Privacy, confidentiality and security of Census data

The Australian Bureau of Statistics (ABS) is committed to upholding the privacy, confidentiality and security of the personal information it collects. Not only does the ABS have strong legislative protections that safeguard the secrecy of an individual's information, it has a proud 100-year history of maintaining community trust in the way it collects, uses, discloses and stores your personal information collected in the Census.

As an Australian Government agency, we comply with the Privacy Act 1988 (Privacy Act) and handle your personal information in accordance with the Australian Privacy Principles (APPs).

Under the Census and Statistics Act 1905, the personal information you provide in the Census remains strictly confidential to the ABS. The ABS never has and never will release identifiable Census data.

All ABS staff are legally bound never to release your personal information to any individual or organisation outside of the ABS, this includes temporary staff working on the Census. It’s an offence for any ABS staff, past or present, to divulge, directly or indirectly, any information collected under this Act. Penalties include fines of up to $26,400 or imprisonment for up to 2 years, or both, for anybody convicted of breaching this obligation.

We cannot, and will not share or provide your identifiable personal information to any government department or organisation.

Names and addresses have been collected in every Census, since 1911.

Names and addresses are specified in the Census and Statistics Regulations as Statistical Information, like all other Census topics. This requires the ABS to collect this information as part of the Census. The requirement for all topics, including names and address, on the Census forms to be filled completely and accurately is consistent with 110 years of Australian Census practice, the Census and Statistics Act 1905 and legal advice to the ABS from the Australian Government Solicitor. The only exception is religion, which the legislation specifies is optional.

The collection of names and addresses in the Census is a critical part of ensuring the quality and value of the Census.

Names are collected in the Census for a number of reasons, including to:

• assist householders completing the form to report the relevant information for each person
• ensure the Census covers the entire population and data is of high quality
• enhance the value of Census data, by combining it with other national datasets to better inform government decisions in important areas such as health, education, infrastructure and the economy.

Addresses are collected in the Census for a number of reasons, including to:

• produce accurate population estimates for regions, which are critical in the distribution of government funds and for electoral purposes
• be able to release data for geographic areas, such as postal areas, states and territories, capital cities, towns, remote areas and many more
• ensure that no household is missed in the Census
• produce both usual residence and Census night population counts
• provide insights on the internal migration of people within Australia.

The ABS commenced using names and addresses to enhance Census data through data integration in the 2006 Census. This change followed community consultation in 2005, and has been transparently communicated through media releases, public submission papers, privacy impact assessments, published research, stakeholder consultation and the ABS website. More information of these publications, papers and the statistics produced is available on the ABS Data Integration page.

ABS research has shown that retaining names and addresses will improve the accuracy and efficiency of data linkage and therefore improve the quality of the resultant statistics. The use of anonymised names and addresses in data linking significantly increases the successful linkage rates compared to linking methods without these variables (source - Research Paper: Assessing the Quality of Linking School Enrolment Records to 2011 Census Data: Deterministic Linkage Methods (cat. no. 1351.0.55.045)). Further, where high quality name and address information is not available, extensive resource intensive analysis is required following any linkage to ascertain the characteristics of the populations of interest in the datasets, for both the linked and unlinked records, in order to effectively account for any systematic bias in the linked data (source - Research Paper: Assessing the Suitability of Temporary Migrants Administrative Data for Data Integration, Nov 2014 (cat. no. 1351.0.55.053)). The use of name and address information may also be expected to deliver more successful outcomes for otherwise difficult to link populations, in particular Aboriginal and Torres Strait Islander people living in remote communities (source - Research paper: Death Registrations to Census Linkage Project - A Linked Dataset for Analysis, March 2016 (cat. no. 1351.0.55.058).

Names and addresses will be stored securely and separate from one another. After the Census processing period is complete, no-one working with Census data will be able to view Census personal identifiers (name or address) at the same time as other Census responses. A number of further protections are put in place to ensure that an individual's identity remains protected during the linking and analysis process. 

To facilitate this, original name and address information is converted to anonymised versions of name (i.e. an unrecognisable code - for details, see ABS Data Integration) and address codes under strict security arrangements. A small number of vetted ABS staff can then use these unrecognisable codes under strict conditions to undertake secure linkage activities for approved statistical and research purposes only. Refer to further information on the Functional Separation principle. These codes are then removed from the linked dataset. No anonymised codes are available on the research dataset, either internally to ABS officers or to external researchers.

The new linked data sets will improve the lives of Australians by:

• better informing decisions, policies and services in important areas like health, education, infrastructure and the economy
• enabling greater use of existing data and reducing the burden on individuals to provide data that is already available
• providing additional insights and more confidence in decisions, particularly for the most vulnerable and challenging policy areas.

More information about the benefits of Data Integration is available on the Data Integration page.

In recent Censuses names and addresses have been destroyed at the end of Census data processing, approximately eighteen months after the Census. This has reduced the value of the Census data and the ability for it to be used to inform future planning and decisions.

Recent public consultation and engagement has revealed that Australians expect the ABS to keep their information secure and to use their data for the benefit of them, their community and Australia.

There is also an expectation that the ABS should retain and use the information collected in the Census for as long as there is a benefit for the community to do so. Consistent with the Australian Privacy Principles, the information should be destroyed once this need no longer exists.

For the 2016 Census, the ABS will destroy names and addresses when there is no longer any community benefit to their retention or four years after collection (i.e. August 2020), whichever is earliest. Retaining names and addresses for a longer period will ensure the ABS is able to use the most up-to-date, secure and effective anonymisation methodologies. It will also enhance the quality of ABS integrated datasets by enabling the ABS to generate anonymous codes for that best match the quality and characteristics of the particular datasets being brought together. New anonymisation techniques are constantly being developed by experts around the world and retention will enable the ABS to continue to adopt the best available methods. Annual review processes to determine whether there is ongoing community benefit in retaining name and address information are being established.

The safety and security of name and address information throughout the retention period will be achieved through arrangements, including:

• storage of names and addresses separately from other Census data, as well as separately from each other
• converting names to anonymised codes and only using these codes for linkage
• limiting the use of addresses and anonymised names to projects where this is necessary to improve the quality of the analysis
• projects that have been approved to use anonymised names and addresses are subjected to strict information security provisions
• strict adherence to existing ABS governance and security protocols
• regular audits and process reviews to ensure the ongoing security, compliance with protections and appropriate use of name and address information.

The ABS has and will always ensure that sufficient safeguards are in place to protect the secrecy, privacy and confidentiality of the information it collects in the Census, including names and addresses.

The ABS has undertaken consultation processes and public sentiment testing in the lead up to and following the 2016 Census that has indicated that there is a continuing high level of public support for the Census and trust in the ABS to manage their information both securely and confidentially.

The ABS invited public comment on the proposal to retain names and addresses from the 2016 Census by issuing a media release and accompanying statement of intent on November 11, 2015. Direct consultation was undertaken with each State and Territory Privacy Commissioner and the Australian Information Commissioner. The ABS also engaged a private research company to undertake sessions with members of the public across a range of demographics and locations to understand their opinions on this issue.

Consistent with best practice, the ABS conducted a Privacy Impact Assessment to assess the potential risks the retention of names and addresses from responses to the 2016 Census might have to the privacy of individuals, and to assess the ABS’s proposed approach to managing, minimising or eliminating those risks. The Privacy Impact Assessment was undertaken in accordance with the framework for Privacy Impact Assessments set out in the Office of the Australian Information Commissioner’s Guide to undertaking Privacy Impact Assessments.

Following the outcomes of the Privacy Impact Assessment, the direct consultation and consideration of all the public submissions received the ABS made the decision to retain names and addresses from the 2016 Census.

The 2016 approach is an incremental change to the widely publicised and consulted on Census Data Enhancement program undertaken with the 2006 and 2011 Census. Further information on the 2006 and 2011 programs is available on the ABS Data Integration page.

The ABS has committed to commissioning independently conducted privacy impact assessments and broad-ranging consultation for future significant changes to personal information handling practices.

Canada and New Zealand retain the names and addresses from every Census in order to enhance the value and use of the information collected in the Census, by combining Census data with other national datasets. It is common and accepted practice in many other countries, for trusted National Statistical Offices to unleash the power of statistics using data integration.

The ABS has legal obligations to keep data secure and ensure that it does not disclose identifiable information about a person, household or business. The ABS never has and never will release identifiable Census data. Key measures to safeguard information include strong encryption of data, restricted access on a need-to-know basis and monitoring of all staff, including regular audits. After data collection and processing, the ABS removes names and addresses from other personal and household information. Names and addresses will be stored securely and separate from one another. No one working with Census data will be able to view your personal information (name or address) at the same time as your other Census responses (such as age, sex, occupation, level of education or income). Stored separately and securely, individuals names will also be substituted with a linkage key, a computer generated code, completely anonymising the personal information. Only these anonymous linkage keys will be used by the ABS to bring data sets together. This practice is known as Functional Separation.

The ABS's application for Accreditation addresses in detail how we adhere to the separation principles. The key layers of protection that will be in place as a result of applying functional separation are listed in the 2015 Privacy Impact Assessment. (Source - PIA: Proposal to Retain Name and Address Information from Responses to the 2016 Census of Population and Housing, page 13)

As an accredited data integrating authority, the ABS complies with a set of key principles for any project that combines Census data with other data, including assessing every project to ensure that the project provides a significant public benefit and safeguards privacy.

The ABS is transparent about every data integration project and publishes the details online.

The ABS complies with the mandatory requirements established by the Australian Commonwealth Protective Security Policy Framework, which include implementing governance, physical, and information security measures to protect data held by the ABS.

The ABS will conduct regular audits of the safeguards, the use and the need for the retention of names and addresses collected in the Census.

The Census and Statistics Act 1905, requires that Census data is never released in identifiable form, or released to any court, tribunal or other agency. This will not change. No identifiable, private or confidential data will be shared by the ABS with anyone.

Non-identifiable statistics produced from Census data are freely available on the ABS website and is used by the community, academics, local/state/federal governments, media and businesses. For example, in this article you can see how the Australian Census Longitudinal Dataset helps to understand housing transitions for older Australians.

A critical feature of the Census and the online form is the first-rate security it uses to protect the secrecy of all personal information collected. The security measures in place have been independently tested and reviewed to ensure that your personal information is secure.

The connection from the user's computer to the online form is protected using, at a minimum, 128-bit TLS encryption, the same encryption technology used for internet banking.

The system has also been designed to be best practice and complies with the Australian Government Information Security Manual developed by the now Australians Signals Directorate.

The independent assessment of the ABS’s compliance with statutory privacy principles as well as wider privacy concerns and principles also found that “ABS security measures meet the highest standards.” (Source - 2006 Census of Population and Housing – Census Enhancement Proposal – Privacy Impact Assessment, 2005, para 7.10)

Australian Signals Directorate strategies are implemented by the ABS. These strategies include strategies specifically designed to mitigate targeted cyber intrusions.

No. Since 2001, Australians have had the option to have their full and complete Census information saved for future generations via the Census Time Capsule initiative. The National Archives of Australia will hold the information securely for 99 years, before releasing it publicly. This has not changed.

Further information on Data Integration can be found on the ABS Data Integration page.

Yes, the 2016 Census Privacy Policy explains how the personal information you provide to the ABS as part of the 2016 Census is collected, used and disclosed. This statement is consistent with the ABS Privacy Policy.

Information is collected outside the Census form to help conduct the Census. It includes contact information such as your name, email address, address and telephone number. This information may be collected during the conduct of the Census, including when you contact the Census Inquiry Service, submit an online form, write to us or are contacted by an ABS Officer. Personal information collected outside the Census form is subject to protections of the Privacy Act and is handled in accordance with the Australian Privacy Principles (APPs).

If you provide your email address or telephone number, we will only use it to assist with completion of your Census form and will not add it to any mailing lists unless you request us to do so.