APP 4: dealing with unsolicited personal information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school's office receives a résumé from a person who was not applying for any job. Under APP 4, what is this information called?

A Unsolicited personal information

B Solicited personal information

2. What is the first thing an organisation must do when it receives unsolicited personal information?

A Decide if it could have collected the information under the APPs

B Add it to its database straight away

3. An organisation decides it could NOT have collected the unsolicited information. What does APP 4 require?

A Keep it in case it is useful later

B Destroy or de-identify it, if it is lawful and reasonable to do so

4. Which option is a way of de-identifying unsolicited personal information?

A Removing the names and details that identify the person

B Moving the file to a different folder

5. A survey company is accidentally emailed a spreadsheet of another company's customer details. Which statement is correct under APP 4?

A It can use the details for marketing because it did not ask for them

B It must check whether it could have collected the details, and destroy or de-identify them if not

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1APP 4		APublishing the information is wrong. When an organisation could not have collected it, it must destroy or de-identify it, not share it.
2Unsolicited personal information		BThe Australian Privacy Principle about dealing with unsolicited personal information
3First, the organisation must decide whether it could have lawfully collected the unsolicited information under the APPs		CPersonal information an organisation receives but did not ask for or take any active step to collect
4If it could not have collected the information, it must destroy it or de-identify it, as long as it is lawful and reasonable to do so		DThe organisation keeps all unsolicited information without deciding whether it could have collected it. APP 4 requires that decision first.
5IF unsolicited THEN keep_all(data)		EIF could_have_collected = FALSE THEN destroy_or_deidentify(data)
6IF could_have_collected = FALSE THEN publish(data)		FIF could_have_collected = FALSE THEN check_next_step

Definitions

APP 4 unsolicited personal information

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF couldCollect = _____ THEN destroy(info) ENDIF

IF couldCollect = FALSE THEN _______(info) ENDIF

unsolicited ← TRUE IF ___________ THEN assess(info) ENDIF

IF couldCollect THEN keep(info) ELSE __________(info) ENDIF

IF ___ couldCollect THEN destroy(info) ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A receive unsolicited info

B IF could_collect = FALSE THEN

C keep and handle under APPs

D ELSE destroy or de-identify

Question 2

A info ← receive_unsolicited()

B ok ← can_collect(info)

C IF ok = FALSE THEN

D keep_forever(info)

E ENDIF

Question 3

A info ← received_by_email

B asked_for ← TRUE

C IF NOT asked_for THEN

D run_app4_check(info)

Question 4

A ok ← can_collect(info)

B IF NOT ok THEN

C publish(info)

D ENDIF

Question 5

A info ← receive_unsolicited()

B IF NOT can_collect(info) THEN

C encrypt(info)

D ENDIF

Answer Key

APP 4: dealing with unsolicited personal information

Section A: Quick Questions

A — Unsolicited personal information

A — Decide if it could have collected the information under the APPs

B — Destroy or de-identify it, if it is lawful and reasonable to do so

A — Removing the names and details that identify the person

B — It must check whether it could have collected the details, and destroy or de-identify them if not

Section B: Match the Pairs

APP 4 → The Australian Privacy Principle about dealing with unsolicited personal information

Unsolicited personal information → Personal information an organisation receives but did not ask for or take any active step to collect

First, the organisation must decide whether it could have lawfully collected the unsolicited information under the APPs → IF could_have_collected = FALSE THEN check_next_step

If it could not have collected the information, it must destroy it or de-identify it, as long as it is lawful and reasonable to do so → IF could_have_collected = FALSE THEN destroy_or_deidentify(data)

IF unsolicited THEN keep_all(data) → The organisation keeps all unsolicited information without deciding whether it could have collected it. APP 4 requires that decision first.

IF could_have_collected = FALSE THEN publish(data) → Publishing the information is wrong. When an organisation could not have collected it, it must destroy or de-identify it, not share it.

Section C: Definitions

APP 4 unsolicited personal information — If an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

Section D: Fill in the Blanks

IF couldCollect = FALSE THEN
  destroy(info)
ENDIF

IF couldCollect = FALSE THEN
  destroy(info)
ENDIF

unsolicited ← TRUE
IF unsolicited THEN assess(info)
ENDIF

IF couldCollect THEN keep(info)
ELSE deidentify(info)
ENDIF

IF NOT couldCollect THEN
  destroy(info)
ENDIF

Section E: Spot the Error

B — Information the organisation could have collected can be kept and handled under the APPs. The test should be could_collect = TRUE. With FALSE the logic is reversed and the ELSE branch would wrongly destroy information that could be kept.

D — If the organisation could not have collected the unsolicited information, APP 4 says it must destroy or de-identify it (where lawful and reasonable). It must not keep it forever. Line 4 should be destroy_or_deidentify(info).

B — Unsolicited information is information the organisation did not ask for, so asked_for should be FALSE. Setting it to TRUE means the APP 4 check would never run. Line 2 should be asked_for ← FALSE.

C — Unsolicited personal information that could not have been collected must be destroyed or de-identified. Publishing it would spread the personal information further. Line 3 should be destroy_or_deidentify(info).

C — Encrypting information still keeps it and the person can still be identified. APP 4 requires the organisation to destroy or de-identify it. Line 3 should be de_identify(info) (or destroy).