← VCE Data Analytics U3O2

APP 4: dealing with unsolicited personal information

If an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

Part of: VCE Data Analytics - U3O2 - Analysis and Design — Module 92

Understanding APP 4: dealing with unsolicited personal information in VCE Data Analytics U3O2

What it does: APP 4 starts with a decision test: could this information have been collected if the organisation had asked for it? The answer sets the next step. Unsolicited means the organisation did not ask for it. APP 4 covers personal information received without being requested. De-identifying means the person can no longer be identified from the information. Moving a file does not change who the data is about. The correct action under APP 4 is destroy_or_deidentify(data). Publishing would make the privacy breach worse.

Common mistakes: Information the organisation could have collected can be kept and handled under the APPs. The test should be could_collect = TRUE. With FALSE the logic is reversed and the ELSE branch would wrongly destroy information that could be kept. If the organisation could not have collected the unsolicited information, APP 4 says it must destroy or de-identify it (where lawful and reasonable). It must not keep it forever. Line 4 should be destroy_or_deidentify(info).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add APP 4: dealing with unsolicited personal information to a class →

This module's key terms are also in a printable crossword (Modules 76–146) and word search (Modules 3–146).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A school's office receives a résumé from a person who was not applying for any job. Under APP 4, what is this information called?
Solicited personal informationUnsolicited personal information
Matches
IF unsolicited THEN keep_all(data)
↓
The organisation keeps all unsolicited information without deciding whether it could have collected it. APP 4 requires that decision first.
Applying
Meanings
Term
APP 4 unsolicited personal information
Meaning
If an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.
Practice
IF information was not asked for THEN
Testing
Gaps
IF couldCollect = THEN
Check Answer
Spots
1receive unsolicited info
2IF could_collect = FALSE THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Gila Monster' badge — Patient Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A school's office receives a résumé from a person who was not applying for any job. Under APP 4, what is this information called?
A. Unsolicited personal information ✓
B. Solicited personal information
Unsolicited means the organisation did not ask for it. APP 4 covers personal information received without being requested.
2. What is the first thing an organisation must do when it receives unsolicited personal information?
A. Decide if it could have collected the information under the APPs ✓
B. Add it to its database straight away
APP 4 requires the organisation to work out whether it could have lawfully collected the information if it had asked for it.
3. An organisation decides it could NOT have collected the unsolicited information. What does APP 4 require?
A. Keep it in case it is useful later
B. Destroy or de-identify it, if it is lawful and reasonable to do so ✓
If the organisation could not have collected the information, it must destroy it or de-identify it. Keeping it 'just in case' breaks APP 4.
4. Which option is a way of de-identifying unsolicited personal information?
A. Removing the names and details that identify the person ✓
B. Moving the file to a different folder
De-identifying means the person can no longer be identified from the information. Moving a file does not change who the data is about.
5. A survey company is accidentally emailed a spreadsheet of another company's customer details. Which statement is correct under APP 4?
A. It can use the details for marketing because it did not ask for them
B. It must check whether it could have collected the details, and destroy or de-identify them if not ✓
Receiving information by mistake does not give the right to use it. APP 4 sets out the steps the organisation must follow.

Match the Pairs

APP 4 → The Australian Privacy Principle about dealing with unsolicited personal information
Unsolicited personal information → Personal information an organisation receives but did not ask for or take any active step to collect
First, the organisation must decide whether it could have lawfully collected the unsolicited information under the APPs → IF could_have_collected = FALSE THEN check_next_step
If it could not have collected the information, it must destroy it or de-identify it, as long as it is lawful and reasonable to do so → IF could_have_collected = FALSE THEN destroy_or_deidentify(data)
IF unsolicited THEN keep_all(data) → The organisation keeps all unsolicited information without deciding whether it could have collected it. APP 4 requires that decision first.
IF could_have_collected = FALSE THEN publish(data) → Publishing the information is wrong. When an organisation could not have collected it, it must destroy or de-identify it, not share it.

Key Term

APP 4 unsolicited personal information
If an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

Fill in the Blanks

1. IF couldCollect = FALSE THEN destroy(info) ENDIF
Hint: Type the Boolean value that means the organisation could not have collected the information itself.
2. IF couldCollect = FALSE THEN destroy(info) ENDIF
Hint: Type the function name for the APP 4 action that permanently gets rid of unsolicited information.
3. unsolicited ← TRUE IF unsolicited THEN assess(info) ENDIF
Hint: Type the variable name that was just set to show the information was not asked for.
4. IF couldCollect THEN keep(info) ELSE deidentify(info) ENDIF
Hint: Type the function name for the alternative to destroying, where details that identify the person are removed.
5. IF NOT couldCollect THEN destroy(info) ENDIF
Hint: Type the logical operator that reverses a Boolean value.

Spot the Error

Question 1
A receive unsolicited info
B IF could_collect = FALSE THEN
C keep and handle under APPs
D ELSE destroy or de-identify
Line B — Information the organisation could have collected can be kept and handled under the APPs. The test should be could_collect = TRUE. With FALSE the logic is reversed and the ELSE branch would wrongly destroy information that could be kept.
Question 2
A info ← receive_unsolicited()
B ok ← can_collect(info)
C IF ok = FALSE THEN
D keep_forever(info)
E ENDIF
Line D — If the organisation could not have collected the unsolicited information, APP 4 says it must destroy or de-identify it (where lawful and reasonable). It must not keep it forever. Line 4 should be destroy_or_deidentify(info).
Question 3
A info ← received_by_email
B asked_for ← TRUE
C IF NOT asked_for THEN
D run_app4_check(info)
Line B — Unsolicited information is information the organisation did not ask for, so asked_for should be FALSE. Setting it to TRUE means the APP 4 check would never run. Line 2 should be asked_for ← FALSE.
Question 4
A ok ← can_collect(info)
B IF NOT ok THEN
C publish(info)
D ENDIF
Line C — Unsolicited personal information that could not have been collected must be destroyed or de-identified. Publishing it would spread the personal information further. Line 3 should be destroy_or_deidentify(info).
Question 5
A info ← receive_unsolicited()
B IF NOT can_collect(info) THEN
C encrypt(info)
D ENDIF
Line C — Encrypting information still keeps it and the person can still be identified. APP 4 requires the organisation to destroy or de-identify it. Line 3 should be de_identify(info) (or destroy).

Student with a class code? Join your class →