Students match the club app's practices to five Australian Privacy Principles, judge each as meeting or breaching it, propose changes for the breaches, and write a privacy notice that meets APP 5 (AC9TDI10P14 nodes 1 and 2). A 5E mission lesson.
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can say what five of the Australian Privacy Principles require.
I can judge whether an app meets or breaches a principle, with evidence.
I can propose a change that would meet it.
Timing
Engage and Explore 14 min · Explain 10 min · Elaborate 18 min · Evaluate 8 min
Before class
Try the board yourself. The club app is made up.
The one idea: the principles limit collection, use, sharing and storage, and give people access; a policy doesn't override them.
Accuracy notes: the APPs are in Schedule 1 of the Privacy Act 1988 (Cth). They bind agencies and organisations with turnover over $3 million, plus some smaller ones; a school club wouldn't usually be bound itself; independent schools usually are (government schools come under their state's privacy law), and the principles are the standard to design against. The lesson uses five: APP 3, 5, 6, 11 and 12 (13 is correction). Check the OAIC's summary at oaic.gov.au for the current wording before teaching, and check where the Children's Online Privacy Code is up to (the OAIC released an exposure draft in 2026).
Running the lesson
Engage: ask whether a policy can make anything allowed.
Explore: ask which practice was hardest to match to a principle.
Explain: model the five-step scaffold on the sports shop case.
Elaborate: ask why 'hide the field' still breaches APP 3.
Evaluate: discuss which principle protects the student in the homework app.
The hard part (on purpose)
Students argue from feelings (it's creepy) rather than the principle. Use the scaffold: which principle, what does it require, what does the app do, verdict, change.
When students get stuck
What you will see
A question to ask
The fix
A student thinks the policy makes sharing allowed (Sam's mistake).
Why did members give their emails?
Use for another purpose needs agreement (APP 6).
A student mixes up APP 3 and APP 6.
Is this about getting the data, or what's done with it after?
Getting: collection (APP 3). After: use and disclosure (APP 6).
Answers to the checks
Engage: is it allowed?: The club's privacy policy says it may share members' details with partners. Can it give their emails to a sports shop for advertising? Not without asking. APP 6: personal information is used and shared for the purpose it was collected for, unless people agree to more.
Explore: audit the app: For each thing the app does, choose the principle it's about, and whether the app meets it or breaches it.
Collecting unused addresses breaches APP 3; the notice meets APP 5; sharing with the shop breaches APP 6; hashing and encryption meet APP 11; no way to see or correct details breaches APP 12.
Explain: five principles: Sam reads the club's privacy policy. Click the line where it first goes wrong. line 3 Line 3: advertising isn't why members gave their emails. APP 6 needs their agreement first, whatever the policy says.
Elaborate: fix the breaches: Audit the app again. For each breach, choose the change that would meet the principle.
Stop collecting addresses (APP 3), ask before sharing (APP 6), add a My details page (APP 12). The other options still breach.
Elaborate: the privacy notice: Write the club app's privacy notice: pick the version of each line that tells a member something real.
What exactly, why exactly, who exactly, how it's protected, and where to go: a notice a member can act on.
The homework app: A school's homework app stores students' marks. A student asks to see what it holds about her. Which principle says the school must let her? APP 12 Access People can ask to see the personal information held about them.
Solutions
One possible solution for each task. Other correct programs are fine.
Elaborate: fix the breaches
Open task: any program that does what the step asks.
Elaborate: the privacy notice
Open task: any program that does what the step asks.
Stretch and support
Stretch: Critique an app you use (its privacy page and settings) against two principles, with evidence and a proposed change.
Support: A card with the five principles in one line each, and the scaffold.
Exit ticket
Name two Australian Privacy Principles and what each requires.
Any two: APP 3 collect only what is needed; APP 5 tell people what and why; APP 6 use and share only for that purpose unless they agree; APP 11 keep it secure; APP 12 let people see it.
What each step is for
Engage: is it allowed?: Committing to whether a policy allows anything tests the new move: the principles set limits that a policy can't remove.
Explore: audit the app: Students match practices to principles and judge them, meeting each principle through a concrete case.
Explain: five principles: The teacher models the critique scaffold on one practice: principle, what it requires, what the app does, verdict, change. Sam trusts the policy, the misconception planted after the method.
Elaborate: fix the breaches: One change: after the verdict, the change that would meet the principle, the last step of the critique scaffold.
Elaborate: the privacy notice: Producing a notice that meets APP 5 reverses the audit: from the principle to what a member reads.