← VCE Data Analytics U4O2

Eligible data breach and serious harm (ss 26WE, 26WF)

Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 118, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 54, WA Computer Science ATAR Year 11 — Cyber Security — Module 160

Understanding Eligible data breach and serious harm (ss 26WE, 26WF) in VCE Data Analytics U4O2

What it does: Sending personal information to the wrong person is an unauthorised disclosure, and sensitive details make serious harm likely, so it is an eligible data breach. Serious harm can include physical, psychological, emotional, financial or reputational harm. A single extra email is not serious. Likely means more probable than not. Harm does not need to have already happened, and it does not need to be certain.

Common mistakes: When access is unauthorised, the information is personal and serious harm is likely, the breach is an eligible data breach. The line should say THEN breach is eligible. An eligible data breach needs serious harm to be likely, not minor harm. The line should be harm ← likely serious harm.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Eligible data breach and serious harm (ss 26WE, 26WF) to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which event is an eligible data breach under the Privacy Act?
A staff member's work laptop is replaced after a routine upgrade and the old one is wipedA hacker downloads customer names, addresses and licence numbers, and serious harm is likely
Matches
Any data breach must be reported as an eligible data breach
↓
Not every breach is eligible. It must involve personal information and be likely to result in serious harm to the individuals concerned.
Applying
Meanings
Term
eligible data breach
Meaning
Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).
Practice
IF unauthorised access OR unauthorised disclosure OR loss THEN
Testing
Gaps
IF unauthorisedAccess seriousHarm THEN
Check Answer
Spots
3AND serious harm is likely
4THEN breach is not eligible

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Fennec Fox' badge — Listener, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which event is an eligible data breach under the Privacy Act?
A. A hacker downloads customer names, addresses and licence numbers, and serious harm is likely ✓
B. A staff member's work laptop is replaced after a routine upgrade and the old one is wiped
An eligible data breach needs unauthorised access, disclosure or loss of personal information AND likely serious harm. A planned, secure wipe involves neither.
2. What is the harm test for an eligible data breach?
A. Any incident that causes the organisation a small amount of inconvenience
B. Access, disclosure or loss is likely to result in serious harm to the individuals concerned ✓
The test is about likely serious harm to the individuals the information concerns, not just inconvenience to the organisation.
3. Which is an example of unauthorised disclosure?
A. An employee emails a spreadsheet of client health details to the wrong external address ✓
B. An authorised analyst opens the same spreadsheet to complete their assigned work
Disclosure to someone who is not allowed to see the information is unauthorised. An authorised person doing their job is normal, permitted use.
4. True or false: a data breach can be eligible even if no hacker is involved.
A. True: loss of information, such as a USB drive left on a train, can be an eligible data breach ✓
B. False: only deliberate attacks by criminals can ever be eligible data breaches
The sub-themes include loss of information. Accidental loss can be eligible if serious harm is likely, so the cause does not matter.
5. A database of only anonymous, non-identifying statistics is stolen. Is it an eligible data breach?
A. Yes, because any stolen data is automatically an eligible data breach
B. Probably not, because it is not personal information and serious harm to individuals is unlikely ✓
An eligible data breach must involve personal information and likely serious harm to individuals. Stolen data alone is not enough.

Match the Pairs

s 26WE → Defines an eligible data breach: unauthorised access to or disclosure of personal information, or loss of it where unauthorised access or disclosure is likely, that is likely to cause serious harm.
s 26WF → Explains how to decide whether serious harm is likely, using relevant matters such as the kind of information, who holds it and how sensitive it is.
A staff member emails a spreadsheet of customer names, addresses and medical details to the wrong external person. This is an unauthorised disclosure that is likely to cause serious harm. → Eligible data breach: unauthorised disclosure + likely serious harm
A laptop holding unencrypted customer records is lost on a train. Unauthorised access is likely and could cause serious harm. → Eligible data breach: loss of information + likely serious harm
Any data breach must be reported as an eligible data breach → Not every breach is eligible. It must involve personal information and be likely to result in serious harm to the individuals concerned.
Serious harm only means financial loss → Serious harm is wider than money. It can include physical, psychological, emotional, reputational and financial harm, and s 26WF guides the judgement.

Key Term

eligible data breach
Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).

Fill in the Blanks

1. IF unauthorisedAccess AND seriousHarm THEN
Hint: Type the logical operator that requires both conditions to be true before the breach is eligible.
2. IF informationLost AND seriousHarm THEN
Hint: Type the keyword that starts a condition in pseudocode, here testing whether lost personal information is a breach.
3. IF chanceOfHarm > 50 THEN
Hint: Type the comparison operator meaning more than, so harm is more probable than not.
4. IF access OR disclosure OR loss THEN
Hint: Type the logical operator that means any one of the events is enough to count as a breach.
5. IF likelySeriousHarm = TRUE THEN
Hint: Type the Boolean value that shows serious harm is likely, so the breach is eligible.

Spot the Error

Question 1
A IF access is unauthorised
B AND info is personal
C AND serious harm is likely
D THEN breach is not eligible
Line D — When access is unauthorised, the information is personal and serious harm is likely, the breach is an eligible data breach. The line should say THEN breach is eligible.
Question 2
A type ← unauthorised access
B info ← personal information
C harm ← likely to be minor
D eligible ← type AND harm
Line C — An eligible data breach needs serious harm to be likely, not minor harm. The line should be harm ← likely serious harm.
Question 3
A definition ← s 26WK
B serious_harm ← s 26WF
C OUTPUT definition, harm
Line A — Section 26WE defines an eligible data breach. Section 26WK covers the statement to the Commissioner, so the line should use s 26WE.
Question 4
A IF data is lost in a theft
B AND info is personal
C AND any harm is possible
D THEN assess as eligible
Line C — The test is that serious harm is likely. Any possible harm is too low a threshold. The line should be AND serious harm is likely.
Question 5
A IF laptop with records is safe
B AND unauthorised access likely
C AND serious harm is likely
D THEN breach is eligible
Line A — Loss of information can be an eligible data breach when unauthorised access or disclosure is likely. A laptop that is safe has no loss. The line should say the laptop is lost.

Student with a class code? Join your class →