Implications of the APPs for organisations and individuals

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which of these is a duty the APPs place on an organisation?

A Choose which passwords its customers use

B Keep personal information secure from misuse and loss

2. Which of these is a right the APPs give to an individual?

A Ask to see the personal information an organisation holds about you

B Demand a free copy of the organisation's whole database

3. A student finds their birthday is wrong in a shop's records. What can they do under the APPs?

A Ask the shop to correct it

B Nothing, because records can never be changed

4. Which statement about compliance is more accurate?

A Following the APPs costs organisations nothing

B Following the APPs takes time, staff training and money for organisations

5. An app asks for your home address just to show you a joke of the day. Which APP duty is it likely breaking?

A Collecting only what is reasonably necessary (APP 3)

B Letting people access their own information (APP 12)

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1if (!hasPolicy) publishPolicy()		Apassphrase = unique(); readPolicy()
2user.requestAccess(myData)		BThe organisation ignores a request to fix wrong data. Under APP 13 it must take reasonable steps to correct the information.
3Following the APPs costs organisations time and money, for example staff training and security upgrades.		Cbudget += training + encryption
4Individuals still need to protect themselves, for example by using strong passphrases and reading privacy policies.		DThe form collects far more than a newsletter needs. APP 3 says to collect only what is reasonably necessary, such as an email address.
5newsletter.require(name, dob, address, tfn)		EOrganisation duty: have a clear, up-to-date privacy policy (APP 1).
6if (user.reportsError) ignore()		FIndividual right: ask an organisation to show you the personal information it holds about you (APP 12).

Definitions

APP duties and rights

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Org duty: collect only _________ data

Org duty: _______ inaccurate data

Person's right: ask to ______ your data

Cost for org: time to update the ______

Your job: choose a strong __________

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A user = {"name": "Sam"}

B user["consent"] = True

C if not user["consent"]:

D collect(user)

Question 2

A def access_request(person):

B return records["admin"]

C print(access_request("Sam"))

Question 3

A news_needs = ["email", "tfn"]

B for item in news_needs:

C ask_user(item)

Question 4

A def complain(org, issue):

B if org.resolve(issue):

C return "Resolved"

D return "Give up"

Question 5

A def join_forum(name=None):

B if name is None:

C refuse_entry()

D return name

Answer Key

Implications of the APPs for organisations and individuals

Section A: Quick Questions

B — Keep personal information secure from misuse and loss

A — Ask to see the personal information an organisation holds about you

A — Ask the shop to correct it

B — Following the APPs takes time, staff training and money for organisations

A — Collecting only what is reasonably necessary (APP 3)

Section B: Match the Pairs

if (!hasPolicy) publishPolicy() → Organisation duty: have a clear, up-to-date privacy policy (APP 1).

user.requestAccess(myData) → Individual right: ask an organisation to show you the personal information it holds about you (APP 12).

Following the APPs costs organisations time and money, for example staff training and security upgrades. → budget += training + encryption

Individuals still need to protect themselves, for example by using strong passphrases and reading privacy policies. → passphrase = unique(); readPolicy()

newsletter.require(name, dob, address, tfn) → The form collects far more than a newsletter needs. APP 3 says to collect only what is reasonably necessary, such as an email address.

if (user.reportsError) ignore() → The organisation ignores a request to fix wrong data. Under APP 13 it must take reasonable steps to correct the information.

Section C: Definitions

APP duties and rights — The APPs make organisations handle personal data responsibly (clear policy, minimal collection, security, correction) and give people rights: consent, anonymity, access, correction and complaint.

Section D: Fill in the Blanks

Org duty: collect only necessary data

Org duty: correct inaccurate data

Person's right: ask to access your data

Cost for org: time to update the policy

Your job: choose a strong passphrase

Section E: Spot the Error

C — Organisations should collect personal data only when the person has given consent. The condition must be if user["consent"]: so data is collected only when consent is True.

B — People have the right to access their own personal information. The function must return records[person], not another person's record such as the admin's.

A — Organisations must collect only what is reasonably necessary. A newsletter only needs an email address, so asking for a tax file number is excessive. The list should be ["email"].

D — Individuals can complain to the OAIC if the organisation does not fix a problem. Giving up skips that right. It should be return oaic.submit(issue).

C — People have the right to deal with an organisation anonymously or with a pseudonym where practical. Refusing entry when no name is given breaks this. The code should assign a pseudonym like "anon_" + uid().