← VCE Data Analysis

Holding information only for its primary purpose

The reason personal information was collected. Under APP 6, check each proposed use against it. Any other use is a secondary use and needs consent or a legal exception.

Part of: VCE Applied Computing - U1O1 - Data analysis — Module 41, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 22

Understanding Holding information only for its primary purpose in VCE Data Analysis

What it does: This decision shows APP 6 in action: a matching use is allowed, and any other use needs consent or a legal exception. When the primary purpose is finished there is no reason to keep the data, so the record should be deleted. APP 6 starts with the primary purpose. Each proposed use is checked against it, and a use that does not match is a secondary use. Once personal information is no longer needed for its purpose, the organisation should destroy or de-identify it. Keeping it just in case invites misuse. Advertising is not the reason the excursion data was collected, so it is a secondary use under APP 6.

Common mistakes: The primary purpose is the reason the information was collected, which here is to process a refund. It was wrongly set to a marketing aim. Line 1 should be purpose ← "process a refund". Marketing is a secondary use of loan assessment data. Under APP 6 it needs consent or a legal exception, so it can't be allowed automatically. Line 4 should be CHECK consent or exception.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Holding information only for its primary purpose to a class →

This module's key terms are also in a printable crossword (Modules 38–54) and word search (Modules 25–54).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A school collects student emails to send timetable changes. What is the primary purpose of the emails?

Any use the school finds helpful laterSending timetable changes to students

Matches

Collected for a library card, so also use it to market a phone plan

↓

Marketing a phone plan is a secondary use. It needs the person's consent or a legal exception, not an assumption that it is fine.

Applying

Meanings

Term

primary purpose

Meaning

The reason personal information was collected. Under APP 6, check each proposed use against it. Any other use is a secondary use and needs consent or a legal exception.

Practice

Dataset: swim club sign-up form

Testing

Gaps

= "deliver an online order"

Check Answer

Spots

1purpose ← "send product ads"

2use ← "process a refund"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A school collects student emails to send timetable changes. What is the primary purpose of the emails?

A. Any use the school finds helpful later

B. Sending timetable changes to students ✓

The primary purpose is the specific reason the information was collected. Here that is timetable changes, not anything the school thinks of later.

2. A gym collected member details to manage memberships. It now wants to sell the list to a supplement company. This is a...

A. Secondary use that needs consent or a legal exception ✓

B. Primary use that is always allowed under APP 6

Selling the list is not about managing memberships, so it is a secondary use. Under APP 6 the gym needs consent or a legal exception.

3. Which step comes first when checking a proposed use of personal data under APP 6?

A. Check how much money the new use could make

B. Compare the proposed use to the primary purpose ✓

APP 6 starts with the primary purpose. Each proposed use is checked against it, and a use that does not match is a secondary use.

4. A clinic collected patient details to book appointments. Using them to send booking reminders is...

A. Consistent with the primary purpose ✓

B. A secondary use that needs new consent

Reminders are part of booking appointments, so they match the primary purpose. No new consent is needed.

5. An online shop collected addresses to deliver orders. Using them for a political advertising campaign is...

A. A secondary use ✓

B. The primary purpose

Delivery was the primary purpose. Political advertising is a different reason, so it is a secondary use.

Match the Pairs

Primary purpose: process a student's excursion permission → States the reason the data was collected, which is the starting point for checking every later use under APP 6

Use: send excursion list to a shop for advertising → A secondary use that does not match the primary purpose, so it needs consent or a legal exception

Check a proposed use against the primary purpose before using the data → IF use matches primary purpose THEN allow ELSE ask for consent

Delete personal data once it is no longer needed for its primary purpose → IF purpose complete THEN delete record

Collected for a library card, so also use it to market a phone plan → Marketing a phone plan is a secondary use. It needs the person's consent or a legal exception, not an assumption that it is fine.

Event ended last year, so keep all attendee details forever just in case → Data no longer needed for its primary purpose should be deleted or de-identified, not kept just in case.

Key Term

primary purpose

The reason personal information was collected. Under APP 6, check each proposed use against it. Any other use is a secondary use and needs consent or a legal exception.

Fill in the Blanks

1. primaryPurpose = "deliver an online order"

Hint: Type the variable name that stores the reason the data was collected, written in camelCase.

2. proposedUse = "send marketing emails" IF proposedUse = primaryPurpose THEN allow

Hint: Type the variable that holds the new use being checked against the original purpose.

3. secondary = proposedUse != primaryPurpose

Hint: Type the operator meaning 'is not equal to', which shows the use differs from the primary purpose.

4. IF secondary AND consent = FALSE THEN DISPLAY "Use not allowed"

Hint: Type the Boolean value showing that consent has not been given.

5. purposeDone = TRUE IF purposeDone THEN DELETE record

Hint: Type the keyword for removing data that is no longer needed.

Spot the Error

Question 1

A purpose ← "send product ads"

B use ← "process a refund"

C IF use = purpose THEN

D ALLOW use

Line A — The primary purpose is the reason the information was collected, which here is to process a refund. It was wrongly set to a marketing aim. Line 1 should be purpose ← "process a refund".

Question 2

A purpose ← "assess a loan"

B use ← "market to customer"

C IF use ≠ purpose THEN

D ALLOW use

Line D — Marketing is a secondary use of loan assessment data. Under APP 6 it needs consent or a legal exception, so it can't be allowed automatically. Line 4 should be CHECK consent or exception.

Question 3

A purpose ← "enrol student"

B use ← "send fundraising email"

C secondary ← use = purpose

D IF secondary THEN ASK consent

Line C — A secondary use is one that does NOT match the primary purpose. The test must be use ≠ purpose. With = it would flag the primary use as secondary.

Question 4

A purpose ← "hire staff"

B IF purpose is started THEN

C DELETE the data

D ELSE KEEP data

Line B — Data is deleted once its purpose is finished and it is no longer needed. Deleting when the purpose has only started would destroy data still in use. It should be IF purpose is finished THEN.

Question 5

A purpose ← "deliver parcel"

B IF use ≠ purpose THEN

C ALLOW use

D ELSE ASK consent

Line B — The condition is reversed. A use that matches the primary purpose is allowed, and any other use needs consent. Line 2 should be IF use = purpose THEN.

Student with a class code? Join your class →