The Australian Privacy Principles

The Australian Privacy Principles (APPs) say what organisations must do with personal information: collect only what they need (APP 3), tell people what and why (APP 5), use and share it only for that purpose unless people agree (APP 6), keep it secure (APP 11), and let people see and correct it (APP 12). A privacy policy doesn't override them.

The club gave members' emails to a sports shop. It's in the privacy policy, page 40. Is that allowed?

Your mission: the club app holds members' personal information, so the Australian Privacy Principles apply. Audit what it does, fix what breaches them, and write its privacy notice.

Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.

EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.

Engage: is it allowed?

The club's privacy policy says it may share members' details with partners. Can it give their emails to a sports shop for advertising?Yes, as long as the shop is localNot without asking: sharing for a different purpose needs people's agreementOnly on weekendsYes: the policy says so

ExploreTry it on the board and compare what happens with your prediction.

Explore: audit the app

Was your prediction right?

Try it yourselfYour edits are saved in this browser.

For each thing the app does, choose the principle it's about, and whether the app meets it or breaches it.

Use the board. This ticks when you get there.

ExplainPut a name to what you saw, and why it works.

Explain: five principles

The Australian Privacy Principles (in the Privacy Act 1988) say what organisations must do with personal information: anything that identifies a person.

Worked exampleBefore each step, say what you think comes next.

$\text{APP 3 Collection}$ Collect only what you need for your purpose.
$\text{APP 5 Notice}$ Tell people what you collect, why, and who to ask.
$\text{APP 6 Use and disclosure}$ Use and share it only for that purpose, unless they agree.
$\text{APP 11 Security}$ Protect it: hash passwords, encrypt data, limit who can see it.
$\text{APP 12 Access}$ Let people see what you hold about them (APP 13: and correct it).

Find the mistake

Sam reads the club's privacy policy. Click the line where it first goes wrong.

ElaborateUse the idea in a new situation.

Elaborate: fix the breaches

Try it yourselfYour edits are saved in this browser.

Audit the app again. For each breach, choose the change that would meet the principle.

Use the board. This ticks when you get there.

ElaborateUse the idea in a new situation.

Elaborate: the privacy notice

Try it yourselfYour edits are saved in this browser.

Need a hint?

Read each line as a member: does it tell you something real?

Another hint

Vague lines like 'some information' or 'our partners' tell a member nothing.

Write the club app's privacy notice: pick the version of each line that tells a member something real.

Use the board. This ticks when you get there.

EvaluateLook back at your first ideas and what changed.

Evaluate: look back

A school's homework app stores students' marks. A student asks to see what it holds about her. Which principle says the school must let her?APP 5 NoticeAPP 3 CollectionAPP 12 AccessAPP 11 Security

I can name five Australian Privacy Principles and use them to critique an app.

For teachers

Students match the club app's practices to five Australian Privacy Principles, judge each as meeting or breaching it, propose changes for the breaches, and write a privacy notice that meets APP 5 (AC9TDI10P14 nodes 1 and 2). A 5E mission lesson. About 50 minutes.

Open the teacher guide: answers, solutions, slides and a worksheet.

Students will be able to

I can say what five of the Australian Privacy Principles require.
I can judge whether an app meets or breaches a principle, with evidence.
I can propose a change that would meet it.

Before class

Try the board yourself. The club app is made up.

The one idea: the principles limit collection, use, sharing and storage, and give people access; a policy doesn't override them.

Accuracy notes: the APPs are in Schedule 1 of the Privacy Act 1988 (Cth). They bind agencies and organisations with turnover over $3 million, plus some smaller ones; a school club wouldn't usually be bound itself; independent schools usually are (government schools come under their state's privacy law), and the principles are the standard to design against. The lesson uses five: APP 3, 5, 6, 11 and 12 (13 is correction). Check the OAIC's summary at oaic.gov.au for the current wording before teaching, and check where the Children's Online Privacy Code is up to (the OAIC released an exposure draft in 2026).

Running the lesson

Engage: ask whether a policy can make anything allowed.
Explore: ask which practice was hardest to match to a principle.
Explain: model the five-step scaffold on the sports shop case.
Elaborate: ask why 'hide the field' still breaches APP 3.
Evaluate: discuss which principle protects the student in the homework app.

The hard part (on purpose)

Students argue from feelings (it's creepy) rather than the principle. Use the scaffold: which principle, what does it require, what does the app do, verdict, change.

When students get stuck

A student thinks the policy makes sharing allowed (Sam's mistake). Ask: Why did members give their emails? Fix: Use for another purpose needs agreement (APP 6).
A student mixes up APP 3 and APP 6. Ask: Is this about getting the data, or what's done with it after? Fix: Getting: collection (APP 3). After: use and disclosure (APP 6).

Stretch and support

Stretch: Critique an app you use (its privacy page and settings) against two principles, with evidence and a proposed change.

Support: A card with the five principles in one line each, and the scaffold.

Where it leads

Next: Security review, the challenge.

Sources

Australian Privacy Principles (OAIC)

What each step is for

Engage: is it allowed?: Committing to whether a policy allows anything tests the new move: the principles set limits that a policy can't remove.
Explore: audit the app: Students match practices to principles and judge them, meeting each principle through a concrete case.
Explain: five principles: The teacher models the critique scaffold on one practice: principle, what it requires, what the app does, verdict, change. Sam trusts the policy, the misconception planted after the method.
Elaborate: fix the breaches: One change: after the verdict, the change that would meet the principle, the last step of the critique scaffold.
Elaborate: the privacy notice: Producing a notice that meets APP 5 reverses the audit: from the principle to what a member reads.

Now you can

Say what five of the Australian Privacy Principles require.
Judge whether an app meets or breaches a principle, with evidence.
Propose a change that would meet it.

Next lesson8. Security reviewBefore the club app launches, review it like a security team: inspect its accounts, its data and its system, choose the fix that really closes each weakness, and collect a flag for each section you make safe. Everything from the course comes together: unique passphrases and MFA, collecting only what is needed, hashed passwords, a real privacy notice, HTTPS and updates.

Source: content/systems/cyber/privacy/lesson.md