IPP 1: collection of personal information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A Victorian school app asks students for their favourite colour just for fun. Does this follow IPP 1?

A No - the information is not necessary for the school's functions

B Yes - any information is fine if the student agrees

2. Which action best shows the 'fair and lawful means' part of IPP 1?

A Secretly recording users' activity without telling them

B Asking users to fill in a clear sign-up form

3. Under IPP 1, what must an organisation do when it collects personal information from a person?

A Tell the person why the information is being collected

B Only tell the person if they ask

4. A library borrowing app needs to identify members. Which data is most likely 'necessary' under IPP 1?

A Member name and contact details

B Member's religion and medical history

5. True or false: IPP 1 is part of the Privacy and Data Protection Act 2014 (Vic).

A False

B True

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1IPP 1		A<p>We collect your email to send booking receipts.</p>
2Collection notice		BA statement given when personal information is collected that tells people who is collecting it, why, and how it will be used.
3Necessary collection: only collect personal information that the organisation needs for one of its functions.		Csignup_form = ["username", "email"]
4Telling people why data is collected: show a notice at the point of collection explaining the purpose.		DThe form collects medical history and a tax file number that a simple signup does not need, so it breaks the necessary collection rule of IPP 1.
5signup_form = ["name", "email", "medical_history", "tax_file_number"]		EThe organisation collects data unfairly and without clear notice by hiding the purpose in small print.
6Pre-ticked box: I agree to receive marketing from partners (hidden in small print)		FInformation Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, and do it lawfully, fairly and with notice.

Definitions

IPP 1

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF dataIsNecessary = TRUE ____ collect(dataItem) END IF

IF dataIsNecessary = _____ THEN DISPLAY "Do not collect this data" END IF

IF isLawful ___ isFair THEN collect(dataItem) END IF

notice ← "We collect your email for receipts" _______ notice collect(email)

IF noticeGiven AND isNecessary THEN _______(email) END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A BEGIN signUpForm

B ASK name, email, religion

C SHOW notice of purpose

D END

Question 2

A BEGIN fitnessApp

B SHOW purpose notice

C IF user accepts THEN

D COPY contacts secretly

E END IF

Question 3

A BEGIN tutorBooking

B SET required = name, phone

C SHOW notice after saving

D ASK required

Question 4

A BEGIN loyaltyCard

B ASK name, email

C MARK phone as optional

D HIDE why we ask

E END

Question 5

A BEGIN schoolExcursion

B SHOW purpose notice

C ASK name, parent income

D END

Answer Key

IPP 1: collection of personal information

Section A: Quick Questions

A — No - the information is not necessary for the school's functions

B — Asking users to fill in a clear sign-up form

A — Tell the person why the information is being collected

A — Member name and contact details

B — True

Section B: Match the Pairs

IPP 1 → Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, and do it lawfully, fairly and with notice.

Collection notice → A statement given when personal information is collected that tells people who is collecting it, why, and how it will be used.

Necessary collection: only collect personal information that the organisation needs for one of its functions. → signup_form = ["username", "email"]

Telling people why data is collected: show a notice at the point of collection explaining the purpose. → <p>We collect your email to send booking receipts.</p>

signup_form = ["name", "email", "medical_history", "tax_file_number"] → The form collects medical history and a tax file number that a simple signup does not need, so it breaks the necessary collection rule of IPP 1.

Pre-ticked box: I agree to receive marketing from partners (hidden in small print) → The organisation collects data unfairly and without clear notice by hiding the purpose in small print.

Section C: Definitions

IPP 1 — Information Privacy Principle 1 (Vic): only collect personal information that is necessary for your functions, collect it lawfully and fairly, and tell people why you are collecting it.

Section D: Fill in the Blanks

IF dataIsNecessary = TRUE THEN
    collect(dataItem)
END IF

IF dataIsNecessary = FALSE THEN
    DISPLAY "Do not collect this data"
END IF

IF isLawful AND isFair THEN
    collect(dataItem)
END IF

notice ← "We collect your email for receipts"
DISPLAY notice
collect(email)

IF noticeGiven AND isNecessary THEN
    collect(email)
END IF

Section E: Spot the Error

B — IPP 1 allows collecting only information that is necessary for the organisation's functions. Religion is not needed to sign up, so the line should be ASK name, email.

D — IPP 1 requires information to be collected by lawful and fair means. Secretly copying contacts is unfair and unnecessary. It should be ASK name, email.

C — IPP 1 says people must be told why their data is collected at or before collection. Showing the notice after saving is too late. It should be SHOW notice before asking.

D — IPP 1 requires organisations to tell people why their information is being collected. Hiding the reason breaks this notice requirement. It should be TELL user why we ask.

C — Parent income is not necessary to run an excursion. IPP 1 limits collection to what is necessary, so the line should be ASK name, parent phone.