← VCE Software Development U3O2

IPP 1: collection of personal information

Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, collect it lawfully and fairly, and tell people why you are collecting it.

Part of: VCE Software Development - U3O2 - Analysis and Design — Module 66, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 106, VCE Data Analytics - U3O2 - Analysis and Design — Module 101, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 105

Understanding IPP 1: collection of personal information in VCE Software Development U3O2

What it does: A signup form that asks only for the fields the app needs follows IPP 1 necessity. Extra fields like home address or birth date would not be needed. This text next to a form field tells users the purpose of the collection. That meets the IPP 1 requirement to give notice. IPP 1 requires personal information to be collected by lawful and fair means, and not in an unreasonably intrusive way. Secret collection is unfair. IPP 1 requires notice: the organisation must take reasonable steps to make the person aware of why it is collecting the information, who it may share it with and how to access it.

Common mistakes: IPP 1 allows collecting only information that is necessary for the organisation's functions. Religion is not needed to sign up, so the line should be ASK name, email. IPP 1 requires information to be collected by lawful and fair means. Secretly copying contacts is unfair and unnecessary. It should be ASK name, email.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add IPP 1: collection of personal information to a class →

This module's key terms are also in a printable crossword (Modules 52–71) and word search (Modules 52–85).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A Victorian school app asks students for their favourite colour just for fun. Does this follow IPP 1?

Yes - any information is fine if the student agreesNo - the information is not necessary for the school's functions

Matches

signup_form = ["name", "email", "medical_history", "tax_file_number"]

↓

The form collects medical history and a tax file number that a simple signup does not need, so it breaks the necessary collection rule of IPP 1.

Applying

Meanings

Term

IPP 1

Meaning

Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, collect it lawfully and fairly, and tell people why you are collecting it.

Practice

DISPLAY "We collect your name and email to send your tickets"

Testing

Gaps

IF dataIsNecessary = TRUE

Check Answer

Spots

1BEGIN signUpForm

2 ASK name, email, religion

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A Victorian school app asks students for their favourite colour just for fun. Does this follow IPP 1?

A. No - the information is not necessary for the school's functions ✓

B. Yes - any information is fine if the student agrees

IPP 1 says an organisation may only collect personal information that is necessary for one or more of its functions. Collecting extra data 'just because' breaks this.

2. Which action best shows the 'fair and lawful means' part of IPP 1?

A. Secretly recording users' activity without telling them

B. Asking users to fill in a clear sign-up form ✓

IPP 1 requires personal information to be collected by lawful and fair means, and not in an unreasonably intrusive way. Secret collection is unfair.

3. Under IPP 1, what must an organisation do when it collects personal information from a person?

A. Tell the person why the information is being collected ✓

B. Only tell the person if they ask

IPP 1 requires notice: the organisation must take reasonable steps to make the person aware of why it is collecting the information, who it may share it with and how to access it.

4. A library borrowing app needs to identify members. Which data is most likely 'necessary' under IPP 1?

A. Member name and contact details ✓

B. Member's religion and medical history

Name and contact details are needed to run a borrowing service. Religion and medical history are not necessary for that function, so collecting them breaks IPP 1.

5. True or false: IPP 1 is part of the Privacy and Data Protection Act 2014 (Vic).

A. False

B. True ✓

The Information Privacy Principles (IPPs) are in the Victorian Privacy and Data Protection Act 2014. The Australian Privacy Principles (APPs) are in the federal Privacy Act 1988.

Match the Pairs

IPP 1 → Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, and do it lawfully, fairly and with notice.

Collection notice → A statement given when personal information is collected that tells people who is collecting it, why, and how it will be used.

Necessary collection: only collect personal information that the organisation needs for one of its functions. → signup_form = ["username", "email"]

Telling people why data is collected: show a notice at the point of collection explaining the purpose. → <p>We collect your email to send booking receipts.</p>

signup_form = ["name", "email", "medical_history", "tax_file_number"] → The form collects medical history and a tax file number that a simple signup does not need, so it breaks the necessary collection rule of IPP 1.

Pre-ticked box: I agree to receive marketing from partners (hidden in small print) → The organisation collects data unfairly and without clear notice by hiding the purpose in small print.

Key Term

IPP 1

Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, collect it lawfully and fairly, and tell people why you are collecting it.

Fill in the Blanks

1. IF dataIsNecessary = TRUE THEN collect(dataItem) END IF

Hint: Type the keyword that follows an IF condition and starts the block that runs when it is true.

2. IF dataIsNecessary = FALSE THEN DISPLAY "Do not collect this data" END IF

Hint: Type the Boolean value that means the data is not needed for the organisation's functions.

3. IF isLawful AND isFair THEN collect(dataItem) END IF

Hint: Type the logical operator that makes sure both the lawful and fair conditions are true.

4. notice ← "We collect your email for receipts" DISPLAY notice collect(email)

Hint: Type the pseudocode command that shows the notice to the user before collecting.

5. IF noticeGiven AND isNecessary THEN collect(email) END IF

Hint: Type the function name that gathers the personal information once the checks pass.

Spot the Error

Question 1

A BEGIN signUpForm

B ASK name, email, religion

C SHOW notice of purpose

D END

Line B — IPP 1 allows collecting only information that is necessary for the organisation's functions. Religion is not needed to sign up, so the line should be ASK name, email.

Question 2

A BEGIN fitnessApp

B SHOW purpose notice

C IF user accepts THEN

D COPY contacts secretly

E END IF

Line D — IPP 1 requires information to be collected by lawful and fair means. Secretly copying contacts is unfair and unnecessary. It should be ASK name, email.

Question 3

A BEGIN tutorBooking

B SET required = name, phone

C SHOW notice after saving

D ASK required

Line C — IPP 1 says people must be told why their data is collected at or before collection. Showing the notice after saving is too late. It should be SHOW notice before asking.

Question 4

A BEGIN loyaltyCard

B ASK name, email

C MARK phone as optional

D HIDE why we ask

E END

Line D — IPP 1 requires organisations to tell people why their information is being collected. Hiding the reason breaks this notice requirement. It should be TELL user why we ask.

Question 5

A BEGIN schoolExcursion

B SHOW purpose notice

C ASK name, parent income

D END

Line C — Parent income is not necessary to run an excursion. IPP 1 limits collection to what is necessary, so the line should be ASK name, parent phone.

Student with a class code? Join your class →