DGB 4: Handling User Data

← Digital Literacy – Year 4

Apps, websites and connected devices can collect far more than a name or e-mail address. Clicks, search activity, location, contacts, device identifiers and inferred interests can be combined into profiles. Students examine how this happens, which legitimate purposes exist and where negligence, misuse or surveillance create risks.

Curriculum reference

Area	Classification
Competence area	Information
Perspectives	G, I
Focus	Collection, analysis and linking of user data
Competence	Understand how user data is collected and combined, recognise risks of negligence, misuse and surveillance, and make data-conscious decisions.

Learning objectives

Students can:

identify different types of user data;
explain common ways in which websites, apps and devices collect data;
describe how separate data sets can be linked into profiles;
distinguish necessary processing from optional tracking in simple cases;
recognise risks caused by negligent handling of data;
recognise risks of misuse, identity theft and unauthorised disclosure;
explain how surveillance can influence behaviour;
check app permissions and privacy settings;
apply data minimisation and careful sharing in everyday situations;
respect the data and privacy of other people.

Learning content

Collecting user data

Data may be entered deliberately, generated by actions or observed automatically. Examples include account details, clicks, search queries, location, device information, interaction times and purchase history.

Analysing user data

Providers can use data to improve services, detect fraud, personalise content or sell advertising. Analysis can also infer interests or characteristics that users never stated directly.

Linking data

The combination of several harmless-looking data points can reveal much more than each item alone. Linking account data, location and behavioural patterns may create a detailed profile.

Risks through negligence

Public sharing, weak passwords, excessive permissions, careless forwarding or unprotected devices can expose personal or third-party data even without malicious intent.

Misuse and identity theft

Stolen or improperly used data can enable impersonation, fraud, harassment or targeted manipulation. The consequences depend on the sensitivity and context of the data.

Surveillance and behavioural effects

When people believe they are being monitored, they may change behaviour or avoid legitimate activities. This is sometimes called a chilling effect and shows that privacy affects freedom as well as secrecy.

Responsible handling

Use data minimisation, review permissions, use strong unique passwords and multi-factor authentication where possible, choose appropriate audiences and avoid collecting or forwarding data that is not needed.

Classroom activities

Everyday data hunt

Identify what types of data a fictional app could collect during normal use.

Expected outcome: A data inventory.

From click to profile

Connect individual actions to possible inferences and advertising categories.

Expected outcome: A profile-building diagram.

Negligent or responsible

Classify everyday data-handling scenarios and improve the risky ones.

Expected outcome: A corrected scenario set.

Recognise misuse

Analyse fictional incidents involving leaked data, impersonation or unauthorised sharing.

Expected outcome: An incident analysis.

Surveillance and behaviour

Discuss how visible monitoring could change behaviour in school or public spaces.

Expected outcome: A reasoned discussion.

Check privacy settings

Review permissions in a safe test environment and remove unnecessary access.

Expected outcome: A settings record.

Role-play a data conflict

Debate a case from user, provider, friend and data-protection perspectives.

Expected outcome: A stakeholder map.

Create a personal protection concept

Develop practical rules for accounts, permissions, sharing and backups.

Expected outcome: A protection guide.

Self-check

I can identify different categories of user data.
I understand that combining data can reveal additional information.
I can recognise negligence, misuse and surveillance risks.
I check permissions and privacy settings deliberately.
I protect other people's data as well as my own.
I can explain why data minimisation matters.