#U3 #legal ## Legal Legislation & Frameworks Guide In VCE Software Development Unit 3 Outcome 2, students must document the **legal constraints** that impact the development and implementation of their proposed software solution as part of the **Software Requirements Specification (SRS)** (Criterion 3). This guide explores the three core pieces of legislation mandated by the **VCAA Study Design (from 2025)** and the **Software Tools and Functions** document, detailing how they apply to software development. --- ## 1. Copyright Act 1968 (Cwlth) ### Overview The *Copyright Act 1968* is a Commonwealth law protecting original expressions of ideas. It does not protect the idea itself, but rather the way it is written, drawn, or created. Once an original work is created in a tangible form (e.g., written code, saved file, drawn UI), copyright protection is **automatic** in Australia. ### Key Legal Concepts * **Intellectual Property (IP):** The intangible creation of the mind. In software, this includes the source code, custom algorithms, user interface layouts, graphical assets, database schemas, and documentation. * **Ownership:** Typically, the creator (developer) owns the copyright, unless it is created under an employment contract or a specific commissioning agreement. * **Licensing:** Software licenses define how third parties can use, modify, or distribute code. This includes Proprietary licenses and Open Source licenses (e.g., MIT, GNU General Public License (GPL), Apache). * **Fair Dealing:** Exceptions that allow limited use of copyrighted material without permission for specific purposes such as study, research, criticism, or review. ### Practical Software Development Application When writing an SRS, the student must document how they will comply with copyright: * **Third-Party Code/Libraries:** If utilising open-source libraries (e.g., Pygame, NumPy, React, or NuGet packages), the student must acknowledge the developer and comply with the package license. * **Asset Sourcing:** All icons, images, background graphics, fonts, and sound effects must be copyright-free (Creative Commons / Public Domain) or properly licensed. They must be cited in the bibliography. * **Plagiarism & Code Repositories:** Code written by other students or retrieved from forums (like Stack Overflow) must not be claimed as the student's own. * **Protecting Their Solution:** The student should document how they will protect their own intellectual property (e.g., declaring a license, obfuscating binary code, or implementing a clear copyright notice: `© 2026 [Student Name]. All Rights Reserved.`). --- ## 2. Privacy Act 1988 (Cwlth) ### Overview The *Privacy Act 1988* is a Commonwealth law regulating how organizations handle **personal information** (information or an opinion that can identify an individual, such as names, email addresses, phone numbers, and IP addresses). It governs Commonwealth government agencies and private sector organizations with an annual turnover of more than $3 million, as well as health service providers and credit reporting agencies. ### The Australian Privacy Principles (APPs) Under the Act, there are 13 APPs. The VCAA Study Design mandates that Software Development students address **APPs 1, 3, 6, 8, 9, and 11**: | APP | Principle | Software Development Application | | :--------- | :---------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **APP 1** | **Open and transparent management of personal information** | The software must make a clear Privacy Policy accessible to users (e.g., a "Privacy Policy" button on the login/signup screen) explaining what data is collected and how it is managed. | | **APP 3** | **Collection of solicited personal information** | The system must only collect personal information that is reasonably necessary for its core functions. For example, a simple calculator app should not request a user's location or phone number. | | **APP 6** | **Use or disclosure of personal information** | Personal data collected from users must only be used for the primary purpose for which it was gathered. For example, user registration emails cannot be disclosed to third-party marketing companies without explicit user consent. | | **APP 8** | **Cross-border disclosure of personal information** | If the software hosts its database on cloud servers located overseas (e.g., using default AWS, Azure, or Firebase servers in US regions), the developer must disclose this to users and ensure the overseas host complies with similar privacy protections. | | **APP 9** | **Adoption, use or disclosure of government-related identifiers** | The software cannot adopt a government-assigned identifier (such as a Tax File Number, Medicare Number, or Driver's License Number) as its own primary key or unique identifier for a user profile. A custom user ID or auto-incremented index must be used instead. | | **APP 11** | **Security of personal information** | The developer must protect the data from misuse, loss, unauthorized access, modification, or disclosure. This requires implementing specific security controls, and destroying or de-identifying data once it is no longer required. | ### Practical Security Controls (APP 11) for Student Solutions: * **Password Hashing:** Storing passwords using secure hashing algorithms (e.g., `bcrypt` or `SHA-256` with salt) rather than plain text. * **Encryption:** Encrypting data at rest (database encryption) and in transit (using HTTPS/SSL). * **Session Management:** Auto-logging out users after a period of inactivity. * **Access Control:** Implementing Role-Based Access Control (RBAC) to ensure only authorized roles (e.g., Admin vs. Standard User) can access sensitive tables. --- ## 3. Privacy and Data Protection Act 2014 (Vic) ### Overview This is a Victorian state law that applies to **Victorian public sector organisations** (such as state government departments, public schools, public hospitals, local councils, and contractors acting on their behalf). If a student's client is a public school or a local government body, this Act applies. ### The Information Privacy Principles (IPPs) The Act defines 10 IPPs. The VCAA Study Design mandates that Software Development students address **IPPs 1, 2, 4, 5, 7, 9, and 10**: | IPP | Principle | Software Development Application | | :--------- | :------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **IPP 1** | **Collection** | Before collecting data, the software must display a "Collection Notice" explaining who is collecting the data, why it is being collected, and how the user can access it. | | **IPP 2** | **Use and Disclosure** | Similar to APP 6, the system cannot disclose Victorian public sector user data to other entities unless it is for the primary purpose of collection, or required by law. | | **IPP 4** | **Data Security** | The public sector organization must protect data from misuse, loss, unauthorized access, modification, or disclosure. The developer must build security measures (e.g., input sanitization, database firewall) to ensure data integrity. | | **IPP 5** | **Openness** | The software system documentation must clearly describe how personal data is managed, stored, and deleted. | | **IPP 7** | **Unique Identifiers** | Victorian public sector identifiers (such as a student's VCAA Student Number or a teacher's employee number) cannot be assigned as the system's unique identifier unless it is necessary to carry out public sector functions. | | **IPP 9** | **Transborder Data Flows** | The software must not transfer personal data outside of Victoria unless the recipient is subject to a law or binding scheme that holds data to a similar standard of privacy protection. | | **IPP 10** | **Sensitive Information** | The system must not collect sensitive information (e.g., racial/ethnic origin, political opinions, religious beliefs, sexual preferences, criminal record) unless the user gives explicit consent, or collection is required by law. | --- ## 4. Legislation Quick-Reference & SAT relevant components Students can use this table to quickly map legal requirements to practical design and coding solutions in their project: | Legal Requirement | Core Act | Specific Principle | Examples of how it applies to the SAT | | :-------------------------------------- | :---------------------------------------------------------- | :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Protect Intellectual Property** | *Copyright Act 1968* | N/A | Add a clear license header file to the project repository; use MIT/GPL notices for libraries; cite sourced icons/fonts in the SRS bibliography. | | **De-identify Data / Limit Collection** | *Privacy Act 1988* | APP 3 | Design input forms to only request necessary fields. De-identify survey data in the database if individual identities are not needed. | | **Protect User Passwords** | *Privacy Act 1988* | APP 11 | Implement a hashing library (e.g., `hashlib` or `bcrypt` in Python) to hash and salt passwords before writing them to the database. | | **Secure Data Storage** | *Privacy and Data Protection Act 2014* | IPP 4 | Use SQL parameterized queries to prevent SQL Injection attacks. Implement input sanitization to filter out malicious scripts (preventing Cross-Site Scripting). | | **Secure Database Hosting** | *Privacy Act 1988* & *Privacy and Data Protection Act 2014* | APP 8 & IPP 9 | Configure the database host (e.g., Amazon RDS, Google Firebase) to store data in Australian data centers (e.g., AWS Region `ap-southeast-2` in Sydney) to comply with transborder restrictions. | | **Handling Sensitive Data** | *Privacy and Data Protection Act 2014* | IPP 10 | If collecting medical or demographic details, include a mandatory checkbox requesting explicit user consent before submitting the form. |