Privacy, confidentiality & security
The Australian Bureau of Statistics (ABS) is committed to upholding the privacy, confidentiality and security of the personal information it collects. Not only does the ABS have strong legislative protections that safeguard the secrecy of an individual's information, it has a proud 100-year history of maintaining community trust in the way it collects, uses, discloses and stores your personal information collected in the Census.Law protects the secrecy of your informationUnder the Census and Statistics Act 1905, the personal information you provide in the Census remains strictly confidential to the ABS. The ABS never has and never will release identifiable Census data.As an Australian Government agency, we also comply with the Privacy Act 1988 (Privacy Act) and handle your personal information in accordance with the Australian Privacy Principles (APPs). All ABS staff are legally bound never to release your personal information to any individual or organisation outside of the ABS, this includes temporary staff working on the Census. It’s an offence for any ABS staff, past or present, to divulge, directly or indirectly, any information collected under this Act. Penalties include fines of up to $25,200 or imprisonment for up to 2 years, or both, for anybody convicted of breaching this obligation. We cannot, and will not share or provide your identifiable personal information to any government department or organisation. Are names and addresses compulsory in the Census?Names and addresses have been collected in every Census, since 1911.Names and addresses are specified in the Census Regulations as Statistical Information, like all other Census topics. This requires the ABS to collect this information as part of the Census. The requirement for all topics, including names and address, on the Census forms to be filled completely and accurately is consistent with 105 years of Australian Census practice, the Census and Statistics Act 1905 and legal advice to the ABS from the Australian Government Solicitor. The only exception is religion, which the legislation specifies is optional. Why does the ABS collect names and address in the Census?The collection of names and addresses in the Census is a critical part of ensuring the quality and value of the Census.Names are collected in the Census for a number of reasons, including:
Addresses are collected in the Census for a number of reasons, including:
The ABS commenced using names and addresses to enhance Census data through data integration in the 2006 Census. This change followed community consultation in 2005, and has been transparently communicated through media releases, public submission papers, privacy impact assessments, published research, stakeholder consultation and the ABS website. More information of these publications, papers and the statistics produced is available in the ABS Statistical Data Integration: Data and Publications page. What are the benefits of retaining names and address collected in the Census?ABS research has shown that retaining names and addresses will improve the accuracy and efficiency of data linkage and therefore improve the quality of the resultant statistics. The use of anonymised name and address in data linking significantly increases the successful linkage rates compared to linking methods without these variables (source - Research Paper: Assessing the Quality of Linking School Enrolment Records to 2011 Census Data: Deterministic Linkage Methods (cat. no. 1351.0.55.045)). Further, where high quality name and address information are not available, extensive resource intensive analysis is required following any linkage to ascertain the characteristics of the populations of interest in the datasets, for both the linked and unlinked records, in order to effectively account for any systematic bias in the linked data (source - Research Paper: Assessing the Suitability of Temporary Migrants Administrative data for data Integration, Nov. 2014 (cat. no. 1351.0.55.053)). The use of name and address information may also be expected to deliver more successful outcomes for otherwise difficult to link populations, in particular Aboriginal and Torres Strait Islander people living in remote communities (source - Research paper: Death Registrations to Census Linkage Project - A Linked Dataset for Analysis, March 2016 (cat. no. 1351.0.55.058)).Names and addresses will be stored securely and separate from one another. After the Census processing period is complete no-one working with Census data will be able to view non-anonymised personal information (such as name or address) at the same time as other Census responses (such as age, sex, occupation, level of education or income). Original name and address information is used by the ABS to generate anonymised versions of name (i.e. an unrecognisable code) and address codes, which are combined with a limited range of other Census responses to facilitate data integration activities. This practice, known as the Functional Separation principle, ensures that an individual's identity remains protected during the linking and analysis process. The new linked data sets, (containing only anonymised versions of names and address codes and no original names and addresses), will improve the lives of Australians by:
More information about the benefits of Data Integration is available on the Data Integration Frequently Asked Questions page. When should the ABS destroy names and addresses?In recent Censuses names and addresses have been destroyed at the end of Census data processing, approximately eighteen months after the Census. This has reduced the value of the Census data and the ability for it to be used to inform future planning and decisions. Recent public consultation and engagement has revealed that Australians expect the ABS to keep their information secure and to use their data for the benefit of them, their community and Australia.There is also an expectation that the ABS should retain and use the information collected in the Census for as long as there is a benefit for the community to do so. Consistent with the Australian Privacy Principles, the information should be destroyed once this need no longer exists. For the 2016 Census, the ABS will destroy names and addresses when there is no longer any community benefit to their retention or four years after collection (i.e. August 2020), whichever is earliest. Retaining name and address for a longer period will ensure the ABS is able to use the most up-to-date, secure and effective anonymisation methodologies. Retaining name and address for a longer period will enhance the quality of ABS integrated datasets by enabling the ABS to generate anonymous codes that best match the quality and characteristics of the particular datasets being brought together. New anonymisation techniques are constantly being developed by experts around the world and retention will enable the ABS to continue to adopt the best available methods. Annual review processes to determine whether there is ongoing community benefit in retaining name and address information are being established. The safety and security of name and address information throughout the retention period will be achieved through arrangements, including:
The ABS has and will always ensure that sufficient safeguards are in place to protect the secrecy, privacy and confidentiality of the information it collects in the Census, including names and addresses. Who did the ABS consult when making the decision to retain names and addresses in the Census?The ABS has undertaken consultation processes and public sentiment testing in the lead up to and following the 2016 Census that has indicated that there is a continuing high level of public support for the Census and trust in the ABS to manage their information both securely and confidentially.The ABS invited public comment on the proposal to retain names and addresses from the 2016 Census by issuing a media release and accompanying statement of intent on November 11, 2015. Direct consultation was undertaken with each State and Territory Privacy Commissioner and the Australian Information Commissioner. The ABS also engaged a private research company to undertake sessions with members of the public across a range of demographics and locations to understand their opinions on this issue. Consistent with best practice, the ABS conducted a Privacy Impact Assessment to assess the potential risks the retention of names and addresses from responses to the 2016 Census might have to the privacy of individuals, and to assess the ABS’ proposed approach to managing, minimising or eliminating those risks. The Privacy Impact Assessment was undertaken in accordance with the framework for Privacy Impact Assessments set out in the Office of the Australian Information Commissioner’s Guide to undertaking Privacy Impact Assessments. Following the outcomes of the Privacy Impact Assessment, the direct consultation and consideration of all the public submissions received the ABS made the decision to retain names and address from the 2016 Census. The 2016 approach is an incremental change to the widely publicised and consulted on Census Data Enhancement program undertaken with the 2006 and 2011 Census. Further information on the 2006 and 2011 programs is available on the ABS Statistical Data Integration: Data and Publications page. The ABS has committed to commissioning independently conducted privacy impact assessments and broad-ranging consultation for future significant changes to personal information handling practices. Are similar practices undertaken in other countries?Canada and New Zealand retain the names and addresses from every Census in order to enhance the value and use of the information collected in the Census, by combining Census data with other national datasets. It is common and accepted practice in many other countries, for trusted National Statistical Offices to unleash the power of statistics using data integration.How will the ABS keep my information secret, confidential and secure?The ABS has legal obligations to keep data secure and ensure that it does not disclose identifiable information about a person, household or business. The ABS never has and never will release identifiable Census data. Key measures to safeguard information include strong encryption of data, restricted access on a need-to-know basis and monitoring of all staff, including regular audits. After data collection and processing, the ABS removes names and addresses from other personal and household information. Names and addresses will be stored securely and separate from one another. No one working with Census data will be able to view your personal information (name or address) at the same time as your other Census responses (such as age, sex, occupation, level of education or income). Stored separately and securely, individuals names will also be substituted with a linkage key, a computer generated code, completely anonymising the personal information. Only these anonymous linkage keys will be used by the ABS to bring data sets together. This practice is known as the Functional Separation principle.The ABS’ application for Accreditation addresses in detail how we adhere to the separation principles. The key layers of protection that will be in place as a result of applying functional separation are listed in the 2015 Privacy Impact Assessment. (Source - Privacy Impact Assessment – Retention of Names and Addresses from 2016 Census, page 14) As an accredited data integrating authority, the ABS complies with a set of key principles for any project that combines Census data with other data, including assessing every project to ensure that the project provides a significant public benefit and safeguards privacy. The ABS is transparent about every data integration project and publishes the details online. The ABS complies with the mandatory requirements established by the Australian Commonwealth Protective Security Policy Framework, which include implementing governance, physical, and information security measures to protect data held by the ABS. The ABS will conduct regular audits of the safeguards, the use and the need for the retention of names and addresses collected in the Census. Which agencies or groups is information shared with?The Census and Statistics Act 1905, requires that Census data is never released in identifiable form, or released to any court, tribunal or other agency. This will not change. No identifiable, private or confidential data will be shared by the ABS with anyone.Non-identifiable statistics produced from Census data are freely available on the ABS website and is used by the community, academics, local/state/federal governments, media and businesses. For example, in this article you can see how the Australian Census Longitudinal Dataset helps to understand housing transitions for older Australians. How secure is my personal information?A critical feature of the Census and the online form is the first-rate security it uses to protect the secrecy of all personal information collected. The security measures in place have been independently tested and reviewed to ensure that your personal information is secure. The connection from the user's computer to the online form is protected using, at a minimum, 128-bit TLS encryption, the same encryption technology used for internet banking. The system has also been designed to be best practice and complies with the Australian Government Information Security Manual developed by the Defence Signals Directorate.The independent assessment of ABS’ compliance with statutory privacy principles as well as wider privacy concerns and principles also found that “ABS security measures meet the highest standards.” (Source - 2006 Census of Population and Housing – Enhancing the Population Census – Privacy Impact Assessment, 2005, para 7.10) Australian Signals Directorate strategies are implemented by the ABS. These strategies include strategies specifically designed to mitigate targeted cyber intrusions. Do these changes affect the Census Time Capsule?No. Since 2001, Australians have had the option to have their full and complete Census information saved for future generations via the Census Time Capsule initiative. The National Archives of Australia will hold the information securely for 99 years, before releasing it publicly. This has not changed.More information on data integrationFurther information on Data Integration can be found on the ABS Data Integration pageDoes the Census have a privacy policy?Yes, the Census Privacy Policy explains how the personal information you provide to the ABS as part of the 2016 Census is collected, used and disclosed. This statement is consistent with the ABS Privacy Policy.How does the ABS protect the privacy of information provided outside the Census form?Information is collected outside the Census form to help conduct the Census. It includes contact information such as your name, email address, address and telephone number. This information may be collected during the conduct of the Census, including when you contact the Census Inquiry Service, submit an online form, write to us or are contacted by an ABS Officer. Personal information collected outside the Census form is subject to protections of the Privacy Act and is handled in accordance with the Australian Privacy Principles (APPs).If you provide your email address or telephone number, we will only use it to assist with completion of your Census form and will not add it to any mailing lists unless you request us to do so. For more information, see the Census Privacy Policy. |
|
