ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints Hangman

The 58 key terms

1Privacy

The right to keep your personal information and data safe from others without permission.

2personal data

Information that identifies you or can be linked to you, such as your name, birthday, address, photos or school. A favourite colour on its own is not personal data.

3sensitive information

A special kind of personal information, like health, ethnic origin, religion or biometric data, that the Privacy Act protects more strictly because misuse can cause serious harm.

4online account

A profile on a website or app that stores the personal data you give it, like your name and age. The company may share that data, so only give what is needed.

5digital footprint

The trail of data you leave online from what you do and post, like posts, comments, searches and photos, including data other people share about you.

6active and passive footprints

Active = data you choose to share, like posting a photo. Passive = data collected about you without you typing it, like cookies, location tracking or browsing history.

7digital permanence

Anything you post online can be copied, saved or shared by others, so it may never fully disappear, even if you delete it. Think before you post.

8cookie

A small file a website saves in your browser to remember you. Tracking cookies record what you do across different sites, often to show you targeted ads.

9metadata

Hidden details stored inside a photo or file, like the time, device and GPS location. It can add to your digital footprint when you share it, so check and remove it first.

10App permissions

Settings where each app asks to use your location, camera, microphone or contacts. You can allow or deny each one, or allow only while using the app, and review them any time.

11Privacy Act 1988

Commonwealth legislation that sets rules for how organisations must collect, use, and store people's personal information.

12APP entity

An organisation or government agency that must follow the Australian Privacy Principles under the Privacy Act 1988, such as federal agencies, health providers and larger businesses.

13Australian Privacy Principles (APPs)

13 legal principles in the Privacy Act 1988 that set rules for how organisations collect, use, store, give access to and correct personal information. Use them as a checklist.

14APP lifecycle groups

The 13 APPs grouped by what happens to data: openness (1-2), collection (3-5), use and disclosure (6-9), quality and security (10-11), access and correction (12-13).

15consent

Asking permission before collecting someone's personal data and explaining how it will be used. The person can say no. For young people, a parent or guardian may also need to agree.

16Australian Privacy Principle 1

Requires organisations to be open and transparent about managing personal information, with a clear, available, up-to-date policy.

17APP 2

Australian Privacy Principle 2: people can choose to stay anonymous or use a pseudonym with an organisation, unless that is impractical or the law requires them to identify themselves.

18APP 3

Australian Privacy Principle 3: only collect personal information that is reasonably necessary for your functions, and collect it lawfully and fairly. Take extra care with sensitive information.

19APP 4 unsolicited personal information

APP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

20APP 5 notification

APP 5 says an organisation must tell people, at or before it collects their info, who is collecting it, why it is needed, and who it may be shared with.

21Australian Privacy Principle 6

Requires organisations to only use or disclose personal information for the purpose it was originally collected for, unless consent or an exception applies.

22primary purpose

The reason personal information was collected. Under APP 6, check each proposed use against it. Any other use is a secondary use and needs consent or a legal exception.

23APP 7 direct marketing

APP 7 stops an organisation using or disclosing personal information for direct marketing unless conditions are met, such as the person's consent or an easy way to opt out.

24APP 8

Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

25APP 9

An organisation must not adopt a government identifier (e.g. Medicare or tax file number) as its own ID for a person. It should use its own customer ID, with limited exceptions.

26APP 10

Australian Privacy Principle 10: take reasonable steps to make sure the personal information you collect, use or disclose is accurate, up to date and complete.

27Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

28APP 12 and APP 13

Rights to ask an organisation for access to the personal information it holds about you (APP 12) and to have it corrected if it is wrong or out of date (APP 13).

29OAIC

The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.

30APP duties and rights

The APPs make organisations handle personal data responsibly (clear policy, minimal collection, security, correction) and give people rights: consent, anonymity, access, correction and complaint.

31privacy policy

A statement of what personal information a system collects, why, who it is shared with, and how you can access or correct it. Read it for these four points.

32data audit

A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.

33essential data

Data a system cannot do its purpose without. If the system could still work with it left out, the data is optional and does not need to be collected.

34APP critique

Check a system against one APP at a time: say what it does, judge if it meets that principle using evidence from the policy or audit, then suggest an improvement.

35data minimisation

Collecting only the data a form really needs. Remove extra questions, mark fields optional and use ranges, like an age range instead of a birth date.

37anonymise

To remove or replace names and other identifying details in data, like using ID numbers, so people cannot be recognised.

38participant code

A code such as P01 used instead of a name. Names and indirect identifiers like school or suburb are removed, and the key list linking codes to people is stored separately.

39filter

A filter shows only the rows that match a value you choose and hides the other rows. The hidden rows are not deleted. Clear the filter to see them all again.

40depersonalise

Save a copy first, then delete columns that identify people (name, address, birth date) so only data needed for analysis remains. Hiding is not enough when sharing.

41privacy by design

Building privacy into a solution from the start: collect minimal data, use anonymous IDs, make settings private by default and plan how data will be deleted.

42privacy check

A review of a data project that asks if you have consent, only collect what you need, hide names, and store the data safely, before you share it.

43privacy critique

List the data a solution collects, test each item against the relevant APPs as met, partly met or not met, then recommend changes that shrink the footprint.

44digital footprint management

Searching your own name, deleting old accounts and posts, tightening privacy settings and limiting app permissions to shrink your footprint, though copies others made may remain.

45security measures

Controls such as passwords, access control, encryption and backups that protect personal information in a dataset from misuse, loss or unauthorised access.

46Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

47permission

A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

48multi-factor authentication

A login step that asks for a second proof of identity, like a phone code or app prompt, as well as your password. A stolen password alone is not enough.

49Encryption at rest and in transit

Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.

50unique passphrase

A different passphrase for every account, so if one is leaked in a breach, criminals cannot use it to get into your other accounts. Change it straight away after a breach.

51password manager

A tool that stores and fills in many passwords for you, kept safe behind one strong master passphrase that only you know.

52data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

53Privacy Amendment (Notifiable Data Breaches) Act 2017

Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

54eligible data breach

Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).

55NDB scheme steps

Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.

56Lack of transparency

When people are not told what data is collected, how it is used or how a conclusion was reached, such as hidden data collection, unexplained AI decisions or unclear privacy policies.

57Misuse of personal data

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

58Data repurposing

When an AI system reuses or shares data collected for one purpose, such as training, without the knowledge or consent of the people it came from. Removing it from a trained model is hard.

59Ethical issue analysis

Name the issue, identify the stakeholders affected and the harm done, link it to an APP, then recommend an action to fix it.