← VCE Software Development U3O2

APP 9: adoption, use or disclosure of government related identifiers

An organisation must not adopt a government identifier (e.g. Medicare or tax file number) as its own ID for a person. It should use its own customer ID, with limited exceptions.

Part of: VCE Software Development - U3O2 - Analysis and Design — Module 63, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 103, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 25

Understanding APP 9: adoption, use or disclosure of government related identifiers in VCE Software Development U3O2

What it does: Generating a new internal ID means the system does not rely on a tax file number to identify the person. The condition shows the identifier is used only when an exception applies, rather than as a normal identifier for the person. APP 9 stops organisations adopting a government related identifier as their own ID. An internal ID like GYM-1042 is the compliant choice. Using a Medicare number as the primary key adopts a government identifier as the organisation's own ID, which APP 9 restricts. Use a generated customerId instead. APP 9 is a restriction with limited exceptions, for example where the use is required or authorised by law. It is not a free-for-all.

Common mistakes: The clinic is adopting the Medicare number as its own customer ID, which APP 9 restricts. It should create its own ID with customerId ← newCustomerId(). The tax file number is being used as the record key, so it has become the organisation's identifier for the person. The key should be the organisation's own generated id.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add APP 9: adoption, use or disclosure of government related identifiers to a class →

This module's key terms are also in a printable crossword (Modules 52–71) and word search (Modules 52–85).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A gym wants a unique ID for each member. Which approach follows APP 9?
Generate its own member ID such as GYM-1042Use each member's Medicare number as their member ID
Matches
SELECT * FROM customers WHERE taxFileNumber = '123 456 782'
↓
The system looks up and identifies customers by their tax file number, adopting a government identifier as its own ID.
Applying
Meanings
Term
APP 9
Meaning
An organisation must not adopt a government identifier (e.g. Medicare or tax file number) as its own ID for a person. It should use its own customer ID, with limited exceptions.
Practice
BEGIN RegisterCustomer
Testing
Gaps
IF idSource "Medicare" THEN
Check Answer
Spots
2INPUT medicareNo
3customerId ← medicareNo

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Giant Squid' badge — Nested Navigator, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A gym wants a unique ID for each member. Which approach follows APP 9?
A. Generate its own member ID such as GYM-1042 ✓
B. Use each member's Medicare number as their member ID
APP 9 stops organisations adopting a government related identifier as their own ID. An internal ID like GYM-1042 is the compliant choice.
2. Which of these is a government related identifier under APP 9?
A. A customer ID created by the business
B. A tax file number (TFN) ✓
A TFN is issued by a government agency, so it is a government related identifier. A business-created customer ID is the organisation's own identifier.
3. True or false: Under APP 9, an online shop can use a student's Medicare number as its database primary key for that customer.
A. True
B. False ✓
Using a Medicare number as the primary key adopts a government identifier as the organisation's own ID, which APP 9 restricts. Use a generated customerId instead.
4. A developer designs a customer table. Which primary key design is better for APP 9 compliance?
A. customerId (auto-generated by the system) ✓
B. taxFileNumber (entered by the customer)
An auto-generated customerId belongs to the organisation. Using the TFN as the key would adopt a government identifier as the organisation's own.
5. Which statement about APP 9 is correct?
A. It allows only limited exceptions to using government identifiers as your own ID ✓
B. It lets any business use any government identifier as its ID
APP 9 is a restriction with limited exceptions, for example where the use is required or authorised by law. It is not a free-for-all.

Match the Pairs

customerId = 'C-1042' → The organisation uses its own internal identifier for a person, which is the approach APP 9 expects.
customerId = medicareNumber → Adopting a government identifier as the organisation's own ID for a person, which APP 9 restricts.
Government related identifiers, such as a tax file number, should be kept out of the field used to identify the person in your system. → customer.id = generateNewId()
APP 9 has limited exceptions, so an organisation may only use a government identifier where the law allows, such as to meet a legal obligation. → if (lawRequiresIdentifier) { useIdentifier() }
SELECT * FROM customers WHERE taxFileNumber = '123 456 782' → The system looks up and identifies customers by their tax file number, adopting a government identifier as its own ID.
primaryKey = medicareNumber → The Medicare number is set as the primary key, so the organisation is using a government identifier as its own identifier for the person.

Key Term

APP 9
An organisation must not adopt a government identifier (e.g. Medicare or tax file number) as its own ID for a person. It should use its own customer ID, with limited exceptions.

Fill in the Blanks

1. IF idSource = "Medicare" THEN DISPLAY "Cannot use as our ID" END IF
Hint: Type the comparison operator that checks whether two values are equal.
2. IF idSource = "TFN" THEN DISPLAY "Cannot use as our ID" END IF
Hint: Type the keyword that starts the block that runs when the condition is true.
3. lastID ← 1041 customerID ← lastID + 1 STORE customerID WITH name
Hint: Type the arithmetic operator that creates the next sequential number for the organisation's own customer ID.
4. customerID ← lastID + 1 record.id ← customerID record.name ← name
Hint: Type the variable that holds the organisation's own ID, not a government identifier.
5. IF NOT lawRequiresTFN THEN customerID ← lastID + 1 END IF
Hint: Type the logical keyword that reverses a condition, so an own ID is used unless a legal exception applies.

Spot the Error

Question 1
A INPUT name
B INPUT medicareNo
C customerId ← medicareNo
D STORE name, customerId
Line C — The clinic is adopting the Medicare number as its own customer ID, which APP 9 restricts. It should create its own ID with customerId ← newCustomerId().
Question 2
A INPUT name, tfn
B id ← GENERATE_ID()
C SAVE tfn AS key, name
Line C — The tax file number is being used as the record key, so it has become the organisation's identifier for the person. The key should be the organisation's own generated id.
Question 3
A INPUT name, licenceNo
B memberId ← licenceNo
C SAVE memberId, name TO members
Line B — A driver licence number is a government related identifier, so the gym must not adopt it as the member ID. It should use its own number from NEXT_MEMBER_ID().
Question 4
A ID_TYPE ← 'MEDICARE_NO'
B id ← CREATE_ID(ID_TYPE)
C SAVE id TO customerTable
Line A — Setting the ID type to a Medicare number means every person would be identified by a government identifier. APP 9 says to use the organisation's own ID type, such as 'CUSTOMER_ID'.
Question 5
A customerId ← newCustomerId()
B SEND medicareNo TO partner
C LOG 'sent ID'
Line B — APP 9 also limits disclosing a government related identifier. Unless an exception applies, send the organisation's own customerId instead of the Medicare number.

Student with a class code? Join your class →