APP 9: adoption, use or disclosure of government related identifiers

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A gym wants a unique ID for each member. Which approach follows APP 9?

A Generate its own member ID such as GYM-1042

B Use each member's Medicare number as their member ID

2. Which of these is a government related identifier under APP 9?

A A customer ID created by the business

B A tax file number (TFN)

3. True or false: Under APP 9, an online shop can use a student's Medicare number as its database primary key for that customer.

A True

B False

4. A developer designs a customer table. Which primary key design is better for APP 9 compliance?

A customerId (auto-generated by the system)

B taxFileNumber (entered by the customer)

5. Which statement about APP 9 is correct?

A It allows only limited exceptions to using government identifiers as your own ID

B It lets any business use any government identifier as its ID

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1customerId = 'C-1042'		Aif (lawRequiresIdentifier) { useIdentifier() }
2customerId = medicareNumber		Bcustomer.id = generateNewId()
3Government related identifiers, such as a tax file number, should be kept out of the field used to identify the person in your system.		CThe system looks up and identifies customers by their tax file number, adopting a government identifier as its own ID.
4APP 9 has limited exceptions, so an organisation may only use a government identifier where the law allows, such as to meet a legal obligation.		DThe Medicare number is set as the primary key, so the organisation is using a government identifier as its own identifier for the person.
5SELECT * FROM customers WHERE taxFileNumber = '123 456 782'		EThe organisation uses its own internal identifier for a person, which is the approach APP 9 expects.
6primaryKey = medicareNumber		FAdopting a government identifier as the organisation's own ID for a person, which APP 9 restricts.

Definitions

APP 9

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF idSource _ "Medicare" THEN DISPLAY "Cannot use as our ID" END IF

IF idSource = "TFN" ____ DISPLAY "Cannot use as our ID" END IF

lastID ← 1041 customerID ← lastID _ 1 STORE customerID WITH name

customerID ← lastID + 1 record.id ← __________ record.name ← name

IF ___ lawRequiresTFN THEN customerID ← lastID + 1 END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A INPUT name

B INPUT medicareNo

C customerId ← medicareNo

D STORE name, customerId

Question 2

A INPUT name, tfn

B id ← GENERATE_ID()

C SAVE tfn AS key, name

Question 3

A INPUT name, licenceNo

B memberId ← licenceNo

C SAVE memberId, name TO members

Question 4

A ID_TYPE ← 'MEDICARE_NO'

B id ← CREATE_ID(ID_TYPE)

C SAVE id TO customerTable

Question 5

A customerId ← newCustomerId()

B SEND medicareNo TO partner

C LOG 'sent ID'

Answer Key

APP 9: adoption, use or disclosure of government related identifiers

Section A: Quick Questions

A — Generate its own member ID such as GYM-1042

B — A tax file number (TFN)

B — False

A — customerId (auto-generated by the system)

A — It allows only limited exceptions to using government identifiers as your own ID

Section B: Match the Pairs

customerId = 'C-1042' → The organisation uses its own internal identifier for a person, which is the approach APP 9 expects.

customerId = medicareNumber → Adopting a government identifier as the organisation's own ID for a person, which APP 9 restricts.

Government related identifiers, such as a tax file number, should be kept out of the field used to identify the person in your system. → customer.id = generateNewId()

APP 9 has limited exceptions, so an organisation may only use a government identifier where the law allows, such as to meet a legal obligation. → if (lawRequiresIdentifier) { useIdentifier() }

SELECT * FROM customers WHERE taxFileNumber = '123 456 782' → The system looks up and identifies customers by their tax file number, adopting a government identifier as its own ID.

primaryKey = medicareNumber → The Medicare number is set as the primary key, so the organisation is using a government identifier as its own identifier for the person.

Section C: Definitions

APP 9 — An organisation must not adopt a government identifier (e.g. Medicare or tax file number) as its own ID for a person. It should use its own customer ID, with limited exceptions.

Section D: Fill in the Blanks

IF idSource = "Medicare" THEN
    DISPLAY "Cannot use as our ID"
END IF

IF idSource = "TFN" THEN
    DISPLAY "Cannot use as our ID"
END IF

lastID ← 1041
customerID ← lastID + 1
STORE customerID WITH name

customerID ← lastID + 1
record.id ← customerID
record.name ← name

IF NOT lawRequiresTFN THEN
    customerID ← lastID + 1
END IF

Section E: Spot the Error

C — The clinic is adopting the Medicare number as its own customer ID, which APP 9 restricts. It should create its own ID with customerId ← newCustomerId().

C — The tax file number is being used as the record key, so it has become the organisation's identifier for the person. The key should be the organisation's own generated id.

B — A driver licence number is a government related identifier, so the gym must not adopt it as the member ID. It should use its own number from NEXT_MEMBER_ID().

A — Setting the ID type to a Medicare number means every person would be identified by a government identifier. APP 9 says to use the organisation's own ID type, such as 'CUSTOMER_ID'.

B — APP 9 also limits disclosing a government related identifier. Unless an exception applies, send the organisation's own customerId instead of the Medicare number.