IPP 10: sensitive information

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which of these is sensitive information under IPP 10?

A A student's religious beliefs

B A student's favourite colour

2. A school app wants to record each user's ethnic origin. What does IPP 10 normally require?

A Nothing, as long as the data is stored securely

B The user's consent

3. Which statement about IPP 10 is true?

A Sensitive information can only be collected in limited situations

B Sensitive information can be collected freely if it might be useful later

4. A developer builds a sign-up form. Which field needs consent under IPP 10?

A Field asking for a username

B Optional field asking for political opinions

5. Which is a valid reason to collect sensitive information under IPP 10?

A A law requires the information to be collected

B Collecting it will make the software more interesting

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1IPP 10: sensitive information		AIF consent OR lawAllows THEN collect(sensitiveData)
2consent == true		BsensitiveFields = [health, ethnicOrigin, beliefs]
3Sensitive information includes health, ethnic origin and religious or political beliefs, so a form asking for these needs extra care.		CSensitive information is collected without checking for consent or a legal exception, which breaks IPP 10.
4Sensitive information may be collected only if the person consents or the law allows or requires it.		DMaking a sensitive field like religion compulsory with no consent or legal reason, which is not permitted under IPP 10.
5IF isSensitive THEN collect(data) //no consent asked		EA Victorian privacy principle that limits collecting sensitive information such as health, ethnic origin or beliefs.
6Sign-up form: Name, Email, Religion (required, no explanation)		FThe person has agreed to their sensitive information being collected, which is the main condition IPP 10 allows.

Definitions

IPP 10: sensitive information

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF sensitive THEN _______ "Ask for consent" END IF

IF sensitive AND consent = _____ THEN DISPLAY "Cannot collect" END IF

IF consent __ lawAllows THEN collectData() END IF

IF sensitive AND consent ____ collectData() END IF

IF sensitive AND ___ consent THEN DISPLAY "Stop collecting" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A sensitive ← TRUE

B consent ← FALSE

C lawAllows ← TRUE

D IF consent AND lawAllows THEN

E collectData()

F END IF

Question 2

A INPUT infoType

B IF infoType = "religion" THEN

C sensitive ← FALSE

D END IF

Question 3

A sensitive ← TRUE

B consent ← TRUE

C IF sensitive AND consent THEN

D discard(healthRecord)

E ELSE

F DISPLAY "Consent needed"

Question 4

A sensitive ← TRUE

B IF consent = FALSE THEN

C collect(ethnicOrigin)

D END IF

Question 5

A list ← ["health", "postcode"]

B INPUT field

C IF field IN list THEN

D sensitive ← TRUE

Answer Key

IPP 10: sensitive information

Section A: Quick Questions

A — A student's religious beliefs

B — The user's consent

A — Sensitive information can only be collected in limited situations

B — Optional field asking for political opinions

A — A law requires the information to be collected

Section B: Match the Pairs

IPP 10: sensitive information → A Victorian privacy principle that limits collecting sensitive information such as health, ethnic origin or beliefs.

consent == true → The person has agreed to their sensitive information being collected, which is the main condition IPP 10 allows.

Sensitive information includes health, ethnic origin and religious or political beliefs, so a form asking for these needs extra care. → sensitiveFields = [health, ethnicOrigin, beliefs]

Sensitive information may be collected only if the person consents or the law allows or requires it. → IF consent OR lawAllows THEN collect(sensitiveData)

IF isSensitive THEN collect(data) //no consent asked → Sensitive information is collected without checking for consent or a legal exception, which breaks IPP 10.

Sign-up form: Name, Email, Religion (required, no explanation) → Making a sensitive field like religion compulsory with no consent or legal reason, which is not permitted under IPP 10.

Section C: Definitions

IPP 10: sensitive information — Victorian privacy principle: sensitive information (health, ethnic origin, beliefs) can only be collected with the person's consent or when the law allows it.

Section D: Fill in the Blanks

IF sensitive THEN
  DISPLAY "Ask for consent"
END IF

IF sensitive AND consent = FALSE THEN
  DISPLAY "Cannot collect"
END IF

IF consent OR lawAllows THEN
  collectData()
END IF

IF sensitive AND consent THEN
  collectData()
END IF

IF sensitive AND NOT consent THEN
  DISPLAY "Stop collecting"
END IF

Section E: Spot the Error

D — IPP 10 lets sensitive information be collected if the person consents OR the law allows it. Requiring both with AND is too strict. It should be IF consent OR lawAllows THEN.

C — Religious beliefs are sensitive information under IPP 10. The flag must be set to TRUE, not FALSE.

D — When the information is sensitive and the person has consented, IPP 10 allows collection. The line should be collect(healthRecord), not discard.

B — Ethnic origin is sensitive, so it can only be collected when consent is given. The condition should be consent = TRUE.

A — The list should hold types of sensitive information such as health and religion. A postcode is ordinary personal information, not sensitive information under IPP 10.