Holding information only for its primary purpose

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school collects student emails to send timetable changes. What is the primary purpose of the emails?

A Any use the school finds helpful later

B Sending timetable changes to students

2. A gym collected member details to manage memberships. It now wants to sell the list to a supplement company. This is a...

A Secondary use that needs consent or a legal exception

B Primary use that is always allowed under APP 6

3. Which step comes first when checking a proposed use of personal data under APP 6?

A Check how much money the new use could make

B Compare the proposed use to the primary purpose

4. A clinic collected patient details to book appointments. Using them to send booking reminders is...

A Consistent with the primary purpose

B A secondary use that needs new consent

5. An online shop collected addresses to deliver orders. Using them for a political advertising campaign is...

A A secondary use

B The primary purpose

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Primary purpose: process a student's excursion permission		AStates the reason the data was collected, which is the starting point for checking every later use under APP 6
2Use: send excursion list to a shop for advertising		BIF purpose complete THEN delete record
3Check a proposed use against the primary purpose before using the data		CA secondary use that does not match the primary purpose, so it needs consent or a legal exception
4Delete personal data once it is no longer needed for its primary purpose		DMarketing a phone plan is a secondary use. It needs the person's consent or a legal exception, not an assumption that it is fine.
5Collected for a library card, so also use it to market a phone plan		EIF use matches primary purpose THEN allow ELSE ask for consent
6Event ended last year, so keep all attendee details forever just in case		FData no longer needed for its primary purpose should be deleted or de-identified, not kept just in case.

Definitions

primary purpose

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______________ = "deliver an online order"

proposedUse = "send marketing emails" IF ___________ = primaryPurpose THEN allow

secondary = proposedUse __ primaryPurpose

IF secondary AND consent = _____ THEN DISPLAY "Use not allowed"

purposeDone = TRUE IF purposeDone THEN ______ record

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A purpose ← "send product ads"

B use ← "process a refund"

C IF use = purpose THEN

D ALLOW use

Question 2

A purpose ← "assess a loan"

B use ← "market to customer"

C IF use ≠ purpose THEN

D ALLOW use

Question 3

A purpose ← "enrol student"

B use ← "send fundraising email"

C secondary ← use = purpose

D IF secondary THEN ASK consent

Question 4

A purpose ← "hire staff"

B IF purpose is started THEN

C DELETE the data

D ELSE KEEP data

Question 5

A purpose ← "deliver parcel"

B IF use ≠ purpose THEN

C ALLOW use

D ELSE ASK consent

Answer Key

Holding information only for its primary purpose

Section A: Quick Questions

B — Sending timetable changes to students

A — Secondary use that needs consent or a legal exception

B — Compare the proposed use to the primary purpose

A — Consistent with the primary purpose

A — A secondary use

Section B: Match the Pairs

Primary purpose: process a student's excursion permission → States the reason the data was collected, which is the starting point for checking every later use under APP 6

Use: send excursion list to a shop for advertising → A secondary use that does not match the primary purpose, so it needs consent or a legal exception

Check a proposed use against the primary purpose before using the data → IF use matches primary purpose THEN allow ELSE ask for consent

Delete personal data once it is no longer needed for its primary purpose → IF purpose complete THEN delete record

Collected for a library card, so also use it to market a phone plan → Marketing a phone plan is a secondary use. It needs the person's consent or a legal exception, not an assumption that it is fine.

Event ended last year, so keep all attendee details forever just in case → Data no longer needed for its primary purpose should be deleted or de-identified, not kept just in case.

Section C: Definitions

primary purpose — The reason personal information was collected. Under APP 6, check each proposed use against it. Any other use is a secondary use and needs consent or a legal exception.

Section D: Fill in the Blanks

primaryPurpose = "deliver an online order"

proposedUse = "send marketing emails"
IF proposedUse = primaryPurpose THEN allow

secondary = proposedUse != primaryPurpose

IF secondary AND consent = FALSE THEN
  DISPLAY "Use not allowed"

purposeDone = TRUE
IF purposeDone THEN DELETE record

Section E: Spot the Error

A — The primary purpose is the reason the information was collected, which here is to process a refund. It was wrongly set to a marketing aim. Line 1 should be purpose ← "process a refund".

D — Marketing is a secondary use of loan assessment data. Under APP 6 it needs consent or a legal exception, so it can't be allowed automatically. Line 4 should be CHECK consent or exception.

C — A secondary use is one that does NOT match the primary purpose. The test must be use ≠ purpose. With = it would flag the primary use as secondary.

B — Data is deleted once its purpose is finished and it is no longer needed. Deleting when the purpose has only started would destroy data still in use. It should be IF purpose is finished THEN.

B — The condition is reversed. A use that matches the primary purpose is allowed, and any other use needs consent. Line 2 should be IF use = purpose THEN.