Legal, Ethical, Security and Privacy Issues
Legal obligations
In Australia, the Privacy Act 1988 and the Australian Privacy Principles govern how organisations collect, use, store, disclose and destroy personal information. Key principles include collecting only what is necessary, informing people why data is collected, using it only for the stated purpose, keeping it secure, and allowing access and correction. Other relevant law includes copyright (datasets and images may not be freely reused) and sector-specific rules such as health records legislation. Candidates should know the difference between personal information (identifies a person) and sensitive information (health, biometric, ethnic origin, criminal record), which attracts stricter handling.
Ethical considerations
Ethics goes beyond legality. Informed consent, transparency about data use, fairness in analysis, avoiding algorithmic bias, and honest reporting of limitations are ethical concerns. Even where collection is legal, using data to manipulate or unfairly target people raises ethical problems. De-identification reduces risk but is not foolproof - combining datasets can re-identify individuals.
Security and privacy
Security controls include encryption (at rest and in transit), access controls and least-privilege permissions, authentication such as multi-factor login, regular backups, audit logs, and secure destruction when data is no longer needed. Privacy is about appropriate use; security is about protection from unauthorised access. A data breach may be both a security failure and a privacy harm.
Traps
Questions often ask whether an action is legal, ethical, or both. An action can be legal but unethical, or well-intentioned but unlawful. Another trap is assuming de-identified data is always safe to publish.