Data, Privacy and You

As you saw in Grade 7, any data that can be linked to one particular person is personal data. Your name and phone number are personal data. So is a photo of your face, your marks in an exam, your voice in a message, and the list of places your phone has been.

In Grade 7 you met two parts of your digital footprint: what you post yourself (active) and what is recorded about you as you use an app (passive) Grade 7: Your digital footprint. Looked at from the app’s side, its data about you comes in three kinds:

• Given: what you typed or posted yourself. Your date of birth when you signed up, a photo, a comment.
• Recorded: what the app noted as you used it. The time you opened it, how long you watched each video, where the phone was.
• Guessed: what a computer worked out from the other two, without asking you. “Likes cricket”, “probably a student”, “may be about to buy a phone”. Data worked out like this is called inferred data.

The guessed kind is the one people know least about. You never see it, so you can’t correct it when it is wrong, and it can be about very private things: your health, your mood, your religion, how much money your family has.

Some personal data can do more harm than the rest if it leaks or is misused: your health, your caste or ethnicity, your religion, your political views, your fingerprints and face, your family’s money. This is called sensitive personal data. It deserves the most care, from you and from anyone who holds it.

Every message you send has two parts. One is the content: the words, the photo, the voice. The other is metadata: data about the message, such as who sent it, to whom, when, from which phone, and through which phone tower. In Grade 7 you met the metadata a camera saves with a photo Grade 7: Photos carry hidden data. Almost everything digital has metadata:

Thing	Its content	Its metadata
a photo	the picture	when and where it was taken, the phone’s model, the camera’s settings
a phone call	what was said	who called whom, when, how long, through which tower
a message	the words	sender, receiver, time, whether it was read
a document	the text	its size, when it was made and changed, often the author’s name
a web page you visit	what the page says	the address, the time, your phone’s type, the network you came from

Metadata is not a trick or a secret. Computers need it to do their job: a phone company can’t connect a call without knowing which tower your phone is near, and your gallery can’t sort photos by date without the date. But it is easy to forget it is there, because you never see it.

Reading a photo’s metadata

A phone saves a photo’s metadata in a standard form called EXIF, inside the photo’s file. A gallery app shows some of it (the date, the place on a map), usually under ⓘ or Details. A computer’s file manager shows more, in the photo’s properties (the box below).

Where a photo was taken is saved as two numbers, its coordinates: how far north of the equator (the latitude) and how far east around the Earth (the longitude). 27.672° N, 85.428° E is Bhaktapur’s Durbar Square. Type the two numbers into any map app and it shows the spot, to within a few meters.

Metadata answers questions

Put the metadata of many photos, calls or messages together, and you can answer questions nobody wrote down the answers to: where someone lives, when they sleep, who their best friend is. This is how metadata is used to answer questions: you choose a question, then look for the fields and the pattern that answer it.

What did you need to answer them? Never the content: only who, when, how long and where, many times over. Metadata is short and neat, so a computer can search millions of records in a moment. That makes it so useful, and so revealing.

The same power can do great good. After the earthquake of 25 April 2015, nobody knew where the people of Kathmandu Valley had gone. Many had left for their home villages, and aid had to follow them.

Almost everyone you deal with keeps some data about you:

• The apps you use, and the companies that make them: what you post, search, watch and buy, and their metadata.
• Advertisers and data brokers: companies that collect data about people from many apps and websites, put it together into a profile of each person, and sell it or use it to pick ads.
• Your phone company: your SIM card’s owner, your calls and messages’ metadata, the towers your phone uses, your data use.
• Banks and wallet companies: who you are, your money, everyone you pay.
• The government: your birth registration, citizenship, national ID card, the census, land and tax records.
• Your school, hospital and the shops you buy from: marks, health records, the phone number you gave for a delivery.

They collect it for different reasons. Some data is needed for the job: a delivery needs your address. Some is asked for by law: a bank must check who its customers are. And some is extra: collected because it can earn money, mostly from advertising.

How your data pays for free apps

In Grade 7 you saw that most free apps earn their money from ads Grade 7: Built to hold your attention. An ad that matches what you want is worth far more to an advertiser than a random one, so the more an app knows about you, the more each ad it shows you is worth. That is why “extra” data is collected.

Many ads are chosen by an automatic auction, held in the moment a page or app opens:

Notice step 2. The message about you goes to many companies, and they all receive it, even the ones that lose. Each can add it to what it already knows about you. This is one way data brokers build their profiles.

Your phone helps them recognize you. Each phone has an advertising ID: a long code that apps can read, so that the ad companies know the person who watched a video in one app is the same person reading news in another. You can delete it, or ask apps not to track you (the box below).

Collecting data isn’t good or bad by itself. In Grade 7 you listed some benefits and risks Grade 7: What the app knows about you. Here is the fuller picture, for you and for everyone.

Benefits	Risks
Apps and services that fit you: a map that knows the traffic, a search that finds what you meant	It can be used against you: ads at the moment you are weakest, prices that change with what the app thinks you will pay
Safety: a bank spots a login from a strange place and blocks it	It can leak: a company is broken into and its customers’ data is stolen (a data breach, Grade 7)
Free apps, paid for by ads	Scammers use leaked data to sound real: “Hello Bimala, about your order from last week…”
For everyone: disease outbreaks found early, aid sent where people are, roads and buses planned where people travel	Guesses can be wrong, and decide things: a loan refused, a job never offered, and you never know why
Research that needs many people’s data, with names removed	It lasts for years, and may be used for things nobody has thought of yet

The benefits often go to everyone at once, while each risk falls on one person at a time. So the question is never just “is data collection good?”, but for this data, this use, and these people: do the benefits outweigh the risks, and did the people agree?

Names out is not enough

“We removed the names, so the data is anonymous”: you will hear this often. Anonymous means no one in the data can be identified. But taking out the names often isn’t enough, because a few ordinary facts together can fit only one person.

Finding out who is in “anonymous” data by combining it with what else you know is called re-identification. The defense is to share less detail: leave out the columns that single people out (a birth date, a ward), or group them (an age range, a district), until every combination fits many people. Even then, check: if everyone who fits gave the same answer, the answer is out anyway.

When you own a bicycle, you decide who rides it, and if someone takes it, you no longer have it. Data isn’t like that. A copy of your phone number can sit in a thousand places at once, and you still have it too. So with data, the real question is not who owns it, but who decides what happens to it: who may collect it, what they may use it for, who they may give it to, and how long they may keep it.

The idea that should decide it is consent: you agree to what happens to your data. For consent to be real, it must be:

• informed: you were told clearly what will be collected, for what, and who will get it;
• free: you could say no without being punished or tricked (“accept or you can’t use your own phone” is not much of a choice);
• specific: you agreed to this use, not to “anything we like, now and in future”;
• able to be taken back: you can change your mind later.

When you join an app, you agree to its terms of service (Grade 7) and its privacy policy: the long pages that say what it collects and what it does with it. Almost nobody reads them, and they are written so that few could.

What Nepal’s law says

Nepal’s Constitution of 2015, in Article 28, makes privacy a fundamental right: a person’s home, property, documents, data, letters and character may not be intruded on, except as the law allows. The Privacy Act, 2075 (2018), which came into force on 18 September 2018, sets out what that means. As of 2026, among other things, it says:

• every person has the right to keep their personal data confidential, and their consent must be obtained before their personal or family data is collected (Section 12);
• data that an office or a company collected with consent may be used only for the purpose it was collected for (Section 12), though it must still be given when the law demands it for national security or public order;
• a person under 18 can’t give this consent alone: their private matters may be published or shared only if a parent or guardian agrees, and only if it is for the child’s good (Section 33);
• giving anyone, or publishing, a person’s health details, income and property, job, family matters, fingerprints, signature, political views or business dealings without their consent is a crime (Section 12), except when a court or the police need it to investigate a crime, punishable with up to three years in prison, a fine of up to Rs 30,000, or both (Section 29); the person harmed can also ask the District Court for compensation (Section 31).

Grade 9 Computing looks at these laws, and others like them around the world, in more detail.

Data that leaves the country

Most big apps keep their data in data centers abroad. In Grade 7 you met data sovereignty: the idea that data about a country’s people should be under that country’s own laws. It matters because when your data sits on a server in another country, that country’s courts and police may be able to ask for it, and Nepal’s law may be hard to use to protect it. For the same reason, many countries ask that their government’s records, and sometimes banking and health data, be kept on servers inside the country.

What you can do

You can’t stop all data collection, and you don’t need to. But you can decide a lot:

• Give less. Leave out what a form doesn’t need (a “*” marks what is required). Say no to permissions an app’s job doesn’t need.
• Turn off what you don’t want recorded: a photo’s location, ad tracking, an app’s location history.
• See what is kept, and download or delete it (most big apps have a “Download your information” page: Grade 7’s box, What the app knows about you).
• Delete accounts you no longer use, rather than leaving them behind with your data in them.
• Ask before you collect other people’s data: your class’s survey, a photo of a friend, a list of phone numbers.
• Keep the account safe, so nobody else can take it all at once: a different strong password for every account, made of random words (three at least, four or more for email and money), and two-step login.
• Tell someone if your data is misused: a photo or details of you shared without your agreement, or someone threatening to share them. Tell an adult you trust, report it in the app, and if it is a crime, report it to Nepal Police’s Cyber Bureau (Unit 8, When an account is hacked).

Data isn’t only collected; it is shown, often as a chart, to persuade you of something. In Grade 6 you learned that a bar chart’s axis must start at 0, and checked charts for a title, named axes and numbers Grade 6: Charts that tell the truth. Now you will be the one designing the chart, and see how many choices there are, and how each one changes what the same numbers seem to say.

Here are the choices that change a chart’s story, from the ones you have seen to new ones:

• Where the axis starts. For bars, always 0. A line chart may zoom in to show small changes, but then the numbers on the axis must be clear, and you must read them.
• Which stretch of the data. Show only the months that fall, or only those that rise, and you can make a year say either. This is called cherry-picking: choosing only the data that supports your story, as if picking only the ripe cherries from a tree.
• Each value, or a running total. A running total adds each month to the months before, so it can only go up. It is fair only when the title says so.
• Stretching the chart. Make a line chart very tall and narrow, and a gentle rise looks like a cliff; make it short and wide, and a steep rise looks flat.
• Totals, or per person. A bigger place nearly always has bigger totals. To compare fairly, divide by its size.
• Pictures that grow. A picture made twice as tall is also twice as wide, so it covers four times the area, and looks four times as big.

An honest chart is one that a reader who looks only at the chart understands correctly. When you design one, add to Grade 6’s checklist:

• Show all the relevant data, or say clearly which part you show and why.
• Compare like with like: per person, per 100 students, per month.
• Keep the shape fair: not stretched or squashed to make a point.
• Say when the data was collected, as well as where it came from.