← VCE Data Analysis

Ethical issue: misuse of personal data and information

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

Part of: VCE Applied Computing - U1O1 - Data analysis — Module 52, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 139, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 57, QCE Digital Solutions Unit 2 — Data-Driven Problems and Solution Requirements — Module 121, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 77, QCE Digital Solutions Unit 4 — Prototype Digital Data Exchanges — Module 120, WA Computer Science ATAR Year 11 — Data Management — Module 113, WA Computer Science ATAR Year 11 — Cyber Security — Module 167

Understanding Ethical issue: misuse of personal data and information in VCE Data Analysis

What it does: The email address was given for one purpose (a receipt) but is then used for another (ads), which is misuse of data. Using stolen personal details to take out a loan in someone else's name is identity theft, a harmful misuse of personal data. Misuse means going beyond what the person agreed to, or causing them harm. Secure storage with agreed use is the opposite. Selling data without consent is misuse. Collecting data does not give an organisation the right to sell it. Misuse can lead to fraud, financial loss, spam, embarrassment and stress for the person affected.

Common mistakes: The condition is reversed. The sale of data should be blocked when consent is FALSE, not when the person has agreed. It should be IF consent = FALSE THEN. This would sell a person's data after they refused. Selling data is only acceptable if the user agreed. It should be IF user agreed to sale THEN.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Ethical issue: misuse of personal data and information to a class →

This module's key terms are also in a printable crossword (Modules 38–54) and word search (Modules 25–54).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which best describes misuse of personal data?

Storing it securely and using it only as the person agreedUsing or sharing it in ways the person did not agree to or that harm them

Matches

A shop sells its customer list to an advertiser. The shop says this is fine because it owns the list.

↓

Owning the list does not give permission. The customers never agreed to their data being sold, so this is misuse.

Applying

Meanings

Term

Misuse of personal data

Meaning

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

Practice

IF data is sold without consent THEN

Testing

Gaps

IF consent = THEN

Check Answer

Spots

1consent ← FALSE

2IF consent = TRUE THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes misuse of personal data?

A. Using or sharing it in ways the person did not agree to or that harm them ✓

B. Storing it securely and using it only as the person agreed

Misuse means going beyond what the person agreed to, or causing them harm. Secure storage with agreed use is the opposite.

2. A company sells its customers' email addresses to advertisers without asking them. Is this misuse of personal data?

A. Yes, because the customers did not agree to their data being sold ✓

B. No, because the company collected the data itself so it can do what it likes

Selling data without consent is misuse. Collecting data does not give an organisation the right to sell it.

3. Which situation is an example of identity theft?

A. A criminal uses stolen names and birth dates to open a bank account ✓

B. A student changes their own username on a school account

Identity theft is using someone else's personal data to pretend to be them, usually to gain money or services.

4. A gym collects your details to sign you up, then uses them to send offers from other businesses. What kind of misuse is this?

A. Identity theft

B. Using data for a different purpose than the one you agreed to ✓

You gave your details for membership only. Using them for something else without agreement is a different-purpose misuse. No one is pretending to be you, so it is not identity theft.

5. Which is a likely harm to a person from misuse of their personal data?

A. Their data becomes more accurate and secure

B. Fraud, stress or loss of money after their details are stolen or sold ✓

Misuse can lead to fraud, financial loss, spam, embarrassment and stress for the person affected.

Match the Pairs

Misuse of personal data → Using or sharing personal data in ways the person did not agree to or that harm them

Selling data → Giving a customer's personal details to another company for profit without the customer's consent

Using data for a different purpose than the one the person agreed to → Email collected for a receipt is used for advertising

Identity theft happens when stolen personal details are used to pretend to be someone → Criminal opens a loan using a stolen name and birth date

A shop sells its customer list to an advertiser. The shop says this is fine because it owns the list. → Owning the list does not give permission. The customers never agreed to their data being sold, so this is misuse.

A school collects student addresses for excursions, then gives them to a local business for marketing. → The addresses were collected for excursions only. Giving them to a business is using data for a different purpose without consent.

Key Term

Misuse of personal data

Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

Fill in the Blanks

1. IF consent = FALSE THEN SET misuse TO TRUE END IF

Hint: Type the Boolean value that means the person did not agree to how their data is used.

2. IF dataSold = TRUE THEN SET misuse TO TRUE END IF

Hint: Type the keyword that starts the action to run when the condition is true.

3. IF idTheft = TRUE THEN SET harm TO TRUE END IF

Hint: Type the Boolean value that records that harm has happened to the person.

4. IF newUse != agreed THEN SET misuse TO TRUE END IF

Hint: Type the comparison operator that checks the two values are not equal.

5. SET misuse TO dataSold OR idTheft

Hint: Type the logical operator that is true if either case happens.

Spot the Error

Question 1

A consent ← FALSE

B IF consent = TRUE THEN

C block the sale of data

D ELSE

E allow the sale

Line B — The condition is reversed. The sale of data should be blocked when consent is FALSE, not when the person has agreed. It should be IF consent = FALSE THEN.

Question 2

A IF user refused the sale THEN

B sell data to a broker

C END IF

Line A — This would sell a person's data after they refused. Selling data is only acceptable if the user agreed. It should be IF user agreed to sale THEN.

Question 3

A email ← get_signup_email()

B purpose ← "newsletter"

C send_newsletter(email)

D sell_to_advertiser(email)

Line D — Selling the email address to an advertiser is misuse because the person only agreed to a newsletter. It should delete the email if they unsubscribe.

Question 4

A IF id_check = PASSED THEN

B deny account access

C alert the real owner

D END IF

Line A — Access would be denied to people who pass the identity check. To stop identity theft, access should be denied when the check FAILS. It should be IF id_check = FAILED THEN.

Question 5

A name ← "Sam Lee"

B dob ← "04/05/2008"

C post_online(dob)

D store(encrypt(dob))

Line C — Posting a full date of birth online makes identity theft easier. It should be masked when shown, as in show(mask(dob)).

Student with a class code? Join your class →