Privacy-enhancing practices as an emerging trend

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which practice best describes data minimisation?

A Collecting only the personal data needed for a stated purpose

B Collecting as much data as possible in case it is useful later

2. A school app is set up so location sharing is OFF until a student turns it on. Which idea is this?

A Privacy by default

B Data repurposing

3. True or false: limiting retention means deleting personal data once it is no longer needed.

A False

B True

4. Which is an example of encryption by default?

A Records are encrypted only if an employee remembers to switch it on

B Customer records are automatically encrypted when saved to the database

5. Why are privacy-enhancing practices an emerging trend?

A They reduce the personal data held and exposed, lowering privacy risk

B They let organisations store more personal data for longer

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1data minimisation		Astorage.encrypt_at_rest = True
2limiting retention		Bprofile_visibility = 'private'
3Privacy by default means the most privacy-protective settings are switched on automatically, without the user having to change anything		CKeeping personal data forever ignores limiting retention. It should be deleted or de-identified once the purpose is finished.
4Encryption by default means stored personal data is scrambled automatically, so stolen data is unreadable without the key		DDelete or de-identify personal data once it is no longer needed, instead of keeping it forever
5signup_form.fields = ['name', 'address', 'DOB', 'income', 'religion'] # for a newsletter		ECollect and keep only the personal data that is really needed for a stated purpose, so less is held and exposed
6retention_period = 'forever'		FThe form collects far more personal data than a newsletter needs, which breaks data minimisation. Only an email address is needed.

Definitions

privacy-enhancing practices

Fill in the Blanks

Complete each line of code by filling in the missing parts.

______ FROM orders WHERE orderDate < '2020-01-01';

profileSharing = ___

UPDATE students SET lastName = ____;

SELECT house, _____(*) FROM students GROUP BY house;

encryptByDefault = ____

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A needed = ['name', 'email']

B collect = needed + ['tfn']

C print(collect)

Question 2

A retention_days = 90

B age = today - record.created

C if age < retention_days:

D delete(record)

Question 3

A row = get_customer(7)

B row['name'] = row['name']

C del row['email']

D save_for_analysis(row)

Question 4

A encrypt_by_default = False

B if encrypt_by_default:

C data = encrypt(data, key)

D store(data)

Question 5

A def new_account(user):

B user.sharing = False

C user.tracking = False

D user.profile = 'public'

E return user

Answer Key

Privacy-enhancing practices as an emerging trend

Section A: Quick Questions

A — Collecting only the personal data needed for a stated purpose

A — Privacy by default

B — True

B — Customer records are automatically encrypted when saved to the database

A — They reduce the personal data held and exposed, lowering privacy risk

Section B: Match the Pairs

data minimisation → Collect and keep only the personal data that is really needed for a stated purpose, so less is held and exposed

limiting retention → Delete or de-identify personal data once it is no longer needed, instead of keeping it forever

Privacy by default means the most privacy-protective settings are switched on automatically, without the user having to change anything → profile_visibility = 'private'

Encryption by default means stored personal data is scrambled automatically, so stolen data is unreadable without the key → storage.encrypt_at_rest = True

signup_form.fields = ['name', 'address', 'DOB', 'income', 'religion'] # for a newsletter → The form collects far more personal data than a newsletter needs, which breaks data minimisation. Only an email address is needed.

retention_period = 'forever' → Keeping personal data forever ignores limiting retention. It should be deleted or de-identified once the purpose is finished.

Section C: Definitions

privacy-enhancing practices — Newer practices like data minimisation, anonymisation and encryption by default that reduce the personal data an organisation holds and exposes, lowering privacy risk.

Section D: Fill in the Blanks

DELETE FROM orders
WHERE orderDate < '2020-01-01';

profileSharing = OFF

UPDATE students SET lastName = NULL;

SELECT house, COUNT(*) FROM students
GROUP BY house;

encryptByDefault = TRUE

Section E: Spot the Error

B — Data minimisation means collecting only the data that is needed. Adding 'tfn' collects extra personal data. The line should be collect = needed.

C — Limiting retention means deleting records once they are older than the retention period. Using < deletes new records and keeps the old ones. It should be if age > retention_days:.

B — Anonymisation removes direct identifiers. This line just reassigns the name, so the person is still identifiable. It should be del row['name'].

A — Encryption by default means data is encrypted unless someone chooses otherwise. Setting the flag to False means the data is stored unencrypted. It should be True.

D — Privacy by default means the most private settings apply to new accounts. A public profile exposes personal data by default. It should be 'private'.