IPP 9: transborder data flows

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. IPP 9 applies when personal information is sent...

A Between two departments in the same Victorian office

B Outside Victoria, such as interstate or overseas

2. A Victorian school app wants to store student details on a server in another country. Which condition could allow this under IPP 9?

A The overseas recipient is bound by similar privacy protection

B The server is cheaper than a Victorian one

3. Which is a way a Victorian organisation can legitimately send personal information interstate under IPP 9?

A The organisation decides the person would not mind

B The person gives consent to the transfer

4. What does 'equivalent protection' mean in IPP 9?

A The recipient must be bound by rules similar to Victoria's privacy principles

B The recipient must be located in the same suburb as the sender

5. A Victorian company wants to send customer data to an interstate cloud provider that has no privacy obligations and the customers have not agreed. Is this allowed under IPP 9?

A No, as there is no similar protection and no consent

B Yes, because interstate is still in Australia

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1IPP 9 transborder data flows		AOne way an organisation can legally send personal information interstate or overseas under IPP 9.
2Recipient bound by a law or contract with similar privacy protection		BIPP 9 applies to any transfer outside Victoria, including interstate, not just overseas.
3A Victorian organisation can send personal information outside Victoria if the individual agrees to the transfer.		CIF provider_protection = EQUIVALENT THEN transfer_data ELSE block_transfer END IF
4Before sending customer data to an interstate cloud provider, the organisation checks that the provider has equivalent privacy protection.		DIF consent_given = TRUE THEN send_data_to_overseas_server ELSE keep_data_in_Victoria END IF
5A school emails student records to an overseas company because the company is cheaper. It does not check protection or ask for consent.		EPersonal information can only be sent outside Victoria if specific conditions are met, such as similar protection or consent.
6Sending data to another Australian state is fine because IPP 9 only applies to overseas transfers.		FIPP 9 is breached because the school did not confirm similar privacy protection or get consent before sending personal information outside Victoria.

Definitions

IPP 9 transborder data flows

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF hasSimilarProtection __ hasConsent THEN SEND data TO overseasServer END IF

hasConsent ← TRUE IF __________ = TRUE THEN SEND data TO overseasServer

IF hasSimilarProtection OR hasConsent THEN SEND data ____ DISPLAY "Transfer blocked"

transferAllowed ← FALSE IF hasConsent = TRUE THEN transferAllowed ← ____

IF destination _ "Victoria" THEN CHECK equivalentProtection OR consent END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF destination <> Victoria

B OR similarProtection = TRUE

C THEN SEND personalInfo

Question 2

A INPUT destination, consentGiven

B IF destination = Interstate

C AND consentGiven = FALSE

D THEN SEND record

Question 3

A country <- Overseas

B IF country = Victoria THEN

C CHECK recipient protection

D ENDIF

Question 4

A recipientBound <- FALSE

B consent <- FALSE

C IF recipientBound AND consent

D SEND data

Question 5

A FOR EACH transfer IN queue

B IF recipientLaw = NONE

C SEND transfer

D NEXT transfer

Answer Key

IPP 9: transborder data flows

Section A: Quick Questions

B — Outside Victoria, such as interstate or overseas

A — The overseas recipient is bound by similar privacy protection

B — The person gives consent to the transfer

A — The recipient must be bound by rules similar to Victoria's privacy principles

A — No, as there is no similar protection and no consent

Section B: Match the Pairs

IPP 9 transborder data flows → Personal information can only be sent outside Victoria if specific conditions are met, such as similar protection or consent.

Recipient bound by a law or contract with similar privacy protection → One way an organisation can legally send personal information interstate or overseas under IPP 9.

A Victorian organisation can send personal information outside Victoria if the individual agrees to the transfer. → IF consent_given = TRUE THEN send_data_to_overseas_server ELSE keep_data_in_Victoria END IF

Before sending customer data to an interstate cloud provider, the organisation checks that the provider has equivalent privacy protection. → IF provider_protection = EQUIVALENT THEN transfer_data ELSE block_transfer END IF

A school emails student records to an overseas company because the company is cheaper. It does not check protection or ask for consent. → IPP 9 is breached because the school did not confirm similar privacy protection or get consent before sending personal information outside Victoria.

Sending data to another Australian state is fine because IPP 9 only applies to overseas transfers. → IPP 9 applies to any transfer outside Victoria, including interstate, not just overseas.

Section C: Definitions

IPP 9 transborder data flows — IPP 9 lets an organisation send personal information outside Victoria only if the recipient is bound by similar privacy protection, or the person consents.

Section D: Fill in the Blanks

IF hasSimilarProtection OR hasConsent THEN
  SEND data TO overseasServer
END IF

hasConsent ← TRUE
IF hasConsent = TRUE THEN
  SEND data TO overseasServer

IF hasSimilarProtection OR hasConsent THEN
  SEND data
ELSE
  DISPLAY "Transfer blocked"

transferAllowed ← FALSE
IF hasConsent = TRUE THEN
  transferAllowed ← TRUE

IF destination ≠ "Victoria" THEN
  CHECK equivalentProtection OR consent
END IF

Section E: Spot the Error

B — With OR, any transfer outside Victoria would be allowed even when the recipient has no similar protection. It should be AND, so the data is sent only if the recipient is bound by similar protection.

C — Consent is one of the two ways IPP 9 allows a transfer outside Victoria. The check must be consentGiven = TRUE, otherwise data is sent without the person's consent.

B — IPP 9 applies when information leaves Victoria. The condition should be country <> Victoria, not = Victoria, so the protection check runs for transfers outside the state.

C — IPP 9 needs only ONE of the two conditions: the recipient is bound by similar protection OR the person consents. It should use OR, not AND.

B — Data should only be sent when the recipient is covered by a similar privacy law. Testing for NONE would send data to recipients with no equivalent protection. It should be = SIMILAR.