APP 3: collecting only what is reasonably necessary

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A school library app lets students borrow books. Which data is reasonably necessary under APP 3?

A Student name and student ID

B Student's religion and family income

2. APP 3 says an organisation may collect personal information that is...

A possibly useful one day

B reasonably necessary for its functions

3. A gaming club sign-up form asks for your email so it can send event details. Is the email necessary or nice to have?

A Necessary for sending event details

B Nice to have, so it should not be asked

4. A shoe shop asks every online customer for their health history 'just in case'. What is the problem?

A It is sensitive information that is not necessary for selling shoes

B Nothing, because customers can just skip the question

5. Which method of collecting personal information meets the 'lawful and fair' part of APP 3?

A Secretly tracking users without telling them

B Asking users openly through a clear form

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1APP 3		Aif needed AND consent: collect(health)
2reasonably necessary		Bcollect(name, studentID) // no religion
3A school library app only needs a student's name and ID to lend books, so it does not ask for their religion		CThe data is collected in a sneaky and unfair way. APP 3 says collection must be lawful and fair, not hidden or deceptive.
4Sensitive information such as health details needs extra care, so collect it only when it is truly needed and with consent		DThe quiz app collects data it does not need, like home address and parents' jobs. These are nice to have, not reasonably necessary.
5signup_form: name, email, birthday, home address, parents' jobs // for a quiz app		EThe principle that says an organisation may only collect personal information that is reasonably necessary for its functions
6collect(location) secretly, without telling users		FThe test for whether a piece of data is really needed for the organisation's work, not just nice to have

Definitions

APP 3

Fill in the Blanks

Complete each line of code by filling in the missing parts.

APP _: collect only necessary information

IF field is _________ THEN collect it

method ← lawful AND ____

IF data is sensitive THEN get _______

IF needed = _____ THEN do not collect

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A purpose ← "borrow books"

B if is_interesting(field)

C collect(field)

Question 2

A method ← "sign-up form"

B openly ← false

C collect(email, method, openly)

Question 3

A for field in all_fields:

B ask(field)

C save(answers)

Question 4

A for field in form_fields:

B if is_necessary(field):

C ignore(field)

D else:

E skip(field)

Question 5

A data ← "health condition"

B sensitive ← true

C if not sensitive: extra_care()

Answer Key

APP 3: collecting only what is reasonably necessary

Section A: Quick Questions

A — Student name and student ID

B — reasonably necessary for its functions

A — Necessary for sending event details

A — It is sensitive information that is not necessary for selling shoes

B — Asking users openly through a clear form

Section B: Match the Pairs

APP 3 → The principle that says an organisation may only collect personal information that is reasonably necessary for its functions

reasonably necessary → The test for whether a piece of data is really needed for the organisation's work, not just nice to have

A school library app only needs a student's name and ID to lend books, so it does not ask for their religion → collect(name, studentID) // no religion

Sensitive information such as health details needs extra care, so collect it only when it is truly needed and with consent → if needed AND consent: collect(health)

signup_form: name, email, birthday, home address, parents' jobs // for a quiz app → The quiz app collects data it does not need, like home address and parents' jobs. These are nice to have, not reasonably necessary.

collect(location) secretly, without telling users → The data is collected in a sneaky and unfair way. APP 3 says collection must be lawful and fair, not hidden or deceptive.

Section C: Definitions

APP 3 — Australian Privacy Principle 3: only collect personal information that is reasonably necessary for your functions, and collect it lawfully and fairly. Take extra care with sensitive information.

Section D: Fill in the Blanks

APP 3: collect only necessary information

IF field is necessary THEN collect it

method ← lawful AND fair

IF data is sensitive THEN get consent

IF needed = FALSE THEN do not collect

Section E: Spot the Error

B — APP 3 says to collect only information that is reasonably necessary for your purpose. The test should be is_necessary(field, purpose), not whether the data is interesting to the organisation.

B — APP 3 requires collection to be lawful and fair. Collecting data secretly is unfair, so the collection must be done openly: openly ← true.

A — The loop should only go through the fields that are reasonably necessary. Looping through all_fields would also collect nice-to-have data. It should be needed_fields.

C — If a field is necessary, the program should collect it. Ignoring it means the necessary data is never collected, so the line should be collect(field).

C — APP 3 asks for extra care with sensitive information. The extra care step should run when sensitive is true, so the condition should be if sensitive, not if not sensitive.