What is Privacy?
Privacy is the right to control your personal information - who can access it, how it's used, and when it's shared. In the digital world, privacy involves protecting data about individuals from unauthorized access or misuse.
Australian Privacy Principles (APPs)
The Privacy Act 1988 contains 13 Australian Privacy Principles that govern how organisations handle personal information.
| APP | Principle | What it means |
|---|---|---|
| 1 | Open and transparent management | Have a clear privacy policy |
| 2 | Anonymity and pseudonymity | Allow people to remain anonymous when possible |
| 3 | Collection of solicited information | Only collect information you actually need |
| 4 | Dealing with unsolicited information | Destroy information you didn't ask for (if appropriate) |
| 5 | Notification of collection | Tell people when you collect their data |
| 6 | Use or disclosure | Only use data for its intended purpose |
| 7 | Direct marketing | Get consent before marketing to individuals |
| 8 | Cross-border disclosure | Ensure overseas recipients protect data too |
| 9 | Adoption, use of government identifiers | Don't use government IDs as your own identifiers |
| 10 | Quality of personal information | Keep data accurate and up-to-date |
| 11 | Security of personal information | Protect data from misuse and unauthorised access |
| 12 | Access to personal information | Let individuals access their own data |
| 13 | Correction of personal information | Let individuals correct inaccurate data |
What is Security?
Security involves protecting digital systems and data from unauthorized access, damage, or theft. It encompasses both technical measures (like encryption) and human factors (like training users).
The CIA Triad
Security aims to protect three key properties:
Confidentiality
Only authorized people can access the data. Achieved through encryption, access controls, and authentication.
Integrity
Data remains accurate and unaltered. Achieved through checksums, version control, and audit trails.
Availability
Data is accessible when needed. Achieved through backups, redundancy, and disaster recovery plans.
Common Security Threats
Malware
Malicious software designed to harm or exploit systems:
- Virus - Attaches to files and spreads when files are shared
- Worm - Self-replicating, spreads across networks automatically
- Trojan - Disguised as legitimate software
- Ransomware - Encrypts files and demands payment
- Spyware - Secretly monitors user activity
Social Engineering
Manipulating people to gain access or information:
- Phishing - Fake emails or websites that trick users into revealing passwords
- Pretexting - Creating a fake scenario to extract information
- Baiting - Leaving infected USB drives for people to find
- Tailgating - Following someone into a secure area
Network Attacks
- Man-in-the-middle - Intercepting communication between two parties
- Denial of Service (DoS) - Overwhelming a system to make it unavailable
- SQL Injection - Inserting malicious code into database queries
Security Measures
Authentication Methods
Something you know
Passwords, PINs, security questions
Something you have
Phone, security key, ID card
Something you are
Fingerprint, face recognition, iris scan
Multi-factor authentication (MFA) combines two or more of these methods for stronger security.
Encryption
Encryption converts readable data (plaintext) into scrambled data (ciphertext) that can only be read with the correct key.
- HTTPS - Encrypts web traffic between browser and server
- End-to-end encryption - Only sender and receiver can read messages
- Full disk encryption - Protects all data on a device
Best Practices
- Use strong, unique passwords for each account
- Enable multi-factor authentication
- Keep software and systems updated
- Back up important data regularly
- Be cautious of suspicious emails and links
- Use secure Wi-Fi connections
- Lock devices when not in use
Ethics in Digital Systems
Ethical considerations help guide responsible behavior when dealing with data and technology.
Key Ethical Principles
- Informed consent - Users should understand and agree to data collection
- Data minimisation - Only collect what's necessary
- Transparency - Be open about how data is used
- Accountability - Take responsibility for data protection
- Fairness - Don't use data to discriminate
Ethical Dilemmas
Consider these scenarios:
- A company wants to use facial recognition to improve security. What privacy concerns arise?
- A health app collects location data "to improve services." Is this ethical?
- Should employers be allowed to monitor employee computer activity?
Data Breaches
A data breach occurs when personal information is accessed, disclosed, or lost without authorization.
Responding to a Data Breach
- Contain - Stop the breach from continuing
- Assess - Determine what data was affected
- Notify - Inform affected individuals and authorities
- Review - Identify how it happened and prevent future breaches
Notifiable Data Breaches: In Australia, organisations must notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if a data breach is likely to cause serious harm.
Key Terminology
- Privacy - Right to control personal information
- APPs - Australian Privacy Principles (13 principles)
- CIA Triad - Confidentiality, Integrity, Availability
- Malware - Malicious software (viruses, worms, trojans)
- Phishing - Fake communications to steal information
- Encryption - Scrambling data so only authorized users can read it
- MFA - Multi-factor authentication using 2+ verification methods
- Data breach - Unauthorized access to personal information