APP 4: dealing with unsolicited personal information
APP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.
Understanding APP 4: dealing with unsolicited personal information in VCE Data Analytics U4O2
What it does: The first step in APP 4 is the decision about whether the organisation could have collected the information itself, which this test represents. De-identifying means removing details so the person can no longer be identified. Moving the data to another folder does not destroy or de-identify it.
Common mistakes: Under APP 4, if the organisation could not have collected the unsolicited information, it must destroy or de-identify it. It cannot keep it. The line should be DESTROY(info). The condition is reversed. De-identifying is only required when the organisation could NOT have collected the information, so the test should be IF ok = FALSE THEN.
Class: _____________________ · Name: _____________________ · Date: _________
Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.
🖨 Print worksheet + answer key
Add APP 4: dealing with unsolicited personal information to a class →
This module's key terms are also in a printable crossword (Modules 80–113) and word search (Modules 44–113).
Take this worksheet further — free with Cloodit
Each concept is reinforced from every angle — learned, then applied, then tested.
Learning
Duo
A job applicant emails their résumé to a company that has no vacancies. Under APP 4, is this unsolicited personal information?
Yes, the company did not ask for itNo, because it arrived by email
Matches
IF unsolicited THEN keep_forever(info)
↓
APP 4 does not allow the organisation to keep unsolicited information it could not have collected. It must decide whether it could have collected it, then destroy or de-identify it if not.
Applying
Meanings
Term
APP 4 unsolicited personal information
Meaning
APP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.
Practice
RECEIVE unsolicited personal information
Testing
Gaps
IF couldCollect THEN
Check Answer
Spots
3IF NOT ok THEN
4 KEEP(info)
Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.
Students earn collectable badges
Over 100 of them, across seven natural biomes.
Study Buddy
Students build a real study resource
Turns their work into revision material ready for Flash Cards and Exam study.
Students lock in with Sprints
Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.
Custom printable certificates
Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.
Quick Questions
1. A job applicant emails their résumé to a company that has no vacancies. Under APP 4, is this unsolicited personal information?
Unsolicited personal information is information an organisation receives without taking active steps to collect it. A résumé sent when no job was advertised fits this.
2. What is the FIRST thing APP 4 requires once an organisation receives unsolicited personal information?
The organisation must first work out whether it could have collected the information under the APPs (APP 3) if it had asked for it.
3. An organisation decides it could NOT have collected the unsolicited information under APP 3. What must it do?
If the organisation could not have collected the information, APP 4 says it must destroy it or de-identify it, as long as this is lawful and reasonable. Keeping it 'just in case' breaks the principle.
4. Which action meets APP 4 for unsolicited personal information that could not have been collected?
De-identifying means removing details so the person can no longer be identified. Moving the data to another folder does not destroy or de-identify it.
5. A student sends their medical history to a school's IT helpdesk by mistake. The helpdesk had no reason to collect it. What does APP 4 suggest?
The helpdesk could not have collected this information for its functions, so APP 4 requires it to be destroyed or de-identified, not added to its records.
Match the Pairs
APP 4 unsolicited personal information
→
Personal information an organisation receives but did not ask for, such as a CV sent in without a job being advertised.
destroy or de-identify
→
What APP 4 requires if the organisation could not have collected the unsolicited information itself, as long as it is lawful and reasonable to do so.
An organisation receives personal information it did not ask for and first decides whether it could have collected it under the APPs
→
IF could_have_collected(info) = FALSE
If the unsolicited information could not have been collected, the organisation must destroy it or de-identify it
→
IF could_have_collected = FALSE THEN destroy_or_deidentify(info)
IF unsolicited THEN keep_forever(info)
→
APP 4 does not allow the organisation to keep unsolicited information it could not have collected. It must decide whether it could have collected it, then destroy or de-identify it if not.
A company is emailed a customer's health details it never requested, so it posts them on its website
→
Publishing unsolicited personal information is wrong. Because the company did not ask for the details and could not have collected them, it must destroy or de-identify them, not share them.
Key Term
APP 4 unsolicited personal informationAPP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.
Fill in the Blanks
1. IF NOT couldCollect THEN
destroyOrDeidentify(data)
END IF
Hint: Type the logical operator that reverses the condition, so the action runs only when collection would not have been allowed.
2. IF unsolicited THEN
destroy(data)
END IF
Hint: Type the action name that permanently deletes the unsolicited information.
3. received ← TRUE
IF NOT couldCollect THEN
deidentify(data)
Hint: Type the action name that strips out identifying details so the person can no longer be recognised.
4. unsolicited ← received AND NOT requested
IF unsolicited THEN
assess(data)
Hint: Type the variable that flags information received without being asked for.
5. IF unsolicited AND NOT couldCollect THEN
destroyOrDeidentify(data)
END IF
Hint: Type the logical operator that requires both conditions to be true before the action runs.
Spot the Error
Question 1
A
info ← RECEIVE_UNASKED()
B
ok ← COULD_COLLECT(info)
C
IF NOT ok THEN
D
KEEP(info)
E
END IF
Line D — Under APP 4, if the organisation could not have collected the unsolicited information, it must destroy or de-identify it. It cannot keep it. The line should be DESTROY(info).
Question 2
A
info ← RECEIVE_UNASKED()
B
ok ← COULD_COLLECT(info)
C
IF ok = TRUE THEN
D
DEIDENTIFY(info)
E
END IF
Line C — The condition is reversed. De-identifying is only required when the organisation could NOT have collected the information, so the test should be IF ok = FALSE THEN.
Question 3
A
CV ← RECEIVE_UNASKED_CV()
B
ok ← TRUE
C
IF NOT ok THEN
D
DESTROY(CV)
Line B — APP 4 requires the organisation to decide whether it could have collected the information. Setting ok to TRUE skips that decision. It should be ok ← COULD_COLLECT(CV).
Question 4
A
mail ← RECEIVE_UNASKED()
B
ok ← COULD_COLLECT(mail)
C
IF NOT ok THEN
D
ARCHIVE(mail)
E
END IF
Line D — Archiving still keeps the personal information in identifiable form. APP 4 requires it to be destroyed or de-identified, so the line should be DEIDENTIFY(mail) or DESTROY(mail).
Question 5
A
msg ← RECEIVE_UNASKED()
B
rule ← APP_7
C
ok ← COULD_COLLECT(msg)
D
IF NOT ok THEN DESTROY(msg)
Line B — APP 7 covers direct marketing. Dealing with unsolicited personal information is APP 4, so the line should be rule ← APP_4.
Student with a class code? Join your class →