2006 Census Proposals

Is this the biggest privacy threat this year? If so, nominate it for a Big Brother Award!

Privacy concerns with the 2006 census

There are three significant privacy concerns arising out of the 2006 census:

• the linkage of people’s Census records over time

• the introduction of the e-Census

• the “Time Capsule” project

The 5% Data Linkage Project

Starting with the 2006 census, the Australian Bureau of Statistics is making a radical and disturbing change to the nature of the Census, which will affect 1 in 20 Australians. Our position is that the proposal is grossly privacy-intrusive and should not proceed.

The primary objective of the proposal is to create a Statistical Longitudinal Census Dataset (the SLCD), which means a set of data about people which links information about them over time, from one Census to the next. By contrast, the current and long-standing practice is that Census data is not linked either over time, or with information from other sources.

The proposal is thus to convert the Census from being an anonymous ‘snapshot’ of Australians’ lives once every five years, into a ‘movie’ highlighting changes in their lives.

In response to the privacy risks highlighted by the Australian Privacy Foundation and other concerned organisations and individuals, the ABS changed its proposal to only cover 5% of the population, instead of the entire population.

The final revision of the proposal by the ABS is a recognition of the significant levels of concern in the community, about the risks of privacy invasion posed by the original proposal. It is also a recognition that seeking to match 2006 census records back in time to 2001 records would have been a breach of the promises made to Australians in 2001.

But the project – to keep longitudinal records on 5% of Australians – still poses considerable risks. That is still around 1 million people whose records will be linked from one census to the next. That is a more significant proposal than the UK practice of linking census data on 1% of their population over time.

We are also very concerned about the lack of clarity of what the project actually entails. For example the ABS said in its media release of 18 August 2005 that the ABS “may” add in extra data, and “might” use disease register information, to add to the longitudinal data collected on these 1 million people. But then in the Statement of Intention say they won’t use the 5% SLCD with other ABS datasets. The public requires firm, clear and legally enforceable statements about the project.

A further Privacy Impact Assessment of this project is essential. The APF is strongly opposed to the measure. It was given no publicity whatsoever during the long and expensive propaganda campaign that the ABS waged in the lead-up to the Census.

Further information about the Statistical Longitudinal Census Dataset project is set out below.

The e-Census

The introduction of the e-Census (online electronic census completion by individuals) introduces data security risks, particularly the potential for your extensive personal information to be intercepted in transit between the user’s keyboard and the online census web server.

On the eve of census day, computer security experts warned that up to 1 million people could be putting their private information at risk of data thieves by filling out the census online, because of Trojan horse software which “can capture personal details from infected machines by recording a user’s keystrokes” (“Take care filling in e-census forms, experts warn”, Australian Financial Review, 8 August 2006, p.9).

The “Time Capsule” project

All people completing the census form are provided the option of having their name-identified census information archived for the use of future generations. If you choose “yes”, your personal information will be held in the custody of National Archives of Australia, and is not supposed to be accessible for 99 years.

This option was first introduced for the 2001 census. Roughly half the population said “yes”.

While the APF does not oppose this project (because your name-identified information is only kept if you consent to it), we do warn people of the risks involved.

  • In particular, there will always be a risk that some future government will change the law, and access the National Archives before the promised 99 years is up, and using the information for a purpose we would today see as an abuse, such as identifying and locating all Muslim men.
  • Democratic governments in other countries have abused census information in the past, and given our inability to predict what political changes might occur in the future, it is impossible to guess who might be a target.

The best privacy protection is therefore to not allow your name-identification information to be kept at all.

The Revised Data Linkage Proposal of August 2005

On 18 August 2005, the ABS announced that “After consideration of [the] submissions, the Australian Statistician decided to substantially modify the proposal. Rather than covering the whole population the ABS will create a statistical longitudinal census dataset covering a 5% sample of the population enumerated during the 2006 Census. The ABS has also decided not to proceed with the option to include the 2001 Census data. Further details relating to the elements of the proposal are set out in the statement of intention below”:

The Proposal is less grossly intrusive than its predecessors, because (1) it will include only 1 in 20 of Australia’s 20 million people, and (2) it will not be retrospective to the 2001 Census.

But the Australian Privacy Foundation remains very seriously concerned about the revised Proposal. It continues to have the following features:

  • the data collected in each Census would now be retained, rather than being destroyed once analysis has been completed. This breaches the public expectation that the detailed data only has a short life and that all that is retained is statistics
  • the data collected in successive Censuses would now be linked. This breaches the public expectation that the Census is a statistical snapshot
  • the data would be very rich, and the individuals it refers to would be readily identifiable. This breaches the vital public expectation that Census data is anonymous
  • the data will still cover 1 million people, and hence will continue to be greatly attractive to many agencies and many corporations
  • it will be used in conjunction with further data from government sources such as birth, death and disease registers, and immigration data. This further breaches public expectations about privacy protections for their data
  • it may be used in conjunction with data from yet more sources. This would further breach public expectations about privacy protections for their data
  • although some kinds of change to the scheme would require legislation, a great many potential ‘enhancements’ to the scheme could be implemented as and when the Australian Statistician of the day sees fit
  • the ABS is trying to maintain the fiction that “because names and addresses will not be used, it will be impossible to identify who is included in the [collection]”. With such a rich data-set, this is, quite simply, untrue; and the fact that the ABS can utter such a statement gives rise to concerns about the agency’s trustworthiness

In bringing this Proposal forward, the ABS is seriously undermining its hitherto strong reputation. The ABS is also doing great harm to the Census, because the Proposal will significantly reduce people’s readiness to complete Census forms, and to do so accurately. The Proposal should be withdrawn.

See:

The Originally Published Data Linkage Proposal of April 2005

The Australian Bureau of Statistics stated that it was considering a proposal to radically alter the nature of the Census, to replace the anonymous ‘snapshot’ of the 5-yearly Census with an identifiable ‘movie’ of every Australian’s life. The proposal was to change the way information collected through the five-yearly Australian Census is stored, used, linked or matched with other information, and disclosed, in two main ways:

  1. by linking information about all Australians over time, from one Census to the next (including retrospective data-matching back to the 2001 Census)
  2. by linking this new “longitudinal” database to information from other sources – such as information about births, deaths, immigration and disease

In some cases names and addresses could be used as the key to linking records, while in other cases probabilistic methods were proposed. The Australian Privacy Foundation stated that it was strongly opposed to the proposal, because it posed increased risks to Australians’ privacy. Possible privacy breaches could come from three sources:

  • hacking into the system by people who want access to the data
  • unauthorised disclosure of information by ABS staff, whether accidental or deliberate
  • pressure to use Census / SLCD data for new purposes (political or commercial)

We stated that the proposed safeguards are simply not enough to protect Australians from these risks.

Even if not intended by the ABS, this proposal would represent a major stepping-stone towards a national identity card, something that Australians have consistently rejected.

We stated that we believed that the ABS had under-estimated the risk to the privacy of all Australians posed by this proposal, and had also under-estimated the value placed on privacy by Australians.

Resources – The ABS Proposal

Submissions and Media

ABS’s Privacy Impact Assessment

Further Submissions

The Original (Unpublished) Data Linkage Proposal of March 2005

The Australian Bureau of Statistics approached APF and some other organisations in March 2005, seeking feedback on a draft document. We believe that this was a constructive move by the ABS, because it enabled key issues to be surfaced, and created the possibility that the agency might not proceed with an announcement that could have serious negative impacts.

The APF was greatly alarmed by the proposal, and provided a written submission analysing the proposal and explaining why it was extremely inadvisable for the Bureau to proceed. The Australian Statistician invited the APF’s representatives to a meeting. This was attended by the Chair, Anna Johnston, by tele-conference, and Roger Clarke, in the ABS’s offices in Canberra. There was front-page coverage of the emergent proposal in The Australian Financial Review at about the same time (17 March 2005), which underlined the proposal’s contentiousness.

Following the meeting and the article in the AFR, the ABS announced that some aspects of the proposal were being re-considered. This initially sounded very positive, resulting in an optimistic assessment of the consultative process being published.

However, the ABS then proceeded to publish a revised proposal, which was only marginally less intrusive than the original. This led to further rounds of submissions and changes, documented above.