IPP 7: unique identifiers

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. When may a Victorian organisation assign a unique identifier to a person under IPP 7?

A Only if it is necessary to carry out its functions efficiently

B Whenever it wants to make its database look tidier

2. Which is an example of a unique identifier?

A A person's favourite colour

B A student ID number assigned to one person

3. A new gym wants to use the driver licence number of each member as its own member ID. What does IPP 7 say?

A It should not adopt another organisation's identifier as its own, unless an exception applies

B It can freely adopt any identifier that another organisation has assigned

4. Which approach follows IPP 7 when building a school library system?

A Use each student's Medicare number as the library card number

B Generate a new library card number for each student

5. Under IPP 7, an organisation can use or disclose an identifier assigned by another organisation if...

A the person has consented, or it is needed to fulfil its obligations to the organisation that assigned it

B it thinks the identifier might be useful for marketing later

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1IPP 7		AVictorian principle that limits when an organisation can assign or share a unique identifier for a person
2Unique identifier		BIF ID is not necessary for function THEN do not assign ID
3Assigning identifiers: an organisation should only give a person a new unique ID if it is necessary to carry out its functions		CIF ID belongs to another organisation AND no exception THEN do not use as own ID
4Using another organisation's identifier: an organisation should not adopt or share another organisation's ID for a person as its own, unless an exception applies		DThis discloses a unique identifier to a third party without a necessary function, consent or legal requirement. Under IPP 7 it should not be shared unless an exception applies.
5student.id = tax_file_number // reuse another organisation's ID as our own ID		EA number or code, such as a customer ID, that is given to a person so an organisation can tell them apart from others
6shareID(customer.id, advertiser) // no consent, no legal need		FThis adopts an identifier assigned by another organisation as the system's own identifier, which IPP 7 limits. The system should generate its own ID instead, such as student.id = newStudentID().

Definitions

IPP 7

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF neededForFunction = ____ THEN assignId(person) END IF

IF ___ neededForFunction THEN DISPLAY "Do not assign an ID" END IF

IF usesOtherOrgId ___ NOT exception THEN blockUse(person) END IF

IF requiredByLaw __ consentGiven THEN allowUse(personId) END IF

IF NOT needed THEN uniqueId ← ____ END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A FUNCTION assignId(student)

B IF NOT idIsNecessary THEN

C RETURN newUniqueId()

D END IF

E END FUNCTION

Question 2

A IF TRUE THEN

B member.id ← newMemberId()

C SAVE member

D END IF

Question 3

A extId ← GET licenceNumber

B idChecked ← TRUE

C ownId ← NewCustomerId()

D customerId ← extId

Question 4

A extId ← student.centrelinkId

B IF consent OR marketing THEN

C SEND extId TO partner

D END IF

Question 5

A FUNCTION buildSignup()

B ASK name, email

C ASK licenceNo

D END FUNCTION

Answer Key

IPP 7: unique identifiers

Section A: Quick Questions

A — Only if it is necessary to carry out its functions efficiently

B — A student ID number assigned to one person

A — It should not adopt another organisation's identifier as its own, unless an exception applies

B — Generate a new library card number for each student

A — the person has consented, or it is needed to fulfil its obligations to the organisation that assigned it

Section B: Match the Pairs

IPP 7 → Victorian principle that limits when an organisation can assign or share a unique identifier for a person

Unique identifier → A number or code, such as a customer ID, that is given to a person so an organisation can tell them apart from others

Assigning identifiers: an organisation should only give a person a new unique ID if it is necessary to carry out its functions → IF ID is not necessary for function THEN do not assign ID

Using another organisation's identifier: an organisation should not adopt or share another organisation's ID for a person as its own, unless an exception applies → IF ID belongs to another organisation AND no exception THEN do not use as own ID

student.id = tax_file_number // reuse another organisation's ID as our own ID → This adopts an identifier assigned by another organisation as the system's own identifier, which IPP 7 limits. The system should generate its own ID instead, such as student.id = newStudentID().

shareID(customer.id, advertiser) // no consent, no legal need → This discloses a unique identifier to a third party without a necessary function, consent or legal requirement. Under IPP 7 it should not be shared unless an exception applies.

Section C: Definitions

IPP 7 — Limits an organisation from assigning or sharing a unique identifier for a person unless it is necessary for its functions, with limited exceptions.

Section D: Fill in the Blanks

IF neededForFunction = TRUE THEN
    assignId(person)
END IF

IF NOT neededForFunction THEN
    DISPLAY "Do not assign an ID"
END IF

IF usesOtherOrgId AND NOT exception THEN
    blockUse(person)
END IF

IF requiredByLaw OR consentGiven THEN
    allowUse(personId)
END IF

IF NOT needed THEN
    uniqueId ← NULL
END IF

Section E: Spot the Error

B — IPP 7 only lets an organisation assign a unique identifier when it is necessary for its functions. The condition must be IF idIsNecessary THEN. With NOT, identifiers would be assigned exactly when they are not needed.

A — The condition TRUE assigns an identifier to every member regardless of need. IPP 7 requires the check IF idNeededForFunction THEN before assigning one.

D — IPP 7 stops an organisation adopting another organisation's identifier (here the licence number) as its own. The customer ID should come from the organisation's own ID: customerId ← ownId.

B — IPP 7 only allows another organisation's identifier to be used or disclosed in limited exceptions, such as consent or law. Marketing is not an exception, so the condition should be IF consent OR lawRequires THEN.

C — An individual should only be required to provide an identifier if the law requires it (or the identifier is linked to its original purpose, or they consent). The licence number must only be asked for inside the exception: IF byLaw THEN ASK licenceNo.