Understanding Critiquing a system against the Australian Privacy Principles in VCE Data Analysis
What it does: This names one APP, gives a judgement (meets or does not meet) and a reason linked to the principle. The last step of a critique is a specific suggested improvement that fixes the problem found. A good critique takes one APP at a time, states what the system does, judges it with evidence and suggests an improvement. The judgement uses evidence. Contact lists are not needed to count steps, so the collection is not reasonably necessary. Evidence comes from the policy or the audit. For APP 5, check whether people are told about the collection at the time of collection.
Common mistakes: The audit shows no notice is given at sign-up, so the system does not meet APP 5. The line should say 'not met'. Protecting data from misuse and loss is APP 11 (security). APP 3 is about collecting data, so the critique names the wrong principle.
Quick Questions
1. A student critiquing a school app says: 'The app is bad for privacy.' What is wrong with this critique?
A. It does not name one APP, say what the system does, or give evidence ✓
B. It is too short, so it must be written in a longer paragraph with no evidence needed
A good critique takes one APP at a time, states what the system does, judges it with evidence and suggests an improvement.
2. Which sentence is the best first step when critiquing a fitness app against APP 3 (collecting only what is reasonably necessary)?
A. Recommend deleting the app before checking what data it collects
B. State what the app collects, such as name, email, location and contacts, using the data audit ✓
Start by stating what the system actually does. The data audit gives you the facts to judge against APP 3.
3. A step counter app collects the user's contact list, but its policy gives no reason for this. Which judgement is best for APP 3?
A. Does not meet APP 3: contacts are not reasonably necessary for counting steps ✓
B. Meets APP 3: the more data an app collects, the better it can work
The judgement uses evidence. Contact lists are not needed to count steps, so the collection is not reasonably necessary.
4. Which piece of evidence best supports a judgement about APP 5 (notifying people when collecting data)?
A. A guess that most users probably read the app's logo and colours
B. A quote from the privacy policy showing whether users are told what is collected and why when they sign up ✓
Evidence comes from the policy or the audit. For APP 5, check whether people are told about the collection at the time of collection.
5. A critique of a school quiz site against APP 6 (use and disclosure) finds that student results are shared with an advertising company. What should the critique say?
A. Does not meet APP 6: sharing results with advertisers is not the purpose they were collected for ✓
B. Meets APP 6: sharing data with other companies is always allowed if the site is free
APP 6 limits using or sharing data to the purpose it was collected for, unless an exception applies such as consent.
Fill in the Blanks
1. APP 5: tell people when you collect data
Hint: Type the APP number about notifying people when collecting their data
2. Step 2: judge if the system meets the APP
Hint: Type the verb for deciding whether the principle is met
3. Evidence: the policy and the data audit
Hint: Type the name of the check that lists what a system collects
4. Step 4: recommend a change to improve it
Hint: Type the verb for suggesting an improvement
5. APP 11: keep personal data secure
Hint: Type the APP number about the security of personal information
Spot the Error
Question 1
A
APP 5: notifying people
B
Does: no notice at sign-up
C
Evidence: audit row 3
D
Judge: met, no notice
E
Fix: add a collection notice
Line D — The audit shows no notice is given at sign-up, so the system does not meet APP 5. The line should say 'not met'.
Question 2
A
APP 3: protect personal data
B
Does: stores plain passwords
C
Evidence: policy, section 4
D
Judge: not met, data at risk
E
Fix: encrypt and limit access
Line A — Protecting data from misuse and loss is APP 11 (security). APP 3 is about collecting data, so the critique names the wrong principle.
Question 3
A
APP 3: necessary collection
B
Does: only asks for first name
C
Evidence: audit field list
D
Judge: not met, not needed
E
Fix: remove address field
Line B — The audit field list shows the system collects a home address. The 'Does' line must state what the system really does, which is asking for the home address.
Question 4
A
APP 6: using and sharing data
B
Does: shares emails with ads
C
Evidence: I think it is bad
D
Judge: not met, no consent
E
Fix: share only with consent
Line C — A critique needs evidence from the policy or the data audit. A personal opinion is not evidence. It should cite something like 'policy, section 6'.
Question 5
A
APP 1: open and clear policy
B
Does: policy is hidden in app
C
Evidence: link on home page
D
Judge: met, policy is public
E
Fix: add plain-English summary
Line B — The evidence is a link on the home page and the judgment is 'met'. The 'Does' line must match this and say the policy is easy to find.
