Critiquing a system against the Australian Privacy Principles
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. A student critiquing a school app says: 'The app is bad for privacy.' What is wrong with this critique?
2. Which sentence is the best first step when critiquing a fitness app against APP 3 (collecting only what is reasonably necessary)?
3. A step counter app collects the user's contact list, but its policy gives no reason for this. Which judgement is best for APP 3?
4. Which piece of evidence best supports a judgement about APP 5 (notifying people when collecting data)?
5. A critique of a school quiz site against APP 6 (use and disclosure) finds that student results are shared with an advertising company. What should the critique say?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1What the system does: The app asks for a home address when students sign up for a quiz. | AImprovement: Remove the address field and ask only for a username. | |
| 2Evidence: Section 4 of the policy says data is shared with 'trusted partners'. | BThis gives no judgement against the principle, no evidence and no specific improvement. It is vague opinion. | |
| 3Judging one principle at a time, for example APP 3 on collecting only what is reasonably necessary | CThe first step of a critique: describe what the system actually does, using facts from the audit. | |
| 4Recommending a change after a judgement, so the system can better meet the APP | DEvidence from the policy or audit that backs up your judgement, such as a quote or a line from the data audit. | |
| 5APP 5: The app is bad for privacy. It should be better. | EAPP 3: Does not meet. A quiz app does not need a home address. | |
| 6APP 6: The app meets all the APPs because it looks safe. | FIt covers every APP at once and gives no evidence. A critique must take one APP at a time and use the policy or audit. |
C
Definitions
APP critique
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
APP _: tell people when you collect data
2.
Step 2: _____ if the system meets the APP
3.
Evidence: the policy and the data _____
4.
Step 4: _________ a change to improve it
5.
APP __: keep personal data secure
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
APP 5: notifying people
B
Does: no notice at sign-up
C
Evidence: audit row 3
D
Judge: met, no notice
E
Fix: add a collection notice
Question 2
A
APP 3: protect personal data
B
Does: stores plain passwords
C
Evidence: policy, section 4
D
Judge: not met, data at risk
E
Fix: encrypt and limit access
Question 3
A
APP 3: necessary collection
B
Does: only asks for first name
C
Evidence: audit field list
D
Judge: not met, not needed
E
Fix: remove address field
Question 4
A
APP 6: using and sharing data
B
Does: shares emails with ads
C
Evidence: I think it is bad
D
Judge: not met, no consent
E
Fix: share only with consent
Question 5
A
APP 1: open and clear policy
B
Does: policy is hidden in app
C
Evidence: link on home page
D
Judge: met, policy is public
E
Fix: add plain-English summary
Answer Key
Critiquing a system against the Australian Privacy Principles
Section A: Quick Questions
Q1
A — It does not name one APP, say what the system does, or give evidence
Q2
B — State what the app collects, such as name, email, location and contacts, using the data audit
Q3
A — Does not meet APP 3: contacts are not reasonably necessary for counting steps
Q4
B — A quote from the privacy policy showing whether users are told what is collected and why when they sign up
Q5
A — Does not meet APP 6: sharing results with advertisers is not the purpose they were collected for
Section B: Match the Pairs
Q1
What the system does: The app asks for a home address when students sign up for a quiz. → The first step of a critique: describe what the system actually does, using facts from the audit.
Q2
Evidence: Section 4 of the policy says data is shared with 'trusted partners'. → Evidence from the policy or audit that backs up your judgement, such as a quote or a line from the data audit.
Q3
Judging one principle at a time, for example APP 3 on collecting only what is reasonably necessary → APP 3: Does not meet. A quiz app does not need a home address.
Q4
Recommending a change after a judgement, so the system can better meet the APP → Improvement: Remove the address field and ask only for a username.
Q5
APP 5: The app is bad for privacy. It should be better. → This gives no judgement against the principle, no evidence and no specific improvement. It is vague opinion.
Q6
APP 6: The app meets all the APPs because it looks safe. → It covers every APP at once and gives no evidence. A critique must take one APP at a time and use the policy or audit.
Section C: Definitions
Q1
APP critique — Check a system against one APP at a time: say what it does, judge if it meets that principle using evidence from the policy or audit, then suggest an improvement.Section D: Fill in the Blanks
Q1
APP 5: tell people when you collect dataQ2
Step 2: judge if the system meets the APPQ3
Evidence: the policy and the data auditQ4
Step 4: recommend a change to improve itQ5
APP 11: keep personal data secureSection E: Spot the Error
Q1
D — The audit shows no notice is given at sign-up, so the system does not meet APP 5. The line should say 'not met'.
Q2
A — Protecting data from misuse and loss is APP 11 (security). APP 3 is about collecting data, so the critique names the wrong principle.
Q3
B — The audit field list shows the system collects a home address. The 'Does' line must state what the system really does, which is asking for the home address.
Q4
C — A critique needs evidence from the policy or the data audit. A personal opinion is not evidence. It should cite something like 'policy, section 6'.
Q5
B — The evidence is a link on the home page and the judgment is 'met'. The 'Does' line must match this and say the policy is easy to find.