident early this year before deleting the image from the male student's phone. No charges were laid.

The university subsequently engaged an external solicitor to conduct a formal misconduct investigation. But it has refused on confidentiality grounds to disclose the punishment, if any, that was dealt to the student.

"Justice done in the dark can't be seen to be justice," the female student said.

The incident highlights the difficulty in seeking legal redress for invasions of privacy in Australia. In some cases, a person can sue for defamation over the unauthorised publication of explicit photos but legal action is costly and damages may be limited.

Privacy law expert Michael Park, a partner at Norton Rose Fulbright, said privacy was "front and centre" in the national debate over law reform.

"I think it's been generated probably over the last three to five years where there's been an increasing number of privacy breaches, many of them associated with new uses of technology," Mr Park said.

The Australian Law Reform Commission released a report in June setting out elements of a potential civil action for serious invasions of privacy that could be enacted by Federal Parliament.

Mr Park, who did not comment on the specific case, said this could give individuals the right to sue each other for serious invasions of privacy.

The female student said she was advised by police and a criminal lawyer that a prosecution could not be brought – assuming all the elements of an offence could be proven – because a statutory limitation period had passed.

A person can be jailed for up to two years in NSW for taking a photo of a person in a "state of undress" when they know the subject does not consent. The photo must be taken for the purposes of "sexual arousal or sexual gratification".

But there is a six-month time limit on commencing proceedings, starting from the date of the alleged offence. The female student was alerted to the photo after eight months.

"A photo doesn't stop being a photo after six months," she said.

She said that the police had offered her "a lot of support". But she was disappointed with the university's handling of her complaint and said she was being bullied and harassed by some students.

"Every time I enter Sydney University it's like being re-traumatised," she said. "I've had to go part-time, so that's extended my degree by one or two years."

The university facilitated a meeting between the students in May, during which the complainant read an "impact statement". But she said her reputation was "still tarnished" and she had wanted the university to facilitate further meetings and a public apology.

The University of Sydney said formal misconduct investigations were "undertaken not as an agent of the complainant but an action of its own". Accordingly, its decisions were a matter for the university and the subject of the investigation.

It said it took "the issue of bullying and safety on campus very seriously and actively promotes a safe learning environment for all its students".

The male student did not respond to requests for comment.

He said in a letter to the female student: "The result of my actions must have put you through traumatic and horrible experiences ... I apologise for abusing your trust and privacy."