9-10 Digital Technologies: Data privacy and the Australian Privacy Principles Hangman

The 25 key terms

1personal data

Information that identifies you or can be linked to you, such as your name, birthday, address, photos or school. A favourite colour on its own is not personal data.

2digital footprint

The trail of data you leave online from what you do and post, like posts, comments, searches and photos, including data other people share about you.

3active and passive footprints

Active = data you choose to share, like posting a photo. Passive = data collected about you without you typing it, like cookies, location tracking or browsing history.

4sensitive information

A special kind of personal information, like health, ethnic origin, religion or biometric data, that the Privacy Act protects more strictly because misuse can cause serious harm.

5Privacy Act 1988

Commonwealth legislation that sets rules for how organisations must collect, use, and store people's personal information.

6Australian Privacy Principles (APPs)

13 legal principles in the Privacy Act 1988 that set rules for how organisations collect, use, store, give access to and correct personal information. Use them as a checklist.

7Australian Privacy Principle 1

Requires organisations to be open and transparent about managing personal information, with a clear, available, up-to-date policy.

8APP 2

Australian Privacy Principle 2: people can choose to stay anonymous or use a pseudonym with an organisation, unless that is impractical or the law requires them to identify themselves.

9APP 3

Australian Privacy Principle 3: only collect personal information that is reasonably necessary for your functions, and collect it lawfully and fairly. Take extra care with sensitive information.

10APP 5 notification

APP 5 says an organisation must tell people, at or before it collects their info, who is collecting it, why it is needed, and who it may be shared with.

11Australian Privacy Principle 6

Requires organisations to only use or disclose personal information for the purpose it was originally collected for, unless consent or an exception applies.

12APP 8

Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

13Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

14APP 12 and APP 13

Rights to ask an organisation for access to the personal information it holds about you (APP 12) and to have it corrected if it is wrong or out of date (APP 13).

15consent

Asking permission before collecting someone's personal data and explaining how it will be used. The person can say no. For young people, a parent or guardian may also need to agree.

16data minimisation

Only collect the personal data you need for your purpose. Less data means less risk, so skip unneeded questions, store data safely and delete it when finished.

17anonymise

To remove or replace names and other identifying details in data, like using ID numbers, so people cannot be recognised.

18privacy policy

A statement of what personal information a system collects, why, who it is shared with, and how you can access or correct it. Read it for these four points.

19data audit

A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.

20privacy setting

A switch in an app or account that controls who can see your information, like making it private or friends only.

21digital footprint management

Searching your own name, deleting old accounts and posts, tightening privacy settings and limiting app permissions to shrink your footprint, though copies others made may remain.

22data breach

When attackers get into an organisation's stored data, such as usernames and passwords. Find out through alerts, then change your password and turn on MFA.

23privacy by design

Building privacy into a solution from the start: collect minimal data, use anonymous IDs, make settings private by default and plan how data will be deleted.

24privacy check

A review of a data project that asks if you have consent, only collect what you need, hide names, and store the data safely, before you share it.

25APP critique

Check a system against one APP at a time: say what it does, judge if it meets that principle using evidence from the policy or audit, then suggest an improvement.