VCE Data Analytics U4O2 Definitions Worksheet: Victorian privacy and health records legislation to Emerging trends in cyber security (Modules 115–134)
Name:
Date:
Class:
✎
Key terms
Write what each term means, in your own words.
1
Which privacy law applies
2
Privacy Amendment (Notifiable Data Breaches) Act 2017
3
eligible data breach
4
s 26WH assessment
5
Statement to the Commissioner
6
s 26WL
7
NDB scheme steps
8
privacy-enhancing practices
9
incident response
10
User behaviour analytics
Answer Key
VCE Data Analytics U4O2 · Modules 115–134 · Student wording will vary for definitions
1Which privacy law applies — The Privacy Act covers federal agencies and large private firms, the PDP Act covers Victorian public bodies, and the Health Records Act covers health information. Work out which apply.
2Privacy Amendment (Notifiable Data Breaches) Act 2017 — Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.
3eligible data breach — Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).
4s 26WH assessment — If an entity suspects an eligible data breach, it must quickly and reasonably assess within 30 days whether serious harm is likely and whether a breach has occurred.
5Statement to the Commissioner — After an eligible data breach, the organisation must prepare a statement of required details and give it to the Australian Information Commissioner as soon as practicable.
6s 26WL — Organisation must tell individuals at risk of serious harm about an eligible data breach, what information was involved and what steps to take, directly or by publishing a notice.
7NDB scheme steps — Check if a breach is eligible (serious harm likely), then notify the OAIC and affected people as soon as practicable. Failing to notify risks penalties under the Privacy Act.
8privacy-enhancing practices — Newer practices like data minimisation, anonymisation and encryption by default that reduce the personal data an organisation holds and exposes, lowering privacy risk.
9incident response — Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.
10User behaviour analytics — Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.