Auditing the data an existing system collects

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student is auditing a school canteen app. Which list is the better start to a data audit?

A Name (typed in), location (GPS permission), device ID (collected passively), each with a reason

B Only the name and email the student typed into the sign-up form

2. Which statement about a data audit is correct?

A It only counts how many users the system has

B It records the reason for collecting each data item

3. A weather app asks for permission to use your location, camera and contacts. In a data audit, what should you do with the camera and contacts permissions?

A List them as data the app can access and ask what the reason is for each

B Leave them out because the app is only about weather

4. Which of these is data collected passively?

A A tracking cookie that records which pages you visit

B The username you type into a sign-up form

5. Which row from a data audit table is complete?

A Location | collected by GPS permission | (no reason given)

B Location | collected by GPS permission | shows nearby shops

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Permission: Location \| Reason: show nearby canteens		AIt leaves out data collected passively, such as app permissions, cookies and trackers, so the audit is incomplete.
2Cookie: _ads_id \| Reason: ???		BIt only lists the items and gives no reason for collecting each one. It also misses passive data such as location and cookies.
3A data audit lists data the user types in as well as data collected passively		CA tracker found in the audit that has no recorded reason, so it should be questioned or removed
4Every item in a data audit is listed with the reason it is collected		DItem: birthdate \| Reason: check age limit
5Audit: name, email, password		EAn audit entry for data collected passively through an app permission, with the reason it is collected
6Audit of app: only fields in the sign-up form		FTyped: name, email \| Passive: location, cookies

Definitions

data audit

Fill in the Blanks

Complete each line of code by filling in the missing parts.

item: email | source: _____ | reason: login

permission: ________ | reason: find shops

item: ad id | source: ______ | reason: ads

item: age | source: typed | ______: age rule

item: contacts | source: __________ reason: find friends who use the app

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A AUDIT Weather app

B email | typed | log in

C name | typed | greet user

D GPS | typed | forecast

Question 2

A AUDIT Quiz game

B username | typed | leaderboard

C cookie | passive |

D age | typed | set difficulty

Question 3

A AUDIT Shop website

B tracker | typed | show ads

C email | typed | send receipt

Question 4

A SET audit TO empty list

B FOR each app permission

C ADD item, reason TO list

D END FOR

Question 5

A SET audit TO empty list

B FOR each cookie on the site

C ADD cookie TO audit

D END FOR

Answer Key

Auditing the data an existing system collects

Section A: Quick Questions

A — Name (typed in), location (GPS permission), device ID (collected passively), each with a reason

B — It records the reason for collecting each data item

A — List them as data the app can access and ask what the reason is for each

A — A tracking cookie that records which pages you visit

B — Location | collected by GPS permission | shows nearby shops

Section B: Match the Pairs

Permission: Location | Reason: show nearby canteens → An audit entry for data collected passively through an app permission, with the reason it is collected

Cookie: _ads_id | Reason: ??? → A tracker found in the audit that has no recorded reason, so it should be questioned or removed

A data audit lists data the user types in as well as data collected passively → Typed: name, email | Passive: location, cookies

Every item in a data audit is listed with the reason it is collected → Item: birthdate | Reason: check age limit

Audit: name, email, password → It only lists the items and gives no reason for collecting each one. It also misses passive data such as location and cookies.

Audit of app: only fields in the sign-up form → It leaves out data collected passively, such as app permissions, cookies and trackers, so the audit is incomplete.

Section C: Definitions

data audit — A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.

Section D: Fill in the Blanks

item: email | source: typed | reason: login

permission: location | reason: find shops

item: ad id | source: cookie | reason: ads

item: age | source: typed | reason: age rule

item: contacts | source: permission
reason: find friends who use the app

Section E: Spot the Error

D — GPS location is not typed in by the user. The app gets it passively through a permission, so the source should be 'permission'.

C — A data audit must record a reason for every item. The cookie row has no reason, so it needs one, such as 'save login'.

B — A tracker collects data without the user typing anything. Its source should be 'passive', not 'typed'.

C — The list was created with the name audit, so the items must be added to audit. 'list' has not been created.

C — Each audit entry needs the reason for collecting the cookie as well as the cookie itself. It should be ADD cookie, reason TO audit.