Applying privacy and health laws to a data collection scenario

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A Victorian public hospital collects patients' medical histories for a study. Which Act is most relevant?

A Health Records Act 2001 (Vic)

B Copyright Act 1968 (Cwlth)

2. A Victorian council survey collects residents' names and home addresses, but no health details. Which Act is most relevant?

A Privacy and Data Protection Act 2014 (Vic)

B Health Records Act 2001 (Vic)

3. How should you structure your check of a data collection scenario?

A Say the scenario is bad, then list every law you remember

B Name the principle, state met or not met, then quote evidence

4. A school survey asks for name and home address, but only counts favourite colours. What is the correct judgement on collecting only what is necessary (APP 3 or IPP 1)?

A Met: any data collected is automatically necessary

B Not met: name and address are not needed to count colours

5. Which is the better piece of evidence for a breach of APP 5 (notifying people)?

A The form gave no notice of why data is collected or who sees it

B The company seems careless with data

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Principle: APP 5 \| Met? No \| Evidence: the survey form gave no collection notice		ADoes not choose the right Act. A Victorian government school is covered by the Privacy and Data Protection Act 2014 (Vic), not the Commonwealth Act.
2Fix: add a collection notice explaining why data is collected and who sees it		BNames no principle and gives no evidence. A good answer names the principle, says whether it is met, and quotes the scenario.
3Choose the right Act first: a Victorian clinic collecting patient records is covered by the Health Records Act 2001 (Vic)		CAct: Health Records Act 2001 (Vic) \| Why: the data is health information held by a Victorian clinic
4Test one principle at a time, so each judgement has its own evidence		DIPP 4: Met? Yes \| Evidence: data is stored in a password-protected, encrypted database
5The school breaks privacy law because it collected data. (No principle named, no evidence)		EA recommendation that fixes the breach found for the notification principle
6Applying the Privacy Act 1988 (Cwlth) to a Victorian public school's student records without checking the other Acts		FA compliance check that names the principle, states it is breached, and quotes evidence from the scenario

Definitions

principle, met or not, evidence

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Scenario: clinic stores patient records Act: _______________________ (Vic)

Scenario: survey asks for unneeded address Principle: APP _ (reasonably necessary)

Scenario: no notice given when collecting Principle: APP 5 (notification) Met: __

Principle: HPP 4 (security and retention) Met: No ________: "files kept on an unlocked shelf"

Met: No Evidence: "files kept on an unlocked shelf" ___: store files in a locked cabinet

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Scenario: open clinic files

B Act: Health Records Act 2001

C Principle: HPP 1 collection

D Met: No, files left unlocked

Question 2

A Scenario: state school survey

B Act: Privacy Act 1988 (Cwlth)

C Principle: IPP 1 collection

D Met: No, no notice given

E Fix: Add a collection notice

Question 3

A Act: Copyright Act 1968

B Scenario: GP stores results

C Principle: HPP 4 retention

D Met: Yes, locked system

Question 4

A Scenario: shop loyalty form

B Act: Privacy Act 1988 (Cwlth)

C Principle: APP 3 necessary

D Met: Yes, asks for religion

E Fix: Remove the extra field

Question 5

A Act: Privacy Act 1988 (Cwlth)

B Principle: APP 5 notification

C Evidence: no notice on form

D Fix: Ask for more data

Answer Key

Applying privacy and health laws to a data collection scenario

Section A: Quick Questions

A — Health Records Act 2001 (Vic)

A — Privacy and Data Protection Act 2014 (Vic)

B — Name the principle, state met or not met, then quote evidence

B — Not met: name and address are not needed to count colours

A — The form gave no notice of why data is collected or who sees it

Section B: Match the Pairs

Principle: APP 5 | Met? No | Evidence: the survey form gave no collection notice → A compliance check that names the principle, states it is breached, and quotes evidence from the scenario

Fix: add a collection notice explaining why data is collected and who sees it → A recommendation that fixes the breach found for the notification principle

Choose the right Act first: a Victorian clinic collecting patient records is covered by the Health Records Act 2001 (Vic) → Act: Health Records Act 2001 (Vic) | Why: the data is health information held by a Victorian clinic

Test one principle at a time, so each judgement has its own evidence → IPP 4: Met? Yes | Evidence: data is stored in a password-protected, encrypted database

The school breaks privacy law because it collected data. (No principle named, no evidence) → Names no principle and gives no evidence. A good answer names the principle, says whether it is met, and quotes the scenario.

Applying the Privacy Act 1988 (Cwlth) to a Victorian public school's student records without checking the other Acts → Does not choose the right Act. A Victorian government school is covered by the Privacy and Data Protection Act 2014 (Vic), not the Commonwealth Act.

Section C: Definitions

principle, met or not, evidence — Check a scenario against each relevant principle: name the principle, state whether it is met or breached, and quote evidence from the scenario. Then recommend a fix.

Section D: Fill in the Blanks

Scenario: clinic stores patient records
Act: Health Records Act 2001 (Vic)

Scenario: survey asks for unneeded address
Principle: APP 3 (reasonably necessary)

Scenario: no notice given when collecting
Principle: APP 5 (notification)
Met: No

Principle: HPP 4 (security and retention)
Met: No
Evidence: "files kept on an unlocked shelf"

Met: No
Evidence: "files kept on an unlocked shelf"
Fix: store files in a locked cabinet

Section E: Spot the Error

C — The evidence is files left unlocked, which is about keeping data secure, not collecting it. The principle should be HPP 4 data security.

B — A Victorian state school is a public sector body, so the Privacy and Data Protection Act 2014 (Vic) applies, not the Commonwealth Privacy Act.

A — Test results held by a GP are health information, so the Health Records Act 2001 (Vic) applies. The Copyright Act covers creative works, not health records.

D — Asking for religion is not reasonably necessary for a loyalty card, so APP 3 is not met. The line should say Met: No.

D — The problem is that people are not told about the collection. Asking for more data does not fix it. The fix should be to add a collection notice.