QCAA Digital Solutions Complex digital data exchange problems and solution requirements

Constraint 1: The coding club has less than four weeks to develop the app; this is a time constraint that may affect the club’s ability to thoroughly test the system before rolling it out for use.

Constraint 2: Using an existing school server for data storage. This may result in limited storage space, and developers will need to consider data compression, particularly for storing images of items.

Constraint 3: Developing a mobile app may present some technical constraints in terms of compatibility across different platforms, e.g. iOS or Android.

Risk to data confidentiality: There is no user authentication process implemented; therefore, updating account balances and accessing user details risks the confidentiality of private information of all users, staff and students, including financial information.

Risk to data integrity: Updating inventory manually during a fundraising event would be a time-consuming process. There is a real risk to data integrity that could lead to overselling if the inventory data is not accurate at the point of sale.

Risk to data availability: Manually updating account balances risks the availability of user account information due to the delay caused by manually processing calculations while managing other distractions during a fundraising event.

BEGIN
    IF checkLogin(studentID, hashPassword(password)) THEN
        Results = getResults(studentID)
        FOR i = 0 to (size of Results)-1
            Display decryptData(key, results[i])
        ENDFOR
    ELSE
        Display “Access denied”
    ENDIF
END

A data confidentiality risk is the possibility that an unauthorised person could observe the user data in transit. For example, the app requires a password for the user to log in and the data would need to be encrypted so that it cannot be stolen.

A data integrity risk is the possibility that the data could become corrupted, lost or be maliciously manipulated. For example, the wrong car might be unlocked or a hacker might use the data to cause distress.

A data availability risk is the possibility that someone may interfere with transmission to prevent data packets from reaching the intended destination, allowing them to access the person's car so that they can steal it.

Australian Privacy Principle: Security of personal information. Allow an administrator to de-identify or destroy personal information once it is no longer in use.

Ethical consideration: Security of personal information is important if the user sells their car, or if the car is no longer in use. The user should not be getting unnecessary calls or marketing materials for a service they no longer use or for a car they no longer own, and it would be unsafe for the original owner to still have access to the vehicle once it has been sold.

ABC DE FG H I J K L M N O P Q R S T U V W X Y Z

BEGIN
INPUT string plainText
INPUT int keyShift
SET string alphabet =ABCDEFGHIJKLMNOPQRSTUVWXYZ
SET encryptedText = ""
    FOR each character in plainText
        SHIFT character by keyShift
        APPEND letter to encryptedText
    END FOR
    RETURN encryptedText
END

Australian Privacy Principle: 1
Implementation: The hospital must be open and transparent about why it is collecting the data, how the data will be used and disclosed, and who will have access to the data. The hospital must also provide clear guidelines to staff about the collection and use of this information.

Australian Privacy Principle: 2
Implementation: The hospital must consider whether it is possible for staff to use a pseudonym instead of their real names when accessing the car park. If this is not practical, the hospital must ensure that it handles the personal information it collects in a secure and confidential manner, and only uses it for the purposes for which it was collected.

Australian Privacy Principle: 3
Implementation: The hospital must have a lawful reason for collecting staff driver information and inform staff of the purpose and use of the data collected.

Confidentiality: The digital solution for capturing numberplate information and staff names poses risks for privacy, as personal data from various sources may be linked in unexpected ways. Only one trusted employee, like an IT manager, should have access to the database, and only after going through a review process approved by the hospital's recruitment and management staff. Information should only be shared between the IT manager and staff member in question, with no other parties privy to conversations or actions taken.

Integrity: The data in the database must be error-free, but staff may attempt to abuse the system by providing access to family or friends by lending them their staff ID and obscuring their number plates to gain entry. To prevent staff from logging different numberplates, the system should crosscheck a list of permitted numberplates against IDs before granting access.

Availability: The data may be vulnerable to hacking if allowed online, so a MicroSD card should be used for offline access by a trusted staff member. Physical security of the system and SD card should be maintained to prevent staff from damaging or destroying the digital solution. Data should be purged regularly, and the database should be detached and not accessible online. Numberplate data captured by the system should be encrypted and only accessible in extreme cases.

The current system poses a significant risk to patient privacy and data security due to the lack of a secure log-in system. All staff, including those who may be parents of students at the school, are able to access the email account containing patient data, and this could lead to a confidentiality breach. Two personal data security needs are a secure log-in system to restrict access to the computer in the van and a system for encrypting patient data when transferring to the central server in the practice.

A VPN could improve this situation by establishing a private connection between the van and the dental practice. This prevents unauthorised hackers from intercepting communications between the two networks. A VPN is also encrypted, so the data is protected even if it is intercepted.