Ethical issue: misuse of personal data and information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes misuse of personal data?

A Using or sharing it in ways the person did not agree to or that harm them

B Storing it securely and using it only as the person agreed

2. A company sells its customers' email addresses to advertisers without asking them. Is this misuse of personal data?

A Yes, because the customers did not agree to their data being sold

B No, because the company collected the data itself so it can do what it likes

3. Which situation is an example of identity theft?

A A criminal uses stolen names and birth dates to open a bank account

B A student changes their own username on a school account

4. A gym collects your details to sign you up, then uses them to send offers from other businesses. What kind of misuse is this?

A Identity theft

B Using data for a different purpose than the one you agreed to

5. Which is a likely harm to a person from misuse of their personal data?

A Their data becomes more accurate and secure

B Fraud, stress or loss of money after their details are stolen or sold

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Misuse of personal data		AOwning the list does not give permission. The customers never agreed to their data being sold, so this is misuse.
2Selling data		BCriminal opens a loan using a stolen name and birth date
3Using data for a different purpose than the one the person agreed to		CEmail collected for a receipt is used for advertising
4Identity theft happens when stolen personal details are used to pretend to be someone		DThe addresses were collected for excursions only. Giving them to a business is using data for a different purpose without consent.
5A shop sells its customer list to an advertiser. The shop says this is fine because it owns the list.		EUsing or sharing personal data in ways the person did not agree to or that harm them
6A school collects student addresses for excursions, then gives them to a local business for marketing.		FGiving a customer's personal details to another company for profit without the customer's consent

Definitions

Misuse of personal data

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF consent = _____ THEN SET misuse TO TRUE END IF

IF dataSold = TRUE ____ SET misuse TO TRUE END IF

IF idTheft = TRUE THEN SET harm TO ____ END IF

IF newUse __ agreed THEN SET misuse TO TRUE END IF

SET misuse TO dataSold __ idTheft

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A consent ← FALSE

B IF consent = TRUE THEN

C block the sale of data

D ELSE

E allow the sale

Question 2

A IF user refused the sale THEN

B sell data to a broker

C END IF

Question 3

A email ← get_signup_email()

B purpose ← "newsletter"

C send_newsletter(email)

D sell_to_advertiser(email)

Question 4

A IF id_check = PASSED THEN

B deny account access

C alert the real owner

D END IF

Question 5

A name ← "Sam Lee"

B dob ← "04/05/2008"

C post_online(dob)

D store(encrypt(dob))

Answer Key

Ethical issue: misuse of personal data and information

Section A: Quick Questions

A — Using or sharing it in ways the person did not agree to or that harm them

A — Yes, because the customers did not agree to their data being sold

A — A criminal uses stolen names and birth dates to open a bank account

B — Using data for a different purpose than the one you agreed to

B — Fraud, stress or loss of money after their details are stolen or sold

Section B: Match the Pairs

Misuse of personal data → Using or sharing personal data in ways the person did not agree to or that harm them

Selling data → Giving a customer's personal details to another company for profit without the customer's consent

Using data for a different purpose than the one the person agreed to → Email collected for a receipt is used for advertising

Identity theft happens when stolen personal details are used to pretend to be someone → Criminal opens a loan using a stolen name and birth date

A shop sells its customer list to an advertiser. The shop says this is fine because it owns the list. → Owning the list does not give permission. The customers never agreed to their data being sold, so this is misuse.

A school collects student addresses for excursions, then gives them to a local business for marketing. → The addresses were collected for excursions only. Giving them to a business is using data for a different purpose without consent.

Section C: Definitions

Misuse of personal data — Using or sharing personal data in ways the person did not agree to or that harm them, such as selling it, identity theft, or using it for a different purpose.

Section D: Fill in the Blanks

IF consent = FALSE THEN
  SET misuse TO TRUE
END IF

IF dataSold = TRUE THEN
  SET misuse TO TRUE
END IF

IF idTheft = TRUE THEN
  SET harm TO TRUE
END IF

IF newUse != agreed THEN
  SET misuse TO TRUE
END IF

SET misuse TO dataSold OR idTheft

Section E: Spot the Error

B — The condition is reversed. The sale of data should be blocked when consent is FALSE, not when the person has agreed. It should be IF consent = FALSE THEN.

A — This would sell a person's data after they refused. Selling data is only acceptable if the user agreed. It should be IF user agreed to sale THEN.

D — Selling the email address to an advertiser is misuse because the person only agreed to a newsletter. It should delete the email if they unsubscribe.

A — Access would be denied to people who pass the identity check. To stop identity theft, access should be denied when the check FAILS. It should be IF id_check = FAILED THEN.

C — Posting a full date of birth online makes identity theft easier. It should be masked when shown, as in show(mask(dob)).