Reading a privacy policy

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which of these is something a privacy policy should tell you?

A How many people have downloaded the app

B What personal information the app collects and why

2. A policy says: 'We may share your details with our partners.' What is the problem?

A It is vague because it does not say who the partners are

B It is clear because it names exactly who gets your data

3. Which policy line clearly states how long data is kept?

A We delete your account data 12 months after you close your account.

B We keep your data for as long as we think is necessary.

4. You want to check who your information is shared with. Which part of the policy do you look for?

A The section on the app's colour scheme and fonts

B The section on disclosure or sharing with third parties

5. Which wording is vague and should make you ask questions?

A We may use your data for business purposes.

B We use your email address to send your order receipt.

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1We collect your name, email address and location.		AThis is the 'what is collected' point: it lists the types of personal information the system collects.
2We may share your details with trusted partners.		BWe delete your account data 12 months after you close your account.
3A clear policy says how long your data is kept, so you know when it will be deleted.		CThis does not say how long the data is kept. 'As long as we need it' is vague and gives no time period.
4A policy should tell you how to access or correct your personal information.		DEmail privacy@school.edu.au to see or fix the data we hold about you.
5We may use your data for business purposes.		EThe wording is vague. It does not say which data is used or why, so the 'why it is collected' point is not clear.
6We keep your information for as long as we need it.		FThis is the 'who it is shared with' point, but it is vague because 'trusted partners' is not named.

Definitions

Fill in the Blanks

Complete each line of code by filling in the missing parts.

policy.________ = ["name", "email"]

policy.___________ = ["advertisers"]

policy.________ = "2 years"

wording = "we may share with partners" IF wording is _____ THEN ask who exactly

policy.______ = "email the privacy officer"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A what ← "we value your privacy"

B why ← "to deliver your order"

C shared ← "courier company"

D kept ← "12 months"

Question 2

A what ← "name, school, grades"

B why ← "to report to parents"

C shared ← "12 months"

D kept ← "until end of year"

Question 3

A kept ← "as long as needed"

B IF no time period given THEN

C flag ← "clear"

D OUTPUT flag

Question 4

A what ← "name, email"

B why ← "to run your account"

C shared ← "payment provider"

D access ← "to run accounts"

Question 5

A shared ← "partners"

B IF shared is specific THEN

C note ← "ask who they are"

Answer Key

Reading a privacy policy

Section A: Quick Questions

B — What personal information the app collects and why

A — It is vague because it does not say who the partners are

A — We delete your account data 12 months after you close your account.

B — The section on disclosure or sharing with third parties

A — We may use your data for business purposes.

Section B: Match the Pairs

We collect your name, email address and location. → This is the 'what is collected' point: it lists the types of personal information the system collects.

We may share your details with trusted partners. → This is the 'who it is shared with' point, but it is vague because 'trusted partners' is not named.

A clear policy says how long your data is kept, so you know when it will be deleted. → We delete your account data 12 months after you close your account.

A policy should tell you how to access or correct your personal information. → Email privacy@school.edu.au to see or fix the data we hold about you.

We may use your data for business purposes. → The wording is vague. It does not say which data is used or why, so the 'why it is collected' point is not clear.

We keep your information for as long as we need it. → This does not say how long the data is kept. 'As long as we need it' is vague and gives no time period.

Section C: Definitions

privacy policy — A statement of what personal information a system collects, why, who it is shared with, and how you can access or correct it. Read it for these four points.

Section D: Fill in the Blanks

policy.collects = ["name", "email"]

policy.shared_with = ["advertisers"]

policy.kept_for = "2 years"

wording = "we may share with partners"
IF wording is vague THEN ask who exactly

policy.access = "email the privacy officer"

Section E: Spot the Error

A — The 'what' point should record the personal information that is collected, such as name, email and location. 'We value your privacy' is a slogan that says nothing about what is collected.

C — The 'shared' point should say who receives the data, such as parents only. '12 months' is a time period, which belongs in the 'kept' point.

C — 'As long as needed' gives no time period, so the wording is vague. Line 3 should set flag to "vague", not "clear".

D — The 'access' point should say how you can see or correct your information, such as asking the privacy officer. 'To run accounts' is a purpose, which belongs in the 'why' point.

B — 'Partners' does not say who the data is shared with, so the condition should be 'is not specific'. As written, the note to ask who they are would only run when the wording is already clear.