APP 4: dealing with unsolicited personal information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A job applicant emails their résumé to a company that has no vacancies. Under APP 4, is this unsolicited personal information?

A Yes, the company did not ask for it

B No, because it arrived by email

2. What is the FIRST thing APP 4 requires once an organisation receives unsolicited personal information?

A Decide if it could have collected the information

B Publish the information on its website

3. An organisation decides it could NOT have collected the unsolicited information under APP 3. What must it do?

A Destroy or de-identify it, if lawful and reasonable

B Keep it in case it is useful later

4. Which action meets APP 4 for unsolicited personal information that could not have been collected?

A Moving the information to a shared folder

B Removing names and details so no one can be identified

5. A student sends their medical history to a school's IT helpdesk by mistake. The helpdesk had no reason to collect it. What does APP 4 suggest?

A Add it to the helpdesk database

B Destroy or de-identify it

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1APP 4 unsolicited personal information		APublishing unsolicited personal information is wrong. Because the company did not ask for the details and could not have collected them, it must destroy or de-identify them, not share them.
2destroy or de-identify		BIF could_have_collected(info) = FALSE
3An organisation receives personal information it did not ask for and first decides whether it could have collected it under the APPs		CAPP 4 does not allow the organisation to keep unsolicited information it could not have collected. It must decide whether it could have collected it, then destroy or de-identify it if not.
4If the unsolicited information could not have been collected, the organisation must destroy it or de-identify it		DWhat APP 4 requires if the organisation could not have collected the unsolicited information itself, as long as it is lawful and reasonable to do so.
5IF unsolicited THEN keep_forever(info)		EPersonal information an organisation receives but did not ask for, such as a CV sent in without a job being advertised.
6A company is emailed a customer's health details it never requested, so it posts them on its website		FIF could_have_collected = FALSE THEN destroy_or_deidentify(info)

Definitions

APP 4 unsolicited personal information

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF ___ couldCollect THEN destroyOrDeidentify(data) END IF

IF unsolicited THEN _______(data) END IF

received ← TRUE IF NOT couldCollect THEN __________(data)

unsolicited ← received AND NOT requested IF ___________ THEN assess(data)

IF unsolicited ___ NOT couldCollect THEN destroyOrDeidentify(data) END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A info ← RECEIVE_UNASKED()

B ok ← COULD_COLLECT(info)

C IF NOT ok THEN

D KEEP(info)

E END IF

Question 2

A info ← RECEIVE_UNASKED()

B ok ← COULD_COLLECT(info)

C IF ok = TRUE THEN

D DEIDENTIFY(info)

E END IF

Question 3

A CV ← RECEIVE_UNASKED_CV()

B ok ← TRUE

C IF NOT ok THEN

D DESTROY(CV)

Question 4

A mail ← RECEIVE_UNASKED()

B ok ← COULD_COLLECT(mail)

C IF NOT ok THEN

D ARCHIVE(mail)

E END IF

Question 5

A msg ← RECEIVE_UNASKED()

B rule ← APP_7

C ok ← COULD_COLLECT(msg)

D IF NOT ok THEN DESTROY(msg)

Answer Key

APP 4: dealing with unsolicited personal information

Section A: Quick Questions

A — Yes, the company did not ask for it

A — Decide if it could have collected the information

A — Destroy or de-identify it, if lawful and reasonable

B — Removing names and details so no one can be identified

B — Destroy or de-identify it

Section B: Match the Pairs

APP 4 unsolicited personal information → Personal information an organisation receives but did not ask for, such as a CV sent in without a job being advertised.

destroy or de-identify → What APP 4 requires if the organisation could not have collected the unsolicited information itself, as long as it is lawful and reasonable to do so.

An organisation receives personal information it did not ask for and first decides whether it could have collected it under the APPs → IF could_have_collected(info) = FALSE

If the unsolicited information could not have been collected, the organisation must destroy it or de-identify it → IF could_have_collected = FALSE THEN destroy_or_deidentify(info)

IF unsolicited THEN keep_forever(info) → APP 4 does not allow the organisation to keep unsolicited information it could not have collected. It must decide whether it could have collected it, then destroy or de-identify it if not.

A company is emailed a customer's health details it never requested, so it posts them on its website → Publishing unsolicited personal information is wrong. Because the company did not ask for the details and could not have collected them, it must destroy or de-identify them, not share them.

Section C: Definitions

APP 4 unsolicited personal information — APP 4: if an organisation gets personal information it did not ask for, it must decide if it could have collected it. If not, it must destroy or de-identify it.

Section D: Fill in the Blanks

IF NOT couldCollect THEN
  destroyOrDeidentify(data)
END IF

IF unsolicited THEN
  destroy(data)
END IF

received ← TRUE
IF NOT couldCollect THEN
  deidentify(data)

unsolicited ← received AND NOT requested
IF unsolicited THEN
  assess(data)

IF unsolicited AND NOT couldCollect THEN
  destroyOrDeidentify(data)
END IF

Section E: Spot the Error

D — Under APP 4, if the organisation could not have collected the unsolicited information, it must destroy or de-identify it. It cannot keep it. The line should be DESTROY(info).

C — The condition is reversed. De-identifying is only required when the organisation could NOT have collected the information, so the test should be IF ok = FALSE THEN.

B — APP 4 requires the organisation to decide whether it could have collected the information. Setting ok to TRUE skips that decision. It should be ok ← COULD_COLLECT(CV).

D — Archiving still keeps the personal information in identifiable form. APP 4 requires it to be destroyed or de-identified, so the line should be DEIDENTIFY(mail) or DESTROY(mail).

B — APP 7 covers direct marketing. Dealing with unsolicited personal information is APP 4, so the line should be rule ← APP_4.