Confidentiality of Census data
The guarantee of the ActThe Census collects information relating to each person and household in Australia. It is taken to provide a snapshot of information about the community as a whole and about groups within the community. However, it is not concerned with information about individuals. The public expects that the information they provide will be kept confidential, and this is ensured by provisions in the Census and Statistics Act 1905. Under this Act, all ABS officers (including temporary employees working during the Census) are legally bound never to release identifiable personal information to any person or organisation outside the ABS.
Section 19 of the Act makes it an offence for any past or present ABS officer to divulge, either directly or indirectly, any confidential information collected under this Act. The Act provides for heavy penalties (fines of up to $13,200 or imprisonment for two years or both) for anybody convicted of breaching this obligation – even if they are no longer employed by the ABS.
In accordance with the Act, no results will be released in a way which would enable particular individuals or households to be identified. In addition, the ABS is obligated to comply with the principles set out under the Privacy Act 1988.
This fact sheet covers the following issues:
Security arrangements during collection and processingFor the Census, strict measures are taken in field collection, processing and output of data to guard against the release of confidential information. Census Collectors are responsible for ensuring the Census forms for their Collector Workload are secure at all times.
The ABS also protects householders' privacy during the collection of the Census forms. Householders who do not wish other members of the household to see their information may request a personal Census form. Those who are concerned about the Census Collector seeing their form can ask for a privacy envelope or can complete the Census form online using the eCensus. Householders who still have concerns can ask their Census Collector for a reply-paid mailback envelope to post their completed form directly to the ABS.
Completed Census forms are transferred from the collection centres to the Census Data Processing Centre under secure arrangements. Full-time security personnel are employed to prevent any unauthorised access to the processing centre. After processing of the forms has been completed, they are pulped under the supervision of an officer of the ABS. All records used by Census Collectors are destroyed.
Comprehensive security arrangements are implemented on the ABS computer system. These include the use of regularly changed passwords, access control and audit trails.
The eCensus is the electronic option for returning your Census form, which allows you to complete the Census via the Internet. To ensure that your information is delivered to the ABS free of tampering, we use the strongest encryption technology that current browsers will support. The eCensus data sent to the ABS via the Internet are not able to be read by anyone other than the ABS. At the end of the Census, the hard disk drives used to store information will be thoroughly wiped under the supervision of the ABS to ensure there is no possibility of any Census data being accessed by any unauthorised person.
Retention of name-identified informationPrior to the 2001 Census, all name-identified information was destroyed once the statistical processing was completed. However, for the 2001 and subsequent Censuses, respondents have been given the choice of having their name-identification information archived for the research use of future generations.
This change came about when the Government accepted the recommendation of the Standing Committee on Legal and Constitutional Affairs report, Saving Our Census and Preserving Our History that saving name-identified Census information 'for future research, with appropriate safeguards, will make a valuable contribution to preserving Australia's history for future generations'. This was particularly true for the 2001 Census as it coincided with the Centenary of Federation.
In order to ensure that the current high levels of public confidence and cooperation in the Census are maintained, and to respect the wishes of those who do not want their information retained for future release, information is only kept for those persons who explicitly give their consent. If a person does not explicitly agree to their name-identified Census information being retained, their name and address is destroyed once statistical processing has been completed.
The retained name-identified information is not available for any purpose, including use by a court or tribunal, within a 99 year closed access period. Retained name-identified information from the 2011 Census will become publicly available in the year 2110.
Confidentiality of tabular dataTables containing cells with very small counts may potentially result in an individual being identified. Consequently, all tables are subjected to confidentiality processes before release. These steps are taken to avoid releasing information that may identify particular individuals, families, households or dwellings, without impairing the usefulness of the tables.
Introduced random errorFor the 2006 Census, a new technique was developed to avoid identification of individuals. The confidentiality technique applied by the ABS is to slightly adjust all cells to prevent any identifiable data being exposed. These adjustments result in small introduced random errors. The technique allows very large tables, for which there is a strong client demand, to be produced even though they contain numbers of very small cells. Details of the exact nature of the methodology applied are available from the ABS on request.
Modifications are made to totals and subtotals to preserve additivity within tables. Tables which have been randomly adjusted will be internally consistent. However, comparisons with other tables containing similar data may show minor discrepancies. This is the case for both customised tables and standard products. These small variations can, for the most part, be ignored.
Care should be taken when specifying tables to minimise the number of small cells. No reliance should be placed on small cells. Aside from the effects of introduced random error, possible respondent and processing errors have greatest relative impact on small cells.
More information on random error in particular can be found in the glossary entry Introduced random error in the 2011 Census Dictionary (cat. no. 2901.0). More general information on data quality can be found in the same publication in the chapter Managing Census Quality.
For more information about privacy and confidentiality, visit the Privacy & confidentiality page