Computer Science · 11th Grade

Active learning ideas

Privacy and Data Protection Laws

Active learning works especially well for privacy laws because the concepts feel abstract until students see how they play out in real companies and real consequences. When students analyze fines, role-play audits, and debate gaps in the law, they move from memorizing clauses to understanding the human impact of policy decisions.

• Common Core State Standards
• CSTA: 3B-IC-24
• CSTA: 3B-IC-25

• 25–40 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Case Study Analysis
• 40 min · Pairs

Case Study Analysis: Real Breach, Real Fines

Assign pairs a documented GDPR or CCPA enforcement case (e.g., Google 50M euro fine, British Airways 20M pound fine). Each pair identifies what regulation was violated, what the organization should have done differently, and whether the penalty was proportionate. Pairs present findings in a structured three-minute pitch to the class.

Explain the core principles of major data protection regulations (e.g., GDPR, CCPA).

Facilitation Tip

During the case study, pause after each fine amount is revealed and ask students to calculate what percentage of the company’s revenue it represents to make the penalty tangible.

What to look for

Pose the question: 'Imagine you are a data privacy officer for a US-based tech startup that offers services globally. What are the top three challenges you anticipate in complying with both GDPR and CCPA? Be prepared to justify your choices.'

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 02

• Socratic Seminar
• 35 min · Small Groups

Role-Play: Privacy Compliance Audit

Groups of four receive a fictional company profile with a data collection scenario. One member plays the compliance officer, one plays a regulator, one plays a consumer advocate, and one plays the CEO. The group works through whether the company's practices meet GDPR/CCPA requirements, then reports areas of risk to the class.

Analyze the responsibilities of organizations under these privacy laws.

Facilitation Tip

For the role-play audit, assign one student to play the data privacy officer and another to play the skeptical student to surface real tensions between usability and compliance.

What to look for

Provide students with a short scenario describing a company's data collection practices. Ask them to identify which principles of GDPR or CCPA (e.g., data minimization, right to opt-out) are potentially being violated and why.

• Analyze
• Evaluate
• Create
• Social Awareness
• Relationship Skills

Activity 03

• Think-Pair-Share
• 25 min · Pairs

Think-Pair-Share: Are Current Laws Enough?

Students individually read two short excerpts--one arguing current privacy laws are sufficient and one arguing they are inadequate. They write their initial stance, discuss with a partner, then share with the class. Track opinion shifts on the board to generate discussion about what stronger protections might look like.

Critique the effectiveness of current laws in protecting individual privacy in the digital age.

Facilitation Tip

In the Think-Pair-Share, provide a short headline about a recent privacy issue so students have a concrete anchor for their debate on whether current laws are enough.

What to look for

On an index card, have students write one key difference between GDPR and CCPA regarding individual rights and one example of how a company might demonstrate compliance with the principle of purpose limitation.

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

A few notes on teaching this unit

Teachers should treat this topic as both civics and ethics—students need to see that laws evolve alongside technology. Avoid presenting privacy rules as fixed; instead, frame them as ongoing debates where students’ future careers and digital lives will be shaped. Research shows that when students role-play compliance roles, they internalize the trade-offs better than through lectures alone.

Successful learning looks like students confidently applying GDPR and CCPA principles to unfamiliar scenarios, not just recalling definitions. They should question weak privacy practices, suggest specific compliance steps, and explain why one law’s rules might conflict with another’s in a given situation.

---

Watch Out for These Misconceptions

• During Case Study Analysis: Real Breach, Real Fines, some students may assume GDPR only applies to European companies. Watch for this when analyzing fines like Meta’s 1.2 billion euro penalty and prompt students to locate the US headquarters in the case materials.

  During Case Study Analysis: Real Breach, Real Fines, redirect students to the enforcement notice to highlight that the fine applies because EU residents’ data was processed, not where the company was based.

• During Role-Play: Privacy Compliance Audit, students may believe CCPA compliance automatically satisfies GDPR. Watch for this when teams propose generic solutions and ask them to check the audit checklist for both laws.

  During Role-Play: Privacy Compliance Audit, have students compare their audit findings side-by-side with a provided side-by-side chart of GDPR and CCPA obligations to reveal gaps in their thinking.

• During Think-Pair-Share: Are Current Laws Enough?, students might assume privacy laws only matter to giant corporations. Watch for this when they cite Google or Facebook examples and redirect them to the small-business scenarios in their discussion prompts.

  During Think-Pair-Share: Are Current Laws Enough?, ask students to consider a hypothetical local bakery’s app that tracks customer birthdays and prompt them to identify which law’s thresholds the bakery might cross.

---

Methods used in this brief

• Case Study Analysis
• Socratic Seminar
• Think-Pair-Share