---
marp: true
theme: default
html: true
---

# The Australian Privacy Principles

Cyber safety and privacy · Secure the system

<!-- Speaker note: Students match the club app's practices to five Australian Privacy Principles, judge each as meeting or breaching it, propose changes for the breaches, and write a privacy notice that meets APP 5 (AC9TDI10P14 nodes 1 and 2). A 5E mission lesson. About 50 minutes (Engage and Explore 14 min · Explain 10 min · Elaborate 18 min · Evaluate 8 min). Sources: Australian Privacy Principles (OAIC), https://www.oaic.gov.au/privacy/australian-privacy-principles. -->

---

## Today

**We are learning to** the Australian Privacy Principles (APPs) say what organisations must do with personal information: collect only what they need (APP 3), tell people what and why (APP 5), use and share it only for that purpose unless people agree (APP 6), keep it secure (APP 11), and let people see and correct it (APP 12). A privacy policy doesn't override them.

- I can say what five of the Australian Privacy Principles require.
- I can judge whether an app meets or breaches a principle, with evidence.
- I can propose a change that would meet it.

<!-- Speaker note: Before class: Try the board yourself. The club app is made up. The one idea: the principles limit collection, use, sharing and storage, and give people access; a policy doesn't override them. Accuracy notes: the APPs are in Schedule 1 of the Privacy Act 1988 (Cth). They bind agencies and organisations with turnover over $3 million, plus some smaller ones; a school club wouldn't usually be bound itself; independent schools usually are (government schools come under their state's privacy law), and the principles are the standard to design against. The lesson uses five: APP 3, 5, 6, 11 and 12 (13 is correction). Check the OAIC's summary at oaic.gov.au for the current wording before teaching, and check where the Children's Online Privacy Code is up to (the OAIC released an exposure draft in 2026). Teacher: Evaluate: discuss which principle protects the student in the homework app. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 25px; }</style>

---

## Why it matters

> The club gave members' emails to a sports shop. It's in the privacy policy, page 40. Is that allowed?

<!-- Speaker note: **Your mission:** the club app holds members' personal information, so the Australian Privacy Principles apply. Audit what it does, fix what breaches them, and write its privacy notice. -->

---

<span style="background:#dbeafe; color:#1a1a1a; border:1.5px solid #3b82f6; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">💬 Discussion</span>

## Engage: predict

**The club's privacy policy says it may share members' details with partners. Can it give their emails to a sports shop for advertising?**

- Yes, as long as the shop is local
- Not without asking: sharing for a different purpose needs people's agreement
- Only on weekends
- Yes: the policy says so

<!-- Speaker note: What happens: Not without asking. APP 6: personal information is used and shared for the purpose it was collected for, unless people agree to more. Take two or three predictions before anyone runs it. -->

<!-- Speaker note: Teacher: ask whether a policy can make anything allowed. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 28px; }</style>

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Try it

{{embed: https://studio.learningwaypoints.com/tutorials/_playground-board/index.html?id=deck%2Fsystems%2Fcyber%2Fprivacy%2Fstep-2&code=widget%3A+cyber%0Amode%3A+privacy%0A&fresh=1}}

[Open this step in the tutorial](https://studio.learningwaypoints.com/tutorials/systems/cyber/privacy/?full=step-2#step-2)

<!-- Speaker note: Was your prediction right? -->

<!-- Speaker note: Teacher: ask which practice was hardest to match to a principle. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 25px; }</style>

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## What happened?

* Not without asking. APP 6: personal information is used and shared for the purpose it was collected for, unless people agree to more.

<!-- Speaker note: Reveal after running. Ask who predicted it, and what made them think so. -->

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## Explain: five principles

**Sam reads the club's privacy policy. Click the line where it first goes wrong.**

```
 1  The club app has a privacy policy.
 2  The policy says the club may share members' details with partners.
 3  So the club can give members' emails to a sports shop for advertising.
 4  So it doesn't need to ask members first.
```

* Answer: line 3

<!-- Speaker note: Line 3: advertising isn't why members gave their emails. APP 6 needs their agreement first, whatever the policy says. What this step is for: The teacher models the critique scaffold on one practice: principle, what it requires, what the app does, verdict, change. Sam trusts the policy, the misconception planted after the method. -->

<!-- Speaker note: Teacher: model the five-step scaffold on the sports shop case. -->

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Elaborate: fix the breaches

{{embed: https://studio.learningwaypoints.com/tutorials/_playground-board/index.html?id=deck%2Fsystems%2Fcyber%2Fprivacy%2Fstep-4&code=widget%3A+cyber%0Amode%3A+privacy%0Afix%3A+on%0A&fresh=1}}

[Open this step in the tutorial](https://studio.learningwaypoints.com/tutorials/systems/cyber/privacy/?full=step-4#step-4)

<!-- Speaker note: What this step is for: One change: after the verdict, the change that would meet the principle, the last step of the critique scaffold. -->

<!-- Speaker note: Teacher: ask why 'hide the field' still breaches APP 3. -->

<style scoped>pre, marp-pre { font-size: 0.5em; line-height: 1.25; } section { font-size: 25px; }</style>

---

<span style="background:#fef3c7; color:#1a1a1a; border:1.5px solid #f59e0b; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✍️ Activity</span>

## Make: Elaborate: the privacy notice



[Open this step](https://studio.learningwaypoints.com/tutorials/systems/cyber/privacy/?full=step-5#step-5)

<!-- Speaker note: What this step is for: Producing a notice that meets APP 5 reverses the audit: from the principle to what a member reads. Hints, in order: Read each line as a member: does it tell you something real? / Vague lines like 'some information' or 'our partners' tell a member nothing. For students who need more support: A card with the five principles in one line each, and the scaffold. For early finishers: Critique an app you use (its privacy page and settings) against two principles, with evidence and a proposed change. The hard part, on purpose: Students argue from feelings (it's creepy) rather than the principle. Use the scaffold: which principle, what does it require, what does the app do, verdict, change. When students get stuck: A student thinks the policy makes sharing allowed (Sam's mistake). Ask: Why did members give their emails? Fix: Use for another purpose needs agreement (APP 6). / A student mixes up APP 3 and APP 6. Ask: Is this about getting the data, or what's done with it after? Fix: Getting: collection (APP 3). After: use and disclosure (APP 6). -->

---

<span style="background:#dcfce7; color:#1a1a1a; border:1.5px solid #22c55e; padding:6px 18px; border-radius:8px; font-size:1em; font-weight:500;">✅ Check</span>

## Exit ticket

**Name two Australian Privacy Principles and what each requires.**

* Any two: APP 3 collect only what is needed; APP 5 tell people what and why; APP 6 use and share only for that purpose unless they agree; APP 11 keep it secure; APP 12 let people see it.

<!-- Speaker note: Students answer on paper or a mini whiteboard before the reveal. Anyone who cannot answer needs the main idea again next lesson. Where this leads: Next: Security review, the challenge. -->