AIT Privacy and Ethics in IT

What is privacy?

Handling personal information appropriately: how it is collected, used and shared.

What is security?

Protecting data and systems from unauthorised access, damage, loss or changes.

What is ethics?

Moral principles that help us decide what is right, fair and responsible.

Can a secure system have privacy problems?

Yes. It can protect information but collect more than it needs.

Does legal always mean ethical?

No. Something can be legal but still unfair or harmful.

What is personal information?

Information that identifies someone or could identify them, such as a name or photo.

What is sensitive information?

Personal information needing extra protection, such as health, religion or ethnic origin.

Is a password legally classified as sensitive information?

Not automatically, but it still needs strong protection.

How can separate details identify someone?

Combining details, such as school, birthday and suburb, can reveal their identity.

What is de-identification?

Removing or changing details to make a person harder to identify.

Is removing names enough to de-identify data?

No. Other details may still identify someone.

How is data collected?

People provide it through forms and uploads, or systems record it automatically.

What are cookies?

Small pieces of data stored in your browser to remember information or track activity.

What is metadata?

Data about other data, such as the date a photo was taken.

What is profiling?

Using data to predict someone's interests, habits or behaviour.

What is a benefit and risk of location access?

It helps navigation but can reveal your movements.

What is a benefit and risk of learning analytics?

It identifies students needing help but may label them incorrectly.

What is a benefit and risk of personalised recommendations?

They suggest relevant content but may limit what you see. (personalised recommendations)

What is a benefit and risk of targeted advertising?

It shows relevant ads but can involve intrusive profiling.

What should you check about data collection?

Is the information needed for the service?

What is consent?

Agreeing to a particular collection, use or sharing of information.

What makes consent valid?

It is informed, voluntary, current and specific, and the person can understand the decision.

What does informed consent mean?

You understand what you are agreeing to.

What does voluntary consent mean?

You have a real choice about agreeing.

What does current and specific consent mean?

Your agreement is up to date and for a clear purpose.

What is capacity to consent?

Being able to understand and communicate your decision.

Does clicking “I agree” always mean valid consent?

No. You must understand and have a real choice.

When is consent generally needed to collect sensitive information?

Usually before collection, unless a legal exception applies.

What is transparency?

Clearly explaining how a system works and handles information.

What should a privacy notice explain?

What is collected, why, how it is used and shared, and how to access, correct or complain about it.

Should advertising consent be bundled with service consent?

No. Give separate choices so people can refuse advertising.

What are the APPs?

The 13 Australian Privacy Principles in the Privacy Act 1988.

Who must follow the APPs?

Organisations and agencies covered by the Privacy Act.

What is APP 1 about?

Being open about how personal information is managed.

What is APP 2 about?

Allowing anonymity or a different name where practicable.

What is APP 3 about?

Collecting requested personal information appropriately and only as needed.

What is APP 4 about?

Handling personal information received without requesting it.

What is APP 5 about?

Telling people about the collection of their information.

What is APP 6 about?

Using and sharing personal information appropriately.

What is APP 7 about?

Following rules for direct marketing.

What is APP 8 about?

Meeting responsibilities when sharing information overseas.

What is APP 9 about?

Restrictions on using and sharing government-related identifiers.

What is APP 10 about?

Keeping personal information accurate, up to date and complete.

What is APP 11 about?

Protecting information and safely destroying or de-identifying it when appropriate.

What is APP 12 about?

Allowing people to access their personal information.

What is APP 13 about?

Correcting inaccurate personal information.

How do you answer an APP scenario?

Identify the issue, name the APP, explain the harm and suggest a fix.

What is a digital footprint?

The trail of information created by digital activity.

What is an active digital footprint?

Information you deliberately provide, such as posts and comments.

What is a passive digital footprint?

Information recorded automatically, such as browsing logs.

Can others add to your digital footprint?

Yes, by posting about you or tagging you.

Why does your digital footprint matter?

It can affect your privacy, safety, reputation and future opportunities.

Does deleting a post remove every trace?

No. Copies and screenshots may remain.

How can you manage your digital footprint?

Check privacy settings, limit permissions and think before posting.

What is a vulnerability?

A weakness that could be exploited or cause harm.

What is a threat?

Something that could cause harm.

What is risk?

How likely harm is and how serious it could be.

Give a vulnerability, threat and risk example.

Weakness: reused password. Threat: stolen-login attack. Risk: someone accessing your account.

How can you protect your accounts?

Use unique passwords, a password manager and MFA; never share logins.

How should you respond to possible phishing?

Check the request through a trusted contact method.

What is MFA?

Using two or more different types of evidence to prove your identity.

Do two passwords count as MFA?

No. Both are something you know.

What should you do with an unexpected MFA prompt?

Reject it and report it.

How can you prevent accidental access to data?

Restrict file-sharing permissions and lock unattended devices.

What is a software supply chain?

External software, plugins and services used to build or run a system.

Why can an outdated plugin be dangerous?

Attackers may exploit its weaknesses to access the system or data.

How can software supply chain risks be reduced?

Use reputable sources, update software, remove unused plugins and limit permissions.

Can trusted software have vulnerabilities?

Yes. Trusted software can still contain weaknesses.

What is least privilege?

Giving someone only the access needed for their role.

What are the stages of the data lifecycle?

Collection, storage, use, sharing, retention and disposal.

How do you protect data throughout its lifecycle?

Collect only what is needed, secure it, limit access and dispose of it safely.

What is a data breach?

Personal information accessed or shared without permission, or lost where it could be exposed.

Must a data breach involve hacking?

No. Sending information to the wrong person can also cause a breach.

What harm can a data breach cause?

Fraud, identity misuse, distress, financial loss and lost trust.

How should an organisation respond to a breach?

Contain it, assess harm, protect people, report as required and prevent repeats.

What should you do if student information is publicly accessible?

Stop viewing it and report it to a teacher. Do not copy or share it.

What are stakeholders?

People or groups affected by a decision.

What ethical principles matter in IT?

Privacy, fairness, transparency, accountability, honesty, accessibility and avoiding harm.

What is fairness?

Treating people justly and avoiding unfair disadvantage.

What is accountability?

Being responsible for actions and their consequences.

What is accessibility?

Making systems usable by people with different needs.

How do you evaluate an ethical issue?

Identify the issue, affected people, benefits and risks; recommend and justify a solution.

What is a benefit and risk of school monitoring?

It can identify safety concerns but may invade students' private lives.

How can school monitoring be more ethical?

Limit its purpose, explain it clearly, restrict access and set deletion times.

What is intellectual property (IP)?

Rights connected to creations such as writing, photos, software and designs.

What does copyright protect?

Original expression, such as written work, photos and software code.

What is attribution?

Giving credit to the creator or source.

What is plagiarism?

Presenting someone else's work or ideas as your own.

Does giving credit automatically give permission to use content?

No. Check the licence, permission or a copyright exception.

How do you use online content responsibly?

Check permission, follow licence conditions, credit sources and mark direct quotes.

What should a Creative Commons image attribution include?

Title if provided, creator, source, licence and any changes.

Why is “Source: Google” inadequate?

Google is a search tool; it does not identify the creator or permission.

How can you protect privacy when using AI?

Use approved tools and avoid uploading unnecessary personal information.

What is AI bias?

A systematic tendency in AI that can produce unfair or unbalanced results.

What causes AI bias?

Training data, design choices or how AI is used.

How can AI bias be reduced?

Check its data and results, and use human review.

Why should you check AI-generated claims?

AI can give incorrect information and invent sources.

How can students use AI honestly?

Follow assessment rules and acknowledge permitted AI help.

What is AI transparency?

Explaining when and how AI is used.

What is AI accountability?

Making clear who is responsible and how decisions can be reviewed.