Chapter 4

Say my name, [save] my name...

The citizen's right to privacy, in contrast with the needs of government and the people for good information on all Australians, has been a fundamental issue for the Bureau since it was established. Part of the difficulty lies in the fact that what is acceptable to ask, changes over time with the evolution of attitudes in society.[1]

4.1        Privacy concerns have been a regular feature of censuses, as discussed in chapter 2. One of the most contentious elements of the 2016 census was the decision by the ABS to retain the names and addresses of respondents for up to four years to increase the value that could be extracted from the census data. Name and address information has always been collected as part of the census for the purpose of ensuring that the count was accurate and complete. After the data was processed, the name and address information was then destroyed, typically within 12 to 18 months.[2]

4.2        This chapter considers this decision by the ABS in the following way:

4.3        The following chapter will continue on a similar theme, but will focus on the storage, security and use of name and address data. Chapter 6 will discuss the events that took place on 9 August.

4.4        During the discussion leading up to the census, there was some confusion regarding the difference between privacy and secrecy. Former Australian Statistician Bill McLennan explained: 'Privacy is not secrecy. It is about giving individuals control over how their personal information is handled'.[3] Secrecy can be considered as determining who has access to information, whereas privacy is determining whom we provide information. This chapter considers privacy concerns, the following will focus on matters of information security.

4.5        Many submissions levelled criticisms at the ABS over its conduct leading up to the decision to retain names and addresses, including allegations that it did not consult properly, that it was insufficiently open regarding the impact of the changes, and that the Privacy Impact Assessment (PIA) was insufficiently robust for a change affecting data collected compulsorily from every household in Australia.

Retention of names and addresses

4.6        The 2016 census was new in that it proposed to retain name and address information collected as part of the census for the purpose of increasing the uses of the collected data, rather than only for data integrity. As the ABS reported:

With the changes to retention of names and addresses, the ABS will be able to produce more policy relevant statistics on aspects such as industrial change in Australia, the performance of health and education services, and key determinants of changes in local communities and households over time. These new statistics will help governments and Parliaments make more informed policy choices over coming years.[4]

4.7        As noted in chapter 2, name and address information from previous censuses have been destroyed following processing in accordance with ABS policy in relation to retention of personal identifiers. The policy states:

It is ABS policy that name, address and other identifiers of individuals must be deleted from collected survey and administrative files as soon as practical after processing, unless there is a business need approved by the Australian Statistician.[5]

4.8        The ABS proposed that by combining census data with other administrative datasets, a more granular picture of Australia would emerge:

[The] use of statistical data integration techniques to bring together Census data with other survey and administrative data would enable the ABS to meet the growing demand of policy agencies (e.g. Department of Social Services, Department of Health), service providers and the research community for higher quality 'joined-up' information to better inform planning decisions and government policies in the public good. In particular, the use of names and addresses to improve the quality and accuracy of linked information, would enhance the ability of policy makers and researchers to effectively measure changes over time or differences between population sub groups or regions.[6]

4.9        In August 2015—four years after preparations for the census had begun—the ABS published the 'Census of Population and Housing: Nature and Content, Australia, 2016' which foreshadowed the ABS was considering the retention of both names and addresses for statistical purposes.[7]  In October 2015, the ABS published 'Information Paper: Census of Population and Housing–Proposed Products and Services, 2016' which highlighted that data integration across datasets would be a central element of the census.[8] This was followed up in November 2015 with notification of a statement of intent to conduct a PIA regarding the decision to collect names and addresses.

4.10      Documents provided to the committee show that within the ABS, the move to retain names and addresses was not considered controversial:

The proposed changes were an incremental change to existing practice in the widely publicised Census Data Enhancement program undertaken with the 2006 and 2011 Censuses.[9]

4.11      There appears to have been a belief within the ABS that destroying name and address information was preventing the organisation from meeting its objectives:

There is a widely held view within ABS that continuing to operate under such restrictions [destroying name and address information] will be a significant barrier in meeting both statistical and operational aspirations.[10]

4.12      Following the conclusion of an internally conducted PIA in December 2015 regarding the retention of names and addresses, the ABS announced that names and addresses would be retained until there was no longer any community benefit to their retention.[11]

4.13      Following concerns raised in the media and online regarding the impact of retaining names and addresses indefinitely, the ABS announced in April 2016 that this information would be retained for a period of no more than four years before being destroyed.[12] The ABS informed the committee that:

This decision was considered by the ABS to provide a balance between the use of Census data and the extensive privacy protections in place for the 2016 Census.[13]

Privacy Impact Assessment 2015

4.14      A PIA is a systemic assessment of a project that identifies the impact that a project might have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating that impact.[14] The ABS informed the committee that PIAs are a standard part of the ABS' project approval process ensuring that privacy concerns are embedded in the design of new initiatives.[15]

4.15      As explained by the Australian Privacy Foundation:

A Privacy Impact Assessment, properly and independently conducted, is [an]...essential and rigorous tool for discovering and understanding the full range of information security, data protection and privacy risks in a proposal; for enabling well-informed community, expert and stakeholder input to aid that process; and for supporting transparency and evidence-based analysis of the adequacy of the proposed remedies for those risks.[16]

4.16      The PIA appears to have been the primary consultation mechanism used by the ABS regarding the decision to retain names and addresses. On 11 November 2015, the ABS issued a press release calling for submission by 2 December 2015 on a proposal to collect and retain names and addresses as part of the 2016 census.[17]

4.17      The PIA found that retaining names and addresses has 'very low risks to privacy, confidence and security'.[18] The ABS announced its intention to retain names and addresses in a press release on 18 December 2015.[19]

4.18      It was explained to the committee that the ABS made this decision following a public consultation process and on the basis that independently run focus group research indicated that 'support for the change and significant public concern would be unlikely'.[20]

4.19      The ABS contend that the PIA was completed according to best practice:

The ABS sought advice from the Office of the Australian Information Commission on the 2015 PIA, and followed their best practice guidelines issued by that office.[21]

4.20      The committee heard several concerns regarding the conduct and outcome of the PIA which are outlined below.

Consultation

4.21      The Office of the Australian Information Commissioner (OAIC) publishes a guide to undertaking privacy impact assessments. One of the principal steps is titled 'Identify and consult with stakeholders', and states:

Identify the project stakeholders. Consulting them can help to identify new privacy risks and concerns, understand known risks better, and develop strategies to mitigate all risks.[22]

4.22      The ABS consultation for the PIA consisted of a media release published on the ABS website on 11 November directing attention to a 'Statement of Intent' with respect to the PIA; discussions with 16 focus groups; and discussions with State, Territory and Commonwealth Information or Privacy Commissioners.[23]

4.23      The PIA reported that feedback from focus group testing:

...indicated a general level of support for retaining names and addresses, and the use of anonymised linkage keys for the purposes of ensuring a higher accuracy in the linkage rate than is currently possible for joined up datasets.

...

In working through examples, focus groups were generally comfortable with the protections that the ABS would put in place to preserve privacy and confidentiality on the proviso that the ABS be transparent about how it handles people's personal information.[24]

4.24      The PIA was reported on by two news outlets, IT News and PS News, and received three submissions from members of the public who 'all raised concerns with the proposal'.[25] The PIA does not say what these concerns were.

4.25      The Australian Privacy Foundation (APF) was clear in its position that the ABS did not undertake a proper consultation process for the PIA, stating:

The consultation process by the ABS in relation to proposed changes to the census was at best incompetent and at worst a sneaky attempt to make serious changes without anyone noticing. The APF was not specifically consulted about the proposed changes and we were completely unaware of the consultation, as it seems were other interested NGOs.[26]

4.26      Digital Rights Watch (DRW) and others expressed concern that there was insufficient public consultation, as later evidenced by community concern regarding the changes.[27] Former Australian Statistician Bill McLennan similarly expressed concerns that insufficient consultations were conducted regarding the changes.[28]

4.27      The ABS received only three written submissions for the PIA. Some submissions to this inquiry took this as evidence that there was insufficient communication from the ABS regarding the proposed changes and the PIA.[29]

4.28      The PIA claims 'the ABS directly notified key internal and external stakeholders of its proposal to retain names and addresses'.[30] Internal ABS documents show that external stakeholders consisted of the Australian Statistics Advisory Council, the Commonwealth Treasurer's office, the Assistant Minister to the Treasurer, the Commonwealth Privacy Commissioner, and state and territory privacy commissioners.[31]

4.29      Based on the information received by the committee, there is no evidence that the ABS consulted with community groups, non-government organisations or privacy advocacy groups.[32]

Privacy Impact Assessment completed internally

4.30      There is no requirement for a PIA to be conducted by an external organisation. The OAIC does note however, that some projects would benefit from the use of external providers:

Some projects will have substantially more privacy impact than others. A robust and independent PIA conducted by external assessors may be preferable in those instances. This independent assessment may also help the organisation to develop community trust in the PIA findings and the project's intent.[33]

4.31      There were considerable differences of opinion regarding how significant the privacy changes in the lead-up to the census were. The ABS' submission argues that 'the proposed changes were an incremental change to existing practice', whereas the APF posited that 'it is hard to think of an example of a PIA that would be more important than the PIA for a Census.'[34] The Castan Centre for Human Rights Law (CCHRL) similarly stated: 'Retaining information that can be linked to Census records has significant privacy implications'.[35]

4.32      Indeed, the census affects all Australians, and even if the changes themselves were relatively minor—a point not conceded by many—the cumulative privacy impacts are inevitably large.

Inconsistencies compared with other PIAs

4.33      Some submissions pointed out that there appeared to be inconsistencies between the findings of PIAs conducted in 2005 and 2015, despite them covering similar concerns.

4.34      The 2015 PIA concluded that:

In relation to the proposed retention of names and addresses from responses to the 2016 Census, a small number of potential risks to personal privacy and public perception of the ABS have been identified. This Assessment concludes that in each case, the likelihood of the risks eventuating is 'very low'. It also concludes that the ABS has implemented robust processes to manage data and protect privacy, and that these arrangements effectively mitigate these risks. Any residual risks are such that the ABS is capable of managing.[36] 

4.35      In 2005, Pacific Privacy Consulting completed a PIA for the ABS regarding a proposal to create a Statistical Longitudinal Census Dataset (SLCD) that would use probabilistic data matching techniques, rather than names and addresses, to link records.[37] The SLCD would have been used to combine data from the 2006 census with future census data to enhance the value of the dataset. The 2005 proposal would have not resulted in names and addresses being retained for any longer than in previous censuses.[38] The 2005 PIA noted that although individual records would not be stored against a name and address, successive censuses would increase the uniqueness of records making identification a possibility.[39] The PIA concluded:

[The] ABS would be unwise to place too great a reliance on the limited use of names and addresses in the linkage proposals. What is important from a functional privacy perspective is the ability to associate a record with a particular known individual, whether or not the information uniquely identifies that individual.[40]

4.36      The ABS appeared unable to explain why the results of the 2005 PIA were significantly different from the 2015 PIA, noting only that:

The PIA undertaken in 2005 considered a proposal to create a statistical longitudinal census dataset comprising 100 [per cent] of Census records. The ABS took account of the outcome from the PIA and the public consultation process and decided to link only a 5 [per cent] sample. The Australian Census Longitudinal Dataset, as it is now called, will continue to take the 5 [per cent] sample approach.[41]

4.37      Given the initial 2005 proposal to create a statistical longitudinal data set using all of the census records sounds much the same as the 2016 proposal, this explanation is not entirely satisfactory. At a more general level, the committee heard proposals to use personal identifiers to facilitate linking census data had been proposed and rejected in both 2006 and 2011 on privacy grounds.[42]

The ABS' power to collect statistical information

4.38      The powers of the ABS to collect information from the public are laid out in the Australian Bureau of Statistics Act 1975 (ABS Act) and the Census and Statistics Act 1905 (Census Act).

4.39      Section 6 of the ABS Act gives the ABS the authority to collect, compile, analyse and disseminate statistics and related information. In addition, the Census Act:

4.40      The PIA conducted by the ABS argued that:

Names and addresses are among the matters in relation to which the Statistician may collect information...[The] proposal to permanently retain name and address information from responses to the 2016 Census does not involve the collection of additional information than that collected in the 2011 Census.[44]

4.41      The ABS also has an obligation to comply with the Privacy Act 1988, including the Australian Privacy Principles (Principles). The PIA explains the relevance of the Principles to the retention of names and addresses:

In accordance with Australian Privacy Principle 3, the ABS may collect personal information (such as name and address) where it is reasonably necessary for, or directly related to, its functions or activities. Australian Privacy Principle 11 provides that the ABS may retain the personal information of an individual where that information continues to meet a business need that is aligned with the purpose for which the information was collected.[45]

4.42      In Johns v Australian Securities Commission (1993) 116 ALR 56, the High Court held that if someone compulsorily obtains information using a statutory power, they must only use or disclose that information for the purposes set out in, or implied by, the statute.

4.43      Some submissions queried whether the ABS has the power to collect names and addresses for uses other than ensuring a complete census count.[46]

Are names statistical information

4.44      The ABS has the power to collect 'statistical information'. A number of submissions queried whether or not names and addresses constitute statistical information, and therefore whether the ABS has the authority to compel their production.[47]

4.45      'Statistical information' is not defined in legislation, but section 12 of the Census Act provides that:

The Statistician shall compile and analyse the statistical information collected under this Act and shall publish and disseminate the results of any such compilation and analysis, or abstracts of this result.[48]

4.46      A number of stakoholders argued that statistical information is information that is collected, compiled and published.[49] For example, CCHRL submitted:

This suggests that information that is 'statistical information' is information that will be 'compiled'—assembled in order to be 'analysed'—examined in the aggregate—for the purpose of publishing and disseminating the results.[50]

4.47      This view was echoed by former Australian Statistician Bill McLennan who explained:

What it says in the act is that, if you collect the information, you then have to compile statistics and publish them. The bureau is about collecting, compiling and publishing statistics—that is its job in a nutshell and it always has been. The act, as it is currently written, states that that has to happen, so you start collecting names, then say to yourself: how am I going to compile statistics about names?

...

Obviously, under collecting names in the census, we are not doing anything in this last census to collate statistics and therefore we are not publishing them. The act says: the ABS shall collate and the ABS shall publish.[51]

4.48      The ABS argued that names and addresses are statistical information that has been compulsorily collected for over 100 years, writing:

The Census of Population and Housing has collected names and addresses on a compulsory basis since 1911. The ABS considers names and addresses as statistical information that can be lawfully collected and used for statistical purposes. They are an essential part of the Census statistical process and have been for over 100 years.[52]

4.49      It was suggested that name and address information be collected on an optional basis, much the same as is done for religion.[53] This approach would mimic the compromise reached with the retention of name and address information in the national archive, where households are given the choice—and therefore some control—over how their information is used.

Was parliament properly informed of the change

4.50      Under section 6(3) of the Australian Bureau of Statistics Act 1975, the ABS must lay before both houses of Parliament 'each new proposal for the collection of information for statistical purposes' before its implementation.[54]

4.51      The committee was informed that:

[This] provision was added as an amendment to the Australian Bureau of Statistics Bill with the express intention of giving Parliament the opportunity to review, and if necessary, intervene to alter or even halt proposed collections of information for statistical purposes in instances where the proposed collection would be on a compulsory basis.[55]

4.52      The ABS tabled in the Senate 'Proposal No. 6 of 2016: 2016 Census of Population and Housing and Post Enumeration Survey' (Proposal) on 17 March 2016.[56] The Proposal made no mention of names and addresses being retained, nor did it mention that this represents a break from past censuses. The ABS appears to have been firmly of the belief that the changes around name and address information were an incremental change that did not require parliamentary oversight.   

Arguments against the retention of name and address information

4.53      As well as the specific process orientated concerns discussed above, the committee heard a number of arguments against the retention of name and address information. These included a loss of trust in the ABS and the potential for lower quality responses threatening the reliability of collected data, the threat to privacy by the existence of the census data set, and the unknown uses to which the data may be put.

Loss of trust in ABS

4.54      It was argued to the committee that the destruction of name and address information is central to the willingness of individuals to give up their personal information to help society distribute goods and services equitably:

There is an implicit social compact underpinning the Census: give us our anonymity and privacy, and every five years we will give you the data you want, in the form of a national, anonymous snapshot, to be used for planning, policy and research purposes. We will answer all those questions, truthfully, because we have been promised that our answers will never actually be linked back to us.[57]

4.55      The CCHRL argued that the decision to retain names and addresses is a threat to privacy:

We are concerned that the use of census data and data linkages across government agencies leads us into 'a system requiring personal information under compulsion of law where the system has increasingly powerful capacity to store, sort, match and predict' individual behaviour...Such a system, even if authorised by law, itself represents a fundamental breach of people's rights to privacy.[58]

4.56      The APF argued that the changes introduced in the 2016 census have harmed the reputation of the ABS in the community:

Before the 2016 census the Australian public generally trusted the ABS. This is no longer true for many Australians. That trust was destroyed by the ABS when it changed the purpose of the census from aggregated statistical data to personal tracking. It still remains unclear what the ABS plans to do with the personal information it has collected.[59]

4.57      The committee heard that the willingness of the community to engage in statistical projects is proportionate to the trust the community has in that organisation. If respondents do not trust that their information is safe they are less likely to honestly participate in the activity.[60]

4.58      Electronic Frontiers Australia argued that the changes to the 2016 census may represent an ongoing threat to future Censuses:

The apparently significant erosion of public trust resulting from the manner in which the 2016 Census has been implemented represents a serious threat to both the integrity of the data collected in the 2016 Census and to all future Censuses.[61]

4.59      It was put to the committee that while the ABS was a widely trusted organisation, it is necessary that the ABS continues to engage with stakeholders to assuage 'actual or perceived' risks in completing the census to ensure ongoing high data quality.[62]

4.60      The ABS recognises the importance of community trust in completing its work, with the ABS' Corporate Plan citing trust as one of the essential components of its success.[63] The ABS argues that it enjoys high levels of community support:

An independent survey in 2015 found that institutional trust was high among general community respondents with 81 [per cent] indicating that they either trust greatly or tend to trust the ABS. Among the informed users of ABS products, the level of trust rose to 100 [per cent]. These are very high trust ratings for an organisation, and higher than comparable surveys of statistical organisations in other countries.[64]

4.61      Although the final census results will not be ready for some time, the committee was informed that initial quality checks conducted by the ABS 'show low levels of item non-response to the known sensitive questions'.[65] The ABS further reports a preliminary response rate in excess of 96 per cent, indicating that the concerns relating to the 2016 census did not tamper community enthusiasm for statistical participation.[66]

Function creep

4.62      The committee heard concerns regarding function creep where data collected for one purpose is later used for another. One of the key questions that anyone naturally has when asked to provide information, is the use to which that information will be put. This report has already canvassed some of the uses to which census data is put, including determining electoral boundaries, determining areas in need of greater public services, and tracking changes in demographics. A number of submissions queried how the enhanced dataset would be used by the ABS and government.

4.63      Australia has no privacy protections written into the Constitution. This means that there is no way the government can guarantee that the current and proposed legislative controls will remain indefinitely. Current protections might be robust, but there is no guarantee this will continue.

4.64      There are examples from Australia's past where governments have put short-term administrative need ahead of principle. Prior to the World War II, the then Tax Commissioner attempted to access census data for the purposes of a court action against a taxpayer. In that instance the Australian Statistician had, in the meantime, destroyed the name identified census card thereby preventing the use of this data. Although the legislative loophole that enabled the Tax Commissioner to make this claim has since been closed, it does highlight how data collected for one purpose at one point in time is often threatened with repurposing.[67]

4.65      Even if consent is given initially to collect and use the data, we have no way to ensure that someone consents to that data being put to different uses.[68] Salinger Privacy expressed concerns relating to the potential uses of the census dataset:

It is my opinion that the risk of function creep was under-estimated by the ABS. Once they hold identifiable data on all 24 million people in Australia, I cannot believe that not a single government department, Minister or police force will be interested in tapping into that data for their own, non-research purposes. A list of the agencies queueing up to gain access to the metadata that telecommunications companies must now keep by law provides a salient example of the likelihood of function creep.[69]

4.66      The committee heard that concerns regarding function creep featured prominently in the findings of the 2005 PIA, and were also cited by the ABS in a submission to the 1997 'Parliamentary Inquiry into the Treatment of Census Forms' in which the ABS recommended against the retention of identified census data.[70]

4.67      The PIA prepared by the ABS relating to the retention of name and address data considered the possibility of function creep which it defined as: 'name and address information from the 2016 Census may be used for purposes beyond what is currently contemplated by the ABS'.[71] The ABS assessed the likelihood as 'very low', and would mitigate against the risk by ensuring that 'any data integration project involving retained information is undertaken for statistical and research purposes only'.[72]

Linking to administrative datasets

4.68      A further criticism of the ABS' handling of the decision to retain name and address information was the lack of clarity regarding how this data would be used in linking datasets. Legal academic Dr Cassandra Cross argued that linked data sets represent a growing threat to individual privacy:

The linking of Census data to these other administrative data sets has the ability to paint a detailed picture of individuals and in and of itself, poses challenges to the privacy and anonymity of those subjected to it.[73]

4.69      Assistant Professor Kate Galloway similarly argued that the linkage of compulsorily acquired data under the census to other data sets itself represents 'an increase in scope of the census' and an erosion of individual privacy.[74]

4.70      The committee also heard views in support of linking census data with other data sets. Dr Liz Allen from the Australian National University (ANU) argued that many countries have been using statistically linked census data for decades, and that:

The benefits of data linkage outweigh any potential harm which may be associated with the statistical undertaking. An example of the power of Census linkage is the methodological work by the ABS estimating Aboriginal and Torres Strait Islander life expectancy.[75]

4.71      The committee similarly heard support for data linkages from the ANU School of Demography:

Our second point is that the linkage of census data and other sources synergistically increases their value, and we would like to see more linkage in Australia. We provide an example to illustrate this point. Census data are necessary to provide the denominators for many indices, including demographic rates and many health measures. Without data linkage, the numerators and denominators, for example, to calculate the mortality from registered deaths and population numbers can only be aligned by reference to geographic area. Any additional information on the characteristics, such as the socioeconomic status, is assumed on the basis of the average socioeconomic status of people living in the area. In other words, the mortality of the individual is not directly linked to the socioeconomic status of the individual.[76]

4.72      It may be that at this point the ABS itself has not fully decided upon the scale of potential data linkages. Internal ABS documents from 2015 discuss some of the potential applications of improved statistical linkages:

ABS data integration activities can be expected to expand significantly in the coming years as ABS gains access to additional key nationally important administrative datasets. Maximising the utility of these datasets, as well as of the Census and survey datasets, will result from the ability to conduct multiple high quality linkage projects, through linking multiple administrative datasets, linking administrative datasets to surveys and/or the Census, and linking the Census to surveys. Name and address information has the potential to markedly improve the quality of data linkage.

...

Statistical data integration offers the potential to produce new data products, as well as enrich existing data products. There are many administrative datasets that are likely to have considerable statistical value. In addition to the Personal Income tax data which has already been used in data integration projects, future data integration projects could include the use of FaHCSIA welfare payments data, Centrelink unemployment benefits data, Medicare and Pharmaceutical Benefits Scheme data, Australian Immunisation Register, the AEC electoral role, and other nationally important datasets.[77]

4.73      The ABS informed the committee that there currently exists strong demand for the delivery of greater statistical information on: the nature, extent and outcomes of industrial changes that are taking place in the economy; changes in in the community as the population ages and work and family patterns change; the education and health interventions most likely to produce outcomes; and the outcomes of government programs and services.[78]

4.74      The ABS reported to the committee that there was 'strong community support for high quality data linkage'.[79]

Committee view

4.75      The committee is of the view that overturning the long-standing practice of destroying name and address data collected through the census is a significant change that warranted significantly more public consultation and external scrutiny than it received.

4.76      It is apparent to the committee that level of consultation undertaken by the ABS in the lead-up to this decision was manifestly inadequate, especially considering the changes affect every Australian household. At a minimum, the PIA should have been conducted by an independent body. This is especially so considering that the ABS Executive Leadership Group was aware that within the organisation there was a 'widely held view' that the practice of destroying name and address was a barrier to meeting organisational objectives.[80]

4.77      As discussed in chapter 2, previous privacy concerns regarding the census had resulted in reduced community participation in the census. We may live in an age where more and more personal data is voluntarily shared electronically, but we also cannot assume that Australians do not take their privacy seriously.

4.78      Based on the evidence received, the committee remains confident that the ABS is committed to using census data for the purpose for which it was collected. In weighing the prospect of any future function creep, the committee notes the ABS' strong track record of protecting personal information privacy. This can give Australian's confidence that the data collected through the census will be used for improving public services and the ability of governments to meet the needs of the Australian population.

4.79      Although the ABS has repeatedly declined to provide the legal advice received from the Australian Government Solicitor to the Senate—presumably confirming its authority to collect, retain and use names and addresses—the committee is not convinced that the ABS has acted beyond its powers, although some submissions expressed contrary views. The move to change how names and addresses are used is not insignificant however, as evidenced by the completion of a PIA in 2015, as well as similar investigations into the merits of such a scheme over the preceding decade.

4.80      As such, the committee is in agreement that all future PIAs relating to the census need to be undertaken by a suitably qualified external body and that the outcomes of this assessment are made publically available on the ABS website well in advance of any census.  In addition, the committee is cognisant of the great work the ABS undertakes but is also aware of the significant negative impact the 2016 census has had on the ABS reputation. Once a new PIA is completed, the ABS should undertake extensive public consultations regarding any future changes or impact a new census might have in order to adequately inform the Australian public and its parliament, but also to re-establish its public credibility.

Recommendation 1

4.81      The committee recommends that all future Privacy Impact Assessments relating to the census, are conducted externally with the final report published on the ABS website 12 months in advance of the census to which it relates.

4.82      Following the release of a PIA recommending changes to future censuses, consultation across the Australian community should be undertaken by the ABS with the outcomes clearly documented on the ABS website no less than six months before a future census.

Recommendation 2

4.83      The committee recommends that the ABS update its internal guidelines to make clear that consultation requires active engagement with the non-government and private sector.

Navigation: Previous Page | Contents | Next Page

Top