Legal and ethical consequences of ineffective security
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. A company's weak security exposes customer data and it never tells the OAIC or the affected people. Which type of consequence is this most directly?
2. Which statement best links a consequence to evidence in a case?
3. Customers' medical details are leaked and some face embarrassment and fraud. This is an example of:
4. Which is a possible LEGAL consequence of ineffective security?
5. An organisation knew about a breach for weeks but told nobody. What is the strongest ethical criticism?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1Breach of privacy law | AA legal and ethical consequence: the organisation did not tell the Commissioner and affected people about an eligible data breach | |
| 2Failure to notify | BA legal consequence: the organisation failed to take reasonable security steps, so it may face Privacy Act penalties or action from the regulator | |
| 3Harm to affected people is an ethical consequence, and the case should show the evidence of this harm | CIt states a legal consequence without naming the law broken or any evidence from the case. | |
| 4A legal consequence is justified by pointing to the law broken and the case evidence showing it | DEvidence: no encryption on files, so APP 11 was breached | |
| 5The breach was embarrassing, so the company faces legal penalties. | EIt ignores the ethical criticism, because hiding a breach is also a lack of transparency that leaves people unable to protect themselves. | |
| 6Failing to tell customers about the breach is only a legal issue, not an ethical one. | FEvidence: stolen names and addresses led to identity theft and stress |
C
Definitions
legal and ethical consequences
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
Weak security can breach _______ law
2.
Failure to ______ breaches the NDB scheme
3.
Harm to affected people is an _______ issue
4.
Always link each consequence to ________
in the case
5.
Evidence: data was unencrypted
Legal: APP __ requires reasonable steps
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
IF serious_harm = FALSE THEN
B
notify Commissioner
C
notify individuals
D
END IF
Question 2
A
evidence ← 'no encryption'
B
principle ← 'APP 11'
C
link ← evidence + principle
D
claim ← 'APP 3 was breached'
Question 3
A
suspected ← TRUE
B
days_to_assess ← 30
C
IF days_to_assess < 30 THEN
D
status ← 'non-compliant'
Question 4
A
FOR each affected person
B
notify via s 26WK
C
NEXT person
Question 5
A
evidence ← 'notice sent fast'
B
issue ← 'lack of transparency'
C
OUTPUT issue, evidence
Answer Key
Legal and ethical consequences of ineffective security
Section A: Quick Questions
Q1
A — Legal: failure to notify under the Notifiable Data Breaches scheme
Q2
A — The firm kept unencrypted records, so it likely breached APP 11 on securing personal information
Q3
A — Ethical criticism for harm to affected people
Q4
B — Investigation and penalties under privacy law
Q5
B — It was not open with affected people, who could not protect themselves
Section B: Match the Pairs
Q1
Breach of privacy law → A legal consequence: the organisation failed to take reasonable security steps, so it may face Privacy Act penalties or action from the regulator
Q2
Failure to notify → A legal and ethical consequence: the organisation did not tell the Commissioner and affected people about an eligible data breach
Q3
Harm to affected people is an ethical consequence, and the case should show the evidence of this harm → Evidence: stolen names and addresses led to identity theft and stress
Q4
A legal consequence is justified by pointing to the law broken and the case evidence showing it → Evidence: no encryption on files, so APP 11 was breached
Q5
The breach was embarrassing, so the company faces legal penalties. → It states a legal consequence without naming the law broken or any evidence from the case.
Q6
Failing to tell customers about the breach is only a legal issue, not an ethical one. → It ignores the ethical criticism, because hiding a breach is also a lack of transparency that leaves people unable to protect themselves.
Section C: Definitions
Q1
legal and ethical consequences — Penalties under privacy law and ethical criticism faced when weak security exposes data, such as breaching privacy law or failing to notify. Link each to evidence in the case.Section D: Fill in the Blanks
Q1
Weak security can breach privacy lawQ2
Failure to notify breaches the NDB schemeQ3
Harm to affected people is an ethical issueQ4
Always link each consequence to evidence
in the caseQ5
Evidence: data was unencrypted
Legal: APP 11 requires reasonable stepsSection E: Spot the Error
Q1
A — Notification is required when an eligible breach is likely to cause serious harm. The condition should be serious_harm = TRUE. With FALSE, the notices would only be sent when there is no serious harm.
Q2
D — The evidence is unencrypted data, and the principle linked to it is APP 11 (security of personal information). The claim must name APP 11, not APP 3, which covers collection.
Q3
C — A suspected breach must be assessed within 30 days (s 26WH). The firm is non-compliant when the time taken is greater than 30 days, so the test should use >, not <.
Q4
B — Notifying affected individuals falls under s 26WL. Section 26WK covers the statement to the Commissioner, so the wrong section is cited.
Q5
A — The ethical issue is lack of transparency, so the evidence must show that people were not told. Evidence of a fast notice does not support the issue. It should say something like 'no breach notice'.