APP 8: sending personal data overseas

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A Victorian school wants to store student names on a cloud server in another country. What does APP 8 say the school must do first?

A Take reasonable steps to make sure the overseas company will protect the information

B Nothing, because cloud servers are always covered by Australian law

2. Which situation is covered by APP 8?

A An Australian app company sends user details to a server located overseas

B A student saves their own homework to a USB drive at home

3. What does 'reasonable steps' mean under APP 8?

A Sensible checks, like a contract that requires the overseas company to protect the data

B Hoping the overseas company is careful and not asking any questions

4. True or false: APP 8 only matters AFTER the personal information has already been sent overseas.

A True. The checks happen after the data arrives

B False. The steps must be taken before it is sent

5. Which is the better example of a reasonable step before using a cloud service in another country?

A Choosing the cheapest provider without reading its terms

B Signing a contract that requires the provider to keep the data secure

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1APP 8		AIF server_country != Australia THEN check_overseas_protection()
2reasonable steps		Bcontract.require(privacy_rules)
3An app stores user photos on servers in another country, so the company must check the overseas provider's protections first.		CSensible actions, like checking a contract or privacy policy, to make sure an overseas company will protect the data.
4One reasonable step is a contract that requires the overseas cloud provider to follow privacy rules.		DThis wrongly skips APP 8 for overseas servers. APP 8 applies exactly when data is sent overseas, so the checks should run in that case.
5upload(userData, overseasServer) // no checks		EBefore personal information is sent overseas, the organisation must take reasonable steps to make sure the overseas recipient will also protect it.
6IF server_country != Australia THEN skip_APP8		FThe data is sent offshore without any reasonable steps to check that the recipient will protect it. Check the provider first, then upload.

Definitions

APP 8

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF serverCountry __ "Australia" THEN takeReasonableSteps(recipient) END IF

IF dataGoesOffshore THEN ___________________(overseasRecipient) END IF

IF recipientProtects = ____ THEN sendData(customerInfo) END IF

IF serverCountry != "Australia" ____ takeReasonableSteps(cloudProvider) END IF

overseas ← serverCountry != "Australia" IF ________ THEN takeReasonableSteps(recipient)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF sending data locally THEN

B take reasonable steps

C confirm recipient protects it

D SEND data to cloud server

Question 2

A recipient ← cloud in Japan

B IGNORE recipient privacy rules

C IF check passed THEN

D SEND personal data

Question 3

A app ← photo app

B server ← overseas

C IF reasonable steps taken THEN

D DO NOT SEND data to server

E ELSE ask for a safer provider

Question 4

A // APP 8 covers local data

B recipient ← cloud in Ireland

C CHECK recipient protects data

Question 5

A app ← study planner app

B servers ← overseas

C steps ← none

D IF steps taken THEN upload

Answer Key

APP 8: sending personal data overseas

Section A: Quick Questions

A — Take reasonable steps to make sure the overseas company will protect the information

A — An Australian app company sends user details to a server located overseas

A — Sensible checks, like a contract that requires the overseas company to protect the data

B — False. The steps must be taken before it is sent

B — Signing a contract that requires the provider to keep the data secure

Section B: Match the Pairs

APP 8 → Before personal information is sent overseas, the organisation must take reasonable steps to make sure the overseas recipient will also protect it.

reasonable steps → Sensible actions, like checking a contract or privacy policy, to make sure an overseas company will protect the data.

An app stores user photos on servers in another country, so the company must check the overseas provider's protections first. → IF server_country != Australia THEN check_overseas_protection()

One reasonable step is a contract that requires the overseas cloud provider to follow privacy rules. → contract.require(privacy_rules)

upload(userData, overseasServer) // no checks → The data is sent offshore without any reasonable steps to check that the recipient will protect it. Check the provider first, then upload.

IF server_country != Australia THEN skip_APP8 → This wrongly skips APP 8 for overseas servers. APP 8 applies exactly when data is sent overseas, so the checks should run in that case.

Section C: Definitions

APP 8 — Before sending personal information overseas, such as to a cloud server, an organisation must take reasonable steps to make sure the overseas recipient will also protect it.

Section D: Fill in the Blanks

IF serverCountry != "Australia" THEN
  takeReasonableSteps(recipient)
END IF

IF dataGoesOffshore THEN
  takeReasonableSteps(overseasRecipient)
END IF

IF recipientProtects = TRUE THEN
  sendData(customerInfo)
END IF

IF serverCountry != "Australia" THEN
  takeReasonableSteps(cloudProvider)
END IF

overseas ← serverCountry != "Australia"
IF overseas THEN
  takeReasonableSteps(recipient)

Section E: Spot the Error

A — APP 8 applies when personal information is sent overseas, not kept in Australia. The condition should be IF sending data overseas THEN.

B — APP 8 requires reasonable steps to check that the overseas recipient will protect the data. The line should be CHECK recipient privacy rules, not ignore them.

D — When reasonable steps have been taken, the data can be sent. This line is the wrong way round. It should be SEND data to server.

A — APP 8 is about personal information sent overseas, such as to a cloud server in another country. The comment should say overseas data.

C — APP 8 needs reasonable steps, such as a contract or a privacy audit. Taking no steps does not meet it. It should list real steps like contract + audit.