Say my name, [save] my name...
The citizen's right to privacy, in contrast with the needs of
government and the people for good information on all Australians, has been a
fundamental issue for the Bureau since it was established. Part of the difficulty
lies in the fact that what is acceptable to ask, changes over time with the
evolution of attitudes in society.[1]
4.1
Privacy concerns have been a regular feature of censuses, as discussed
in chapter 2. One of the most contentious elements of the 2016 census was the
decision by the ABS to retain the names and addresses of respondents for up to
four years to increase the value that could be extracted from the census data.
Name and address information has always been collected as part of the census
for the purpose of ensuring that the count was accurate and complete. After the
data was processed, the name and address information was then destroyed,
typically within 12 to 18 months.[2]
4.2
This chapter considers this decision by the ABS in the following way:
-
the timeline and actions leading to the decision to collect names
and addresses; and
-
a consideration of whether the ABS has the power to retain names
and addresses.
4.3
The following chapter will continue on a similar theme, but will focus
on the storage, security and use of name and address data. Chapter 6 will
discuss the events that took place on 9 August.
4.4
During the discussion leading up to the census, there was some confusion
regarding the difference between privacy and secrecy. Former Australian
Statistician Bill McLennan explained: 'Privacy is not secrecy. It is about
giving individuals control over how their personal information is handled'.[3]
Secrecy can be considered as determining who has access to information, whereas
privacy is determining whom we provide information. This chapter considers
privacy concerns, the following will focus on matters of information security.
4.5
Many submissions levelled criticisms at the ABS over its conduct leading
up to the decision to retain names and addresses, including allegations that it
did not consult properly, that it was insufficiently open regarding the impact
of the changes, and that the Privacy Impact Assessment (PIA) was insufficiently
robust for a change affecting data collected compulsorily from every household
in Australia.
Retention of names and addresses
4.6
The 2016 census was new in that it proposed to retain name and address
information collected as part of the census for the purpose of increasing the
uses of the collected data, rather than only for data integrity. As the ABS
reported:
With the changes to retention of names and addresses, the ABS
will be able to produce more policy relevant statistics on aspects such as
industrial change in Australia, the performance of health and education
services, and key determinants of changes in local communities and households
over time. These new statistics will help governments and Parliaments make more
informed policy choices over coming years.[4]
4.7
As noted in chapter 2, name and address information from previous censuses
have been destroyed following processing in accordance with ABS policy in
relation to retention of personal identifiers. The policy states:
It is ABS policy that name, address and other identifiers of
individuals must be deleted from collected survey and administrative files as
soon as practical after processing, unless there is a business need approved by
the Australian Statistician.[5]
4.8
The ABS proposed that by combining census data with other administrative
datasets, a more granular picture of Australia would emerge:
[The] use of statistical data integration techniques to bring
together Census data with other survey and administrative data would enable the
ABS to meet the growing demand of policy agencies (e.g. Department of Social
Services, Department of Health), service providers and the research community
for higher quality 'joined-up' information to better inform planning decisions
and government policies in the public good. In particular, the use of names and
addresses to improve the quality and accuracy of linked information, would
enhance the ability of policy makers and researchers to effectively measure
changes over time or differences between population sub groups or regions.[6]
4.9
In August 2015—four years after preparations for the census had begun—the
ABS published the 'Census of Population and Housing: Nature and Content,
Australia, 2016' which foreshadowed the ABS was considering the retention of
both names and addresses for statistical purposes.[7]
In October 2015, the ABS published 'Information Paper: Census of Population and
Housing–Proposed Products and Services, 2016' which highlighted that data
integration across datasets would be a central element of the census.[8]
This was followed up in November 2015 with notification of a statement of
intent to conduct a PIA regarding the decision to collect names and addresses.
4.10
Documents provided to the committee show that within the ABS, the move
to retain names and addresses was not considered controversial:
The proposed changes were an incremental change to existing
practice in the widely publicised Census Data Enhancement program undertaken
with the 2006 and 2011 Censuses.[9]
4.11
There appears to have been a belief within the ABS that destroying name
and address information was preventing the organisation from meeting its
objectives:
There is a widely held view within ABS that continuing to
operate under such restrictions [destroying name and address information] will
be a significant barrier in meeting both statistical and operational
aspirations.[10]
4.12
Following the conclusion of an internally conducted PIA in December 2015
regarding the retention of names and addresses, the ABS announced that names
and addresses would be retained until there was no longer any community benefit
to their retention.[11]
4.13
Following concerns raised in the media and online regarding the impact
of retaining names and addresses indefinitely, the ABS announced in April 2016 that
this information would be retained for a period of no more than four years
before being destroyed.[12]
The ABS informed the committee that:
This decision was considered by the ABS to provide a balance
between the use of Census data and the extensive privacy protections in place
for the 2016 Census.[13]
Privacy Impact Assessment 2015
4.14
A PIA is a systemic assessment of a project that identifies the impact
that a project might have on the privacy of individuals, and sets out
recommendations for managing, minimising or eliminating that impact.[14]
The ABS informed the committee that PIAs are a standard part of the ABS'
project approval process ensuring that privacy concerns are embedded in the
design of new initiatives.[15]
4.15
As explained by the Australian Privacy Foundation:
A Privacy Impact Assessment, properly and independently
conducted, is [an]...essential and rigorous tool for discovering and
understanding the full range of information security, data protection and
privacy risks in a proposal; for enabling well-informed community, expert and
stakeholder input to aid that process; and for supporting transparency and
evidence-based analysis of the adequacy of the proposed remedies for those
risks.[16]
4.16
The PIA appears to have been the primary consultation mechanism used by
the ABS regarding the decision to retain names and addresses. On 11 November 2015,
the ABS issued a press release calling for submission by
2 December 2015 on a proposal to collect and retain names and
addresses as part of the 2016 census.[17]
4.17
The PIA found that retaining names and addresses has 'very low risks to
privacy, confidence and security'.[18]
The ABS announced its intention to retain names and addresses in a press
release on 18 December 2015.[19]
4.18
It was explained to the committee that the ABS made this decision
following a public consultation process and on the basis that independently run
focus group research indicated that 'support for the change and significant
public concern would be unlikely'.[20]
4.19
The ABS contend that the PIA was completed according to best practice:
The ABS sought advice from the Office of the Australian Information
Commission on the 2015 PIA, and followed their best practice guidelines issued
by that office.[21]
4.20
The committee heard several concerns regarding the conduct and outcome
of the PIA which are outlined below.
Consultation
4.21
The Office of the Australian Information Commissioner (OAIC) publishes a
guide to undertaking privacy impact assessments. One of the principal steps is
titled 'Identify and consult with stakeholders', and states:
Identify the project stakeholders. Consulting them can help
to identify new privacy risks and concerns, understand known risks better, and
develop strategies to mitigate all risks.[22]
4.22
The ABS consultation for the PIA consisted of a media release published
on the ABS website on 11 November directing attention to a 'Statement of Intent'
with respect to the PIA; discussions with 16 focus groups; and discussions with
State, Territory and Commonwealth Information or Privacy Commissioners.[23]
4.23
The PIA reported that feedback from focus group testing:
...indicated a general level of support for retaining names and
addresses, and the use of anonymised linkage keys for the purposes of ensuring
a higher accuracy in the linkage rate than is currently possible for joined up
datasets.
...
In working through examples, focus groups were generally comfortable
with the protections that the ABS would put in place to preserve privacy and
confidentiality on the proviso that the ABS be transparent about how it handles
people's personal information.[24]
4.24
The PIA was reported on by two news outlets, IT News and PS
News, and received three submissions from members of the public who 'all
raised concerns with the proposal'.[25]
The PIA does not say what these concerns were.
4.25
The Australian Privacy Foundation (APF) was clear in its position that
the ABS did not undertake a proper consultation process for the PIA, stating:
The consultation process by the ABS in relation to proposed
changes to the census was at best incompetent and at worst a sneaky attempt to
make serious changes without anyone noticing. The APF was not specifically
consulted about the proposed changes and we were completely unaware of the
consultation, as it seems were other interested NGOs.[26]
4.26
Digital Rights Watch (DRW) and others expressed concern that there was
insufficient public consultation, as later evidenced by community concern
regarding the changes.[27]
Former Australian Statistician Bill McLennan similarly expressed concerns
that insufficient consultations were conducted regarding the changes.[28]
4.27
The ABS received only three written submissions for the PIA. Some
submissions to this inquiry took this as evidence that there was insufficient
communication from the ABS regarding the proposed changes and the PIA.[29]
4.28
The PIA claims 'the ABS directly notified key internal and external
stakeholders of its proposal to retain names and addresses'.[30]
Internal ABS documents show that external stakeholders consisted of the
Australian Statistics Advisory Council, the Commonwealth Treasurer's office,
the Assistant Minister to the Treasurer, the Commonwealth Privacy Commissioner,
and state and territory privacy commissioners.[31]
4.29
Based on the information received by the committee, there is no evidence
that the ABS consulted with community groups, non-government organisations or
privacy advocacy groups.[32]
Privacy Impact Assessment completed
internally
4.30
There is no requirement for a PIA to be conducted by an external
organisation. The OAIC does note however, that some projects would benefit from
the use of external providers:
Some projects will have substantially more privacy impact
than others. A robust and independent PIA conducted by external assessors may
be preferable in those instances. This independent assessment may also help the
organisation to develop community trust in the PIA findings and the project's
intent.[33]
4.31
There were considerable differences of opinion regarding how significant
the privacy changes in the lead-up to the census were. The ABS' submission
argues that 'the proposed changes were an incremental change to existing
practice', whereas the APF posited that 'it is hard to think of an example of a
PIA that would be more important than the PIA for a Census.'[34]
The Castan Centre for Human Rights Law (CCHRL) similarly stated: 'Retaining information
that can be linked to Census records has significant privacy implications'.[35]
4.32
Indeed, the census affects all Australians, and even if the changes themselves
were relatively minor—a point not conceded by many—the cumulative privacy
impacts are inevitably large.
Inconsistencies compared with other
PIAs
4.33
Some submissions pointed out that there appeared to be inconsistencies
between the findings of PIAs conducted in 2005 and 2015, despite them covering
similar concerns.
4.34
The 2015 PIA concluded that:
In relation to the proposed retention of names and addresses
from responses to the 2016 Census, a small number of potential risks to
personal privacy and public perception of the ABS have been identified. This
Assessment concludes that in each case, the likelihood of the risks eventuating
is 'very low'. It also concludes that the ABS has implemented robust processes
to manage data and protect privacy, and that these arrangements effectively
mitigate these risks. Any residual risks are such that the ABS is capable of managing.[36]
4.35
In 2005, Pacific Privacy Consulting completed a PIA for the ABS
regarding a proposal to create a Statistical Longitudinal Census Dataset (SLCD)
that would use probabilistic data matching techniques, rather than names and
addresses, to link records.[37]
The SLCD would have been used to combine data from the 2006 census with future
census data to enhance the value of the dataset. The 2005 proposal would have
not resulted in names and addresses being retained for any longer than in
previous censuses.[38]
The 2005 PIA noted that although individual records would not be stored against
a name and address, successive censuses would increase the uniqueness of
records making identification a possibility.[39]
The PIA concluded:
[The] ABS would be unwise to place too great a reliance on
the limited use of names and addresses in the linkage proposals. What is
important from a functional privacy perspective is the ability to associate a
record with a particular known individual, whether or not the information
uniquely identifies that individual.[40]
4.36
The ABS appeared unable to explain why the results of the 2005 PIA were
significantly different from the 2015 PIA, noting only that:
The PIA undertaken in 2005 considered a proposal to create a
statistical longitudinal census dataset comprising 100 [per cent] of Census
records. The ABS took account of the outcome from the PIA and the public
consultation process and decided to link only a 5 [per cent] sample. The
Australian Census Longitudinal Dataset, as it is now called, will continue to
take the 5 [per cent] sample approach.[41]
4.37
Given the initial 2005 proposal to create a statistical longitudinal
data set using all of the census records sounds much the same as the 2016
proposal, this explanation is not entirely satisfactory. At a more general
level, the committee heard proposals to use personal identifiers to facilitate
linking census data had been proposed and rejected in both 2006 and 2011 on
privacy grounds.[42]
The ABS' power to collect statistical information
4.38
The powers of the ABS to collect information from the public are laid out
in the Australian Bureau of Statistics Act 1975 (ABS Act) and the Census
and Statistics Act 1905 (Census Act).
4.39
Section 6 of the ABS Act gives the ABS the authority to collect,
compile, analyse and disseminate statistics and related information. In addition,
the Census Act:
-
empowers the Australian Statistician to collect statistical
information on a broad range of demographic, economic, environmental and social
topics; and
-
enables the Australian Statistician to direct a person to provide
statistical information, in which case they are legally obliged to do so.[43]
4.40
The PIA conducted by the ABS argued that:
Names and addresses are among the matters in relation to
which the Statistician may collect information...[The] proposal to permanently
retain name and address information from responses to the 2016 Census does not
involve the collection of additional information than that collected in the
2011 Census.[44]
4.41
The ABS also has an obligation to comply with the Privacy Act 1988,
including the Australian Privacy Principles (Principles). The PIA explains the
relevance of the Principles to the retention of names and addresses:
In accordance with Australian Privacy Principle 3, the ABS
may collect personal information (such as name and address) where it is
reasonably necessary for, or directly related to, its functions or activities.
Australian Privacy Principle 11 provides that the ABS may retain the personal
information of an individual where that information continues to meet a
business need that is aligned with the purpose for which the information was
collected.[45]
4.42
In Johns v Australian Securities Commission (1993) 116 ALR 56,
the High Court held that if someone compulsorily obtains information using
a statutory power, they must only use or disclose that information for the
purposes set out in, or implied by, the statute.
4.43
Some submissions queried whether the ABS has the power to collect names
and addresses for uses other than ensuring a complete census count.[46]
Are names statistical information
4.44
The ABS has the power to collect 'statistical information'. A number of
submissions queried whether or not names and addresses constitute statistical
information, and therefore whether the ABS has the authority to compel their
production.[47]
4.45
'Statistical information' is not defined in legislation, but section 12
of the Census Act provides that:
The Statistician shall compile and analyse the statistical
information collected under this Act and shall publish and disseminate the
results of any such compilation and analysis, or abstracts of this result.[48]
4.46
A number of stakoholders argued that statistical information is
information that is collected, compiled and published.[49]
For example, CCHRL submitted:
This suggests that information that is 'statistical
information' is information that will be 'compiled'—assembled in order to be
'analysed'—examined in the aggregate—for the purpose of publishing and
disseminating the results.[50]
4.47
This view was echoed by former Australian Statistician Bill McLennan who
explained:
What it says in the act is that, if you collect the
information, you then have to compile statistics and publish them. The bureau
is about collecting, compiling and publishing statistics—that is its job in a
nutshell and it always has been. The act, as it is currently written, states that
that has to happen, so you start collecting names, then say to yourself: how am
I going to compile statistics about names?
...
Obviously, under collecting names in the census, we are not
doing anything in this last census to collate statistics and therefore we are
not publishing them. The act says: the ABS shall collate and the ABS shall
publish.[51]
4.48
The ABS argued that names and addresses are statistical information that
has been compulsorily collected for over 100 years, writing:
The Census of Population and Housing has collected names and
addresses on a compulsory basis since 1911. The ABS considers names and
addresses as statistical information that can be lawfully collected and used
for statistical purposes. They are an essential part of the Census statistical
process and have been for over 100 years.[52]
4.49
It was suggested that name and address information be collected on an
optional basis, much the same as is done for religion.[53]
This approach would mimic the compromise reached with the retention of name and
address information in the national archive, where households are given the
choice—and therefore some control—over how their information is used.
Was parliament properly informed of
the change
4.50
Under section 6(3) of the Australian Bureau of Statistics Act 1975,
the ABS must lay before both houses of Parliament 'each new proposal for the
collection of information for statistical purposes' before its implementation.[54]
4.51
The committee was informed that:
[This] provision was added as an amendment to the Australian
Bureau of Statistics Bill with the express intention of giving Parliament the
opportunity to review, and if necessary, intervene to alter or even halt
proposed collections of information for statistical purposes in instances where
the proposed collection would be on a compulsory basis.[55]
4.52
The ABS tabled in the Senate 'Proposal No. 6 of 2016: 2016 Census of
Population and Housing and Post Enumeration Survey' (Proposal) on 17 March 2016.[56]
The Proposal made no mention of names and addresses being retained, nor did it
mention that this represents a break from past censuses. The ABS appears to
have been firmly of the belief that the changes around name and address
information were an incremental change that did not require parliamentary
oversight.
Arguments against the retention of name and address information
4.53
As well as the specific process orientated concerns discussed above, the
committee heard a number of arguments against the retention of name and address
information. These included a loss of trust in the ABS and the potential for
lower quality responses threatening the reliability of collected data, the
threat to privacy by the existence of the census data set, and the unknown uses
to which the data may be put.
Loss of trust in ABS
4.54
It was argued to the committee that the destruction of name and address
information is central to the willingness of individuals to give up their
personal information to help society distribute goods and services equitably:
There is an implicit social compact underpinning the Census:
give us our anonymity and privacy, and every five years we will give you the
data you want, in the form of a national, anonymous snapshot, to be used for
planning, policy and research purposes. We will answer all those questions,
truthfully, because we have been promised that our answers will never actually
be linked back to us.[57]
4.55
The CCHRL argued that the decision to retain names and addresses is a
threat to privacy:
We are concerned that the use of census data and data
linkages across government agencies leads us into 'a system requiring personal
information under compulsion of law where the system has increasingly powerful
capacity to store, sort, match and predict' individual behaviour...Such a system,
even if authorised by law, itself represents a fundamental breach of people's
rights to privacy.[58]
4.56
The APF argued that the changes introduced in the 2016 census have
harmed the reputation of the ABS in the community:
Before the 2016 census the Australian public generally
trusted the ABS. This is no longer true for many Australians. That trust was destroyed by the ABS when it changed the
purpose of the census from aggregated statistical data to personal tracking. It
still remains unclear what the ABS plans to do with the personal information it
has collected.[59]
4.57
The committee heard that the willingness of the community to engage in
statistical projects is proportionate to the trust the community has in that
organisation. If respondents do not trust that their information is safe they
are less likely to honestly participate in the activity.[60]
4.58
Electronic Frontiers Australia argued that the changes to the 2016 census
may represent an ongoing threat to future Censuses:
The apparently significant erosion of public trust resulting
from the manner in which the 2016 Census has been implemented represents a
serious threat to both the integrity of the data collected in the 2016 Census
and to all future Censuses.[61]
4.59
It was put to the committee that while the ABS was a widely trusted
organisation, it is necessary that the ABS continues to engage with
stakeholders to assuage 'actual or perceived' risks in completing the census to
ensure ongoing high data quality.[62]
4.60
The ABS recognises the importance of community trust in completing its
work, with the ABS' Corporate Plan citing trust as one of the essential
components of its success.[63]
The ABS argues that it enjoys high levels of community support:
An independent survey in 2015 found that institutional trust was high among general community respondents
with 81 [per cent] indicating that they either trust
greatly or tend to trust the ABS. Among the
informed users of ABS products, the level of trust
rose to 100 [per cent]. These are very high trust
ratings for an organisation, and higher than comparable surveys of statistical
organisations in other countries.[64]
4.61
Although the final census results will not be ready for some time, the
committee was informed that initial quality checks conducted by the ABS 'show
low levels of item non-response to the known sensitive questions'.[65]
The ABS further reports a preliminary response rate in excess of 96 per cent,
indicating that the concerns relating to the 2016 census did not tamper
community enthusiasm for statistical participation.[66]
Function creep
4.62
The committee heard concerns regarding function creep where data
collected for one purpose is later used for another. One of the key questions
that anyone naturally has when asked to provide information, is the use to
which that information will be put. This report has already canvassed some of
the uses to which census data is put, including determining electoral
boundaries, determining areas in need of greater public services, and tracking
changes in demographics. A number of submissions queried how the enhanced
dataset would be used by the ABS and government.
4.63
Australia has no privacy protections written into the Constitution. This
means that there is no way the government can guarantee that the current and
proposed legislative controls will remain indefinitely. Current protections
might be robust, but there is no guarantee this will continue.
4.64
There are examples from Australia's past where governments have put short-term administrative need ahead of principle. Prior to the World War II,
the then Tax Commissioner attempted to access census data for the purposes of a
court action against a taxpayer. In that instance the Australian Statistician
had, in the meantime, destroyed the name identified census card thereby
preventing the use of this data. Although the legislative loophole that enabled
the Tax Commissioner to make this claim has since been closed, it does highlight
how data collected for one purpose at one point in time is often threatened
with repurposing.[67]
4.65
Even if consent is given initially to collect and use the data, we have
no way to ensure that someone consents to that data being put to different
uses.[68]
Salinger Privacy expressed concerns relating to the potential uses of the census
dataset:
It is my opinion that the risk of function
creep was under-estimated by the ABS. Once they hold identifiable data
on all 24 million people in Australia, I cannot believe that not a single
government department, Minister or police force will be interested in tapping
into that data for their own, non-research purposes. A list of the agencies
queueing up to gain access to the metadata that telecommunications companies must
now keep by law provides a salient example of the likelihood of function creep.[69]
4.66
The committee heard that concerns regarding function creep featured
prominently in the findings of the 2005 PIA, and were also cited by the ABS in
a submission to the 1997 'Parliamentary Inquiry into the Treatment of Census
Forms' in which the ABS recommended against the retention of identified census
data.[70]
4.67
The PIA prepared by the ABS relating to the retention of name and
address data considered the possibility of function creep which it defined as:
'name and address information from the 2016 Census may be used for purposes
beyond what is currently contemplated by the ABS'.[71]
The ABS assessed the likelihood as 'very low', and would mitigate against the
risk by ensuring that 'any data integration project involving retained
information is undertaken for statistical and research purposes only'.[72]
Linking to administrative datasets
4.68
A further criticism of the ABS' handling of the decision to retain name
and address information was the lack of clarity regarding how this data would
be used in linking datasets. Legal academic Dr Cassandra Cross argued that
linked data sets represent a growing threat to individual privacy:
The linking of Census data to these other administrative data
sets has the ability to paint a detailed picture of individuals and in and of
itself, poses challenges to the privacy and anonymity of those subjected to it.[73]
4.69
Assistant Professor Kate Galloway similarly argued that the linkage of
compulsorily acquired data under the census to other data sets itself represents
'an increase in scope of the census' and an erosion of individual privacy.[74]
4.70
The committee also heard views in support of linking census data with
other data sets. Dr Liz Allen from the Australian National University
(ANU) argued that many countries have been using statistically linked census
data for decades, and that:
The benefits of data linkage outweigh any potential harm
which may be associated with the statistical undertaking. An example of the
power of Census linkage is the methodological work by the ABS estimating
Aboriginal and Torres Strait Islander life expectancy.[75]
4.71
The committee similarly heard support for data linkages from the ANU
School of Demography:
Our second point is that the linkage of census data and other
sources synergistically increases their value, and we would like to see more
linkage in Australia. We provide an example to illustrate this point. Census
data are necessary to provide the denominators for many indices, including
demographic rates and many health measures. Without data linkage, the
numerators and denominators, for example, to calculate the mortality from
registered deaths and population numbers can only be aligned by reference to
geographic area. Any additional information on the characteristics, such as the
socioeconomic status, is assumed on the basis of the average socioeconomic
status of people living in the area. In other words, the mortality of the
individual is not directly linked to the socioeconomic status of the
individual.[76]
4.72
It may be that at this point the ABS itself has not fully decided upon
the scale of potential data linkages. Internal ABS documents from 2015 discuss
some of the potential applications of improved statistical linkages:
ABS data integration activities can be expected to expand
significantly in the coming years as ABS gains access to additional key
nationally important administrative datasets. Maximising the utility of these
datasets, as well as of the Census and survey datasets, will result from the
ability to conduct multiple high quality linkage projects, through linking
multiple administrative datasets, linking administrative datasets to surveys
and/or the Census, and linking the Census to surveys. Name and address
information has the potential to markedly improve the quality of data linkage.
...
Statistical data integration offers the potential to produce
new data products, as well as enrich existing data products. There are many
administrative datasets that are likely to have considerable statistical value.
In addition to the Personal Income tax data which has already been used in data
integration projects, future data integration projects could include the use of
FaHCSIA welfare payments data, Centrelink unemployment benefits data, Medicare
and Pharmaceutical Benefits Scheme data, Australian Immunisation Register, the
AEC electoral role, and other nationally important datasets.[77]
4.73
The ABS informed the committee that there currently exists strong demand
for the delivery of greater statistical information on: the nature, extent and
outcomes of industrial changes that are taking place in the economy; changes in
in the community as the population ages and work and family patterns change;
the education and health interventions most likely to produce outcomes; and the
outcomes of government programs and services.[78]
4.74
The ABS reported to the committee that there was 'strong community
support for high quality data linkage'.[79]
Committee view
4.75
The committee is of the view that overturning the long-standing practice
of destroying name and address data collected through the census is a
significant change that warranted significantly more public consultation and external
scrutiny than it received.
4.76
It is apparent to the committee that level of consultation undertaken by
the ABS in the lead-up to this decision was manifestly inadequate, especially
considering the changes affect every Australian household. At a minimum, the
PIA should have been conducted by an independent body. This is especially so
considering that the ABS Executive Leadership Group was aware that within the
organisation there was a 'widely held view' that the practice of destroying
name and address was a barrier to meeting organisational objectives.[80]
4.77
As discussed in chapter 2, previous privacy concerns regarding the
census had resulted in reduced community participation in the census. We may
live in an age where more and more personal data is voluntarily shared
electronically, but we also cannot assume that Australians do not take their privacy
seriously.
4.78
Based on the evidence received, the committee remains confident that the
ABS is committed to using census data for the purpose for which it was
collected. In weighing the prospect of any future function creep, the committee
notes the ABS' strong track record of protecting personal information privacy.
This can give Australian's confidence that the data collected through the
census will be used for improving public services and the ability of
governments to meet the needs of the Australian population.
4.79
Although the ABS has repeatedly declined to provide the legal advice
received from the Australian Government Solicitor to the Senate—presumably
confirming its authority to collect, retain and use names and addresses—the
committee is not convinced that the ABS has acted beyond its powers, although
some submissions expressed contrary views. The move to change how names and
addresses are used is not insignificant however, as evidenced by the completion
of a PIA in 2015, as well as similar investigations into the merits of such a
scheme over the preceding decade.
4.80
As such, the committee is in agreement that all future PIAs relating to
the census need to be undertaken by a suitably qualified external body and that
the outcomes of this assessment are made publically available on the ABS
website well in advance of any census. In addition, the committee is cognisant
of the great work the ABS undertakes but is also aware of the significant
negative impact the 2016 census has had on the ABS reputation. Once a new PIA
is completed, the ABS should undertake extensive public consultations regarding
any future changes or impact a new census might have in order to adequately
inform the Australian public and its parliament, but also to re-establish its
public credibility.
Recommendation 1
4.81
The committee recommends that all future Privacy Impact Assessments
relating to the census, are conducted externally with the final report
published on the ABS website 12 months in advance of the census to which it
relates.
4.82
Following the release of a PIA recommending changes to future censuses,
consultation across the Australian community should be undertaken by the ABS with
the outcomes clearly documented on the ABS website no less than six months
before a future census.
Recommendation 2
4.83
The committee recommends that the ABS update its internal guidelines to
make clear that consultation requires active engagement with the non-government
and private sector.
Navigation: Previous Page | Contents | Next Page