Understanding Applying privacy and health laws to a data collection scenario in VCE Data Analytics U3O2
What it does: Selecting the Act depends on the type of data and the organisation, so health information in Victoria points to the Health Records Act. Each principle is judged separately, with a clear met or not met result and a quotation or detail from the scenario as evidence. Collection must be reasonably necessary for the purpose. The evidence is that the name and address fields are not needed for the stated purpose. A good fix addresses the breached principle directly. Encryption and access control protect health information, while renaming a file does not. The fix should remove the cause of the breach. Collecting less data meets the necessity principle, while hiding the collection would breach the notification principle too.
Common mistakes: The evidence is files left unlocked, which is about keeping data secure, not collecting it. The principle should be HPP 4 data security. A Victorian state school is a public sector body, so the Privacy and Data Protection Act 2014 (Vic) applies, not the Commonwealth Privacy Act.
Quick Questions
1. A Victorian public hospital collects patients' medical histories for a study. Which Act is most relevant?
A. Health Records Act 2001 (Vic) ✓
B. Copyright Act 1968 (Cwlth)
Medical histories are health information, so the Health Records Act 2001 (Vic) and its HPPs apply. Choosing the right Act comes first.
2. A Victorian council survey collects residents' names and home addresses, but no health details. Which Act is most relevant?
A. Privacy and Data Protection Act 2014 (Vic) ✓
B. Health Records Act 2001 (Vic)
A Victorian public sector body collecting personal information is covered by the Privacy and Data Protection Act 2014 (Vic) and its IPPs. No health information is collected, so the Health Records Act is not the best fit.
3. How should you structure your check of a data collection scenario?
A. Say the scenario is bad, then list every law you remember
B. Name the principle, state met or not met, then quote evidence ✓
A strong answer names the principle, gives a verdict and backs it with evidence from the scenario. A general opinion earns no marks.
4. A school survey asks for name and home address, but only counts favourite colours. What is the correct judgement on collecting only what is necessary (APP 3 or IPP 1)?
A. Met: any data collected is automatically necessary
B. Not met: name and address are not needed to count colours ✓
Collection must be reasonably necessary for the purpose. The evidence is that the name and address fields are not needed for the stated purpose.
5. Which is the better piece of evidence for a breach of APP 5 (notifying people)?
A. The form gave no notice of why data is collected or who sees it ✓
B. The company seems careless with data
Evidence must come from the scenario and be specific. Vague opinions such as 'seems careless' do not show which principle is breached.
Fill in the Blanks
1. Scenario: clinic stores patient records
Act: Health Records Act 2001 (Vic)
Hint: Type the name of the Victorian Act that covers health information.
2. Scenario: survey asks for unneeded address
Principle: APP 3 (reasonably necessary)
Hint: Type the APP number about collecting only what is reasonably necessary.
3. Scenario: no notice given when collecting
Principle: APP 5 (notification)
Met: No
Hint: Type whether the principle is met, based on the scenario (yes or no).
4. Principle: HPP 4 (security and retention)
Met: No
Evidence: "files kept on an unlocked shelf"
Hint: Type the label for the line that quotes the scenario to support the judgement.
5. Met: No
Evidence: "files kept on an unlocked shelf"
Fix: store files in a locked cabinet
Hint: Type the label for the line that recommends how to correct the breach.
Spot the Error
Question 1
A
Scenario: open clinic files
B
Act: Health Records Act 2001
C
Principle: HPP 1 collection
D
Met: No, files left unlocked
Line C — The evidence is files left unlocked, which is about keeping data secure, not collecting it. The principle should be HPP 4 data security.
Question 2
A
Scenario: state school survey
B
Act: Privacy Act 1988 (Cwlth)
C
Principle: IPP 1 collection
D
Met: No, no notice given
E
Fix: Add a collection notice
Line B — A Victorian state school is a public sector body, so the Privacy and Data Protection Act 2014 (Vic) applies, not the Commonwealth Privacy Act.
Question 3
A
Act: Copyright Act 1968
B
Scenario: GP stores results
C
Principle: HPP 4 retention
D
Met: Yes, locked system
Line A — Test results held by a GP are health information, so the Health Records Act 2001 (Vic) applies. The Copyright Act covers creative works, not health records.
Question 4
A
Scenario: shop loyalty form
B
Act: Privacy Act 1988 (Cwlth)
C
Principle: APP 3 necessary
D
Met: Yes, asks for religion
E
Fix: Remove the extra field
Line D — Asking for religion is not reasonably necessary for a loyalty card, so APP 3 is not met. The line should say Met: No.
Question 5
A
Act: Privacy Act 1988 (Cwlth)
B
Principle: APP 5 notification
C
Evidence: no notice on form
D
Fix: Ask for more data
Line D — The problem is that people are not told about the collection. Asking for more data does not fix it. The fix should be to add a collection notice.
