Australian Bureau of Statistics and Privacy Issues
Be aware of how ABS collects and keeps the census, longitudinal datasets and compulsory household surveys information
There are lies, damned lies, and the Australian Bureau of Statistics
The Sad Truth
Australian Bureau of Statistics (ABS) has the means and power, including the power of compulsion, to be the largest collector of personal data in Australia. Australian Census is run every 5 years and is mandatory for every person who was in Australia on census night. ABS collects people’s personal information with the help of promises that once census processing is completed, all data is de-identified, and only then disclosed to other government agencies or sold to third parties via online tools like TableBuilder. Though ABS admitted that it is “bringing together census data with ABS and non-ABS datasets using name and address during census processing to undertake quality studies, ... statistical outputs and research purposes”.
The sad truth is, that not many people know that there is a big difference between anonymisation and de-identification of information:
- Anonymisation is irreversible removal of all identity data of the data contributor, which guarantees that any future re-identification is impossible under any condition.
- De-identification removes and/or encodes the identity data to make it not readily-identifiable, but it preserves the identifying information in some form, which could be re-linked in the future.
ABS said it de-identifies the census forms by removing people’s names and addresses once census collection is completed. However, from 2011 the address simply becomes encoded into a so-called mesh block — a set of just 30–60(!) dwellings, the date of birth of the person is kept on file, together with the information about person’s parents, ethnicity, ancestry, employment, family connections, education and previous addresses. All this information greatly increases the chances of every person being easy to trace back even without the explicit presence of their name and address. Would it be difficult to locate a person within a tiny area of 30–60 dwellings if everything but their name and exact address is known: gender, date of birth, country of birth, ethnicity, marital status, age and amount of children, who they live with, their profession, workplace address, education history, school or university addresses, movement history, income, disabilities and even where to and how they get to their work or school?
The introduction by ABS of Australian Census Longitudinal Dataset (ACLD), formerly known as Statistical Longitudinal Census Datasets (SLDS), proves that mass re-tracing and re-linking is quite possible and achievable. Since 2006, Australian census is no longer just a “snapshot of a nation on census night” as ABS keeps telling us, it is a tool capable of continuous, life-long surveillance of every person in Australia. During 2011 census, ABS randomly chose 5% (over a million!) of Australian population and managed to link a staggering 82% of “de-identified” files between 2006 and 2011 censuses within that sample. Those people will be linked again in the census 2016 and may be followed for life, without their knowledge or consent. ABS says “the sample will also be augmented” in the future.
For 2016 census, ABS is planning to use hash-codes of names for the census linking to “achieve between a 5 and 10 percentage point increase in the linkage rate”, which means that from that point the individuals will be uniquely identified, they just will be known by codes and the corresponding personal data, rather than by their names. The trend is obvious.
As David Vaile, vice-chairman of the Australian Privacy Foundation (APF) and executive director of the Cyberspace Law and Policy Community, pointed out:
Changing things one step at a time has been found to be a very effective tactic in practice. “What is the problem? This is hardly anything different from what it was before... you are just paranoid... this is not Big Brother, or the Stasi...” It is a very hard tactic to counter.
2016 — the year the privacy ended
David Vaile was right! For the 2016 Census, the ABS quietly declared on its website that “The ABS collects name and address information in order to... enable the linkage of Census data with other datasets to increase the value of the Census.” This means that personal information is not only retained, but also that ABS gets access to other repositories containing people’s personal data that have nothing to do with Census, such as our health records. It is possible that for 2021 Census, after the majority of Australians had been dragged into the eHealth system, it will be linked with Census too.
In fact, on 18 December 2015, just before Christmas, when everyone is busy with other things and least likes to keep an eye on the new ways our privacy is taken away from us, ABS published the following on its website:
The Australian Bureau of Statistics has decided to retain names and addresses collected in the 2016 Census of Population and Housing in order to enable a richer and dynamic statistical picture of Australia through the combination of Census data with other survey and administrative data.
Whilst the Census has always been valuable in its own right, when used in combination with other data the Census can provide even greater insight.
... The combination of Census data and health data can help improve Australia’s understanding and support of people who require mental health services and assist with the design of better programs of support and prevention.
This decision has been informed by public submissions, public testing and the conduct of a Privacy Impact Assessment.
They decided, huh? Since when government agencies, funded by public taxes, can completely change what they are doing without public approval? Since when public exits for the government and nit the vice versa? You are the public. Have been notified about this significant change? Have been asked whether you agree with it? Have you been given a clear chance to lodge a submission? Make your conclusions about how much your opinion matters to ABS.
To mitigate the public outrage, ABS keep repeating that it has been enjoying a good history of personal data protection. But that is irrelevant. Prior 2006, ABS did not keep any personal data, so of course it could not be misused or stolen. Now it is no longer the case. A 100% security of identity can only be guaranteed if no identifying information is kept in any form — encoded or not.
ABS also tried to calm the public by promising that they “will remove names and addresses from other personal and household information, store them securely and separately from one another, and other Census information. They will never be recombined. The ABS never has and never will release identifiable Census data.” If these promises were true, if names and addresses will really never be recombined, released or used for any other purpose, why store them? Make your guess.
Hackers do exist, and so does the possibility that the government can change the legislation or amend any policy at any point in the future, and the new law may allow the data to be treated less securely or released without de-identification. There is no law against changing the law! There is no law that could permanently protect the privacy of individuals who were forced to hand their personal information over to ABS, and no one can guarantee that at some pont ABS will not be told to release all that “confidential” data it holds, to track people down whenever the new law permits it, or such abused pretexts as “national security” or “public interests” suddenly demand it. And with ACLD it will not only affect the data collected at that time, but will also jeopardise the security of decades worth of linked data from the past. If ABS was truly anonymising our information instead of pretending to hide it behind some semi–“de-identification”, there would be no such danger: one cannot release the data they don’t have anymore, no matter what the new law or the government says.
Unfortunately, ABS is doing the opposite: instead of future-proofing the security of our private and sensitive information, they routinely propose to retain more identifiable data and to merge census data with information from birth and death registers, immigration data, disease registers and their own compulsory surveys. All promised to be “for statistical purposes only”, of course. Though, one fails to understand why they need names, addresses and dates of birth. Postcode and year of birth, without names are perfectly sufficient “for statistical purposes”. If they want names, it’s not statistics anymore! ABS became Australian Bureau of Surveillance.
As the Australian Privacy Foundation said in its Submission to Australian Bureau of Statistics in February 2016, “an anonymous, specific-purpose, temporary and relatively safe one-off snapshot appears to have been changed into a less-safe, personally identified, lifetime longitudinal dossier, with potentially fewer protections”.
The Damn Lies
Technically, all the changes — or, as ABS likes to refer to them, “enhancements” — have to pass a thorough process of public consultation. However, despite a large number of opposing submissions from organisations like Australian Privacy Foundation, Victoria Privacy Commissioner (+ Supplemental Comments), the NSW Council for Civil Liberties, and the response from the NSWCCL urging ABS to abandon the privacy-violating intentions, each subsequent ABS census is implementing more and more intrusive features. Clearly, nobody listens to the public concerns anymore.
As far back as 2005, Australian Privacy Foundation voiced their concerns about ABS’s grossly intrusive initiative to link Census data and pointed out the following:
- The data collected in each Census would now be retained, rather than being destroyed once analysis has been completed. This breaches the public expectation that the detailed data only has a short life and that all that is retained is statistics.
- The data collected in successive Censuses would now be linked. This breaches the public expectation that the Census is a statistical snapshot.
- The data would be very rich, and the individuals it refers to would be readily identifiable. This breaches the vital public expectation that Census data is anonymous.
- The data will still cover 1 million people, and hence will continue to be greatly attractive to many agencies and many corporations.
- It will be used in conjunction with further data from government sources such as birth, death and disease registers, and immigration data. This further breaches public expectations about privacy protections for their data.
- It may be used in conjunction with data from yet more sources. This would further breach public expectations about privacy protections for their data.
- Although some kinds of change to the scheme would require legislation, a great many potential “enhancements” to the scheme could be implemented as and when the Australian Statistician of the day sees fit.
- The ABS is trying to maintain the fiction that “because names and addresses will not be used, it will be impossible to identify who is included in the [collection]”. With such a rich data-set, this is, quite simply, untrue; and the fact that the ABS can utter such a statement gives rise to concerns about the agency's trustworthiness.
In bringing this Proposal forward, the ABS is seriously undermining its hitherto strong reputation. The ABS is also doing great harm to the Census, because the Proposal will significantly reduce people’s readiness to complete Census forms, and to do so accurately.
ABS also undermines the vital trust of the public in the government. Without this trust, no free, democratic society can function. This trust is very fragile, and, once damaged, can take a lifetime to restore, submerging the whole country in chaos and corruption.
APF were right then, and their concerns are even more valid right now, unfortunately.
Wherever there are concerns about, or an opposition to a new method of intrusion of individual privacy, we hear the usual reply: that the decision to do so “followed an extensive public consultation process”. How many people found it easy to obtain the information about a public consultation is taking place? Or, more importantly, how many have seen the contents of all the submissions to a certain public consultation? It cannot be called an “extensive public consultation”, if very few knew about it, and the opinions of those who disagreed were disregarded. Unless these consultation are widely advertised and unless the contents of all submissions are made public, the words about an extensive public consultation process are merely an excuse, or, worse, a lie.
ABS seems to be disregarding the fact that whenever a rich source of data exists, there will always be agencies seeking access to it. And some of those agencies are very powerful. ABS also seems to take for granted that they were able to collect the information and develop a reliable set of statistics only because the public had confidence in it. The introduced changes that impact privacy will inevitably erode public confidence and decrease reliability of the collected data. ABS already had to resort to compulsion and coercion to force the participation of some individuals who were avoiding census and surveys because of fears for their privacy and security. What is next?
The ABS says the compulsion is necessary for creating a population sample that provides a balanced representation of all population of Australia. Yet the very same ABS creates census and survey forms with carefully arranged and worded questions to help get a certain answer. For example, the question about religion “What is the person’s religion?” actually presumes that the person has a religion and induces to select from the list a religion the person was taught at school or grew up with even if they no longer actively practise it. The “no religion” answer option is buried at the end of a long list of common religious affiliations. The result of such careful design is that Australian taxpayers are not only over-subsidising religious institutions, but it also exaggerates religiousness of Australians and allows religions to influence political decisions in such secular areas as public health, which, for example leads to Australia remaining one of few developed countries where abortion is still the subject of criminal law! If ABS was truly seeking an unbiased representation of Australian population, the question would have been “Do you practice any religion?” and the “no religion” option would have been first, above the list of most popular faiths. The truly devoted, religious people would have had no trouble skipping the atheistic answer, while people who are no longer seriously religious would not have been confused. Thus, out the window goes ABS’s claim that lack of bias is so important to them that they are forced to be nasty.
Additional Means of Intrusion of Privacy
In addition to the 5-yearly Census of every person in the country, Australian Bureau of Statistics conducts a number of surveys that require more information from individuals, and that the Bureau claims are compulsory: Monthly Population Surveys (MPS), Australian Health Survey, Income and Housing Survey, and many others. The ABS selects the “victim” households, dispatches a letter addressed “to the householder”, and from that point the tenants of the dwelling have little choice but to let their private life become government property or be prosecuted.
The surveys can be lengthy, inconvenient and extremely privacy-invading. People have no right to say ‘no’ to protect their own personal data and their family from potential risks of misuse, identity theft, leaks or hacker attacks. There is no choice and no exit — all because ABS enjoys the power given to it by a dated Census and Statistics Act 1905 to issue Notices of Direction, to force people to supply the information and threaten them with exorbitant fines (over $100 per each day or resistance), courts and jail sentences.
ABS claims that the surveys must be compulsory for each “chosen” household in order “to provide a balanced representation of all households in Australia so that the estimates made from the data reflect, as closely as possible, all households. If some households do not participate, this may result in one type of household being represented more often than another type, which may result in biases in the data”. But we already know, that ABS not only doesn’t care about bias, it deliberately introduces it when the agenda requires it.
ABS also likes to stress that it “relies on willing cooperation of the selected householders”. Though it is unknown how willing any consent can be if people have no choice and threats are used. It is also unknown how many people are willing to be 100% frank when they are being coerced. Voluntary participation can bias the results of surveys, but wouldn’t coercion and intimidation do even worse? Most people can give honest answers only when they can be sure that their identity is absolutely and irreversibly safe, which is longer the case when ABS is involved.
What Can People Do to Protect Themselves?
Sadly, not much...
The only sure way to avoid ABS is to go overseas, but it is costly, and may be even impossible for a certain person. In addition, people leaving and entering Australia still have to complete passenger cards when crossing the border, but at least those cards are nowhere hear as long and intrusive as the census or ABS surveys.
So far, there has been only one widely known case when a person won a court case against ABS’s intrusion: Shirley Stott Despoja in 1988, the mother of Senator Natasha Stott Despoja. Other mere mortals seem to have the only option to avoid their private life to be examined: to move house and change their address immediately. Otherwise, the ABS surveyors will knock your door at any time and on any day, may stalk you around your house, call your phone and threaten you with fines and jail. Ironically, all these activities are funded by the tax money of the people being threatened.
But... knowledge is power
However, while there is no much chance to fight the insatiable statisticians in court, it may be helpful to know the following:
1. Supplying body fluid samples (blood, urine) for ABS Health Surveys is voluntary, so far. (However, if Australian population doesn’t raise privacy concerns right now, next time a trip to pathology collection centre may be made compulsory!)
2. For non-census surveys, you don’t have to give the ABS surveyors your real name (unless you agreed to provide biomedical samples). ABS chooses their survey victims by households, so it is enough that they already know your address.
A FAQ on ABS website says:
Do I have to give my name?
No. The interviewer will ask for your name to assist with the interview, but if you wish, the interview can be conducted anonymously.
And so it should be, provided ABS’s claims that all its activities are purely for statistical purposes are true. Statistics don’t need names!
Sounds good. However, the surveyors know the person’s address, and they often ask for the date of birth. Given that ABS has access to other government databases, tracing a person by the address and date of birth is a matter of seconds. It could be that the created sense of anonymity is actually false and deceptive if the people are traced and identified afterward; and allowing the respondents remain “anonymous” is just a way to make them disclose the information they would have kept private if they were openly asked to tell their name. So, before participating in a survey, you may want to ask for a written guarantee from ABS that they won’t use your address, date of birth, place of birth or any other personal data for snooping in government files, finding out your name and linking your survey responses to other databases.
For Post Enumeration Survey (PES) that is run after each census, ABS demands the person’s name, sex, date of birth, age, relationship in household, marital status, country of birth and Indigenous status, allegedly to match the PES the person records to Census person records during processing. Ask what is going to happen to your personal information and insist on a written guarantee that after this matching, all your identifying information will not be retained by ABS in any form. While ABS says that it “deletes” people’s names and addresses collected for census, it does not clearly state what happens to the identifying information collected during PES and other surveys. From 2016, it is no longer the case for census either.
If ABS was truly collecting the information for statistical purposes only, as they claim, they shouldn’t need any personally-identifying information at all.
3. Be wary of ABS’s promises to keep your information “confidential”, or to “delete” or “remove” your name and address “once statistical processing is completed”. Most people would think that their identifying information is going to be destroyed, but it is actually kept by ABS: ABS just keeps the names and addresses in a separate file, and that allows them to say that they removed the identifiable data. From abs.gov.au website, it is clear that identifiable information is not destroyed, it is stored in a separate file and that file can be easily linked back to the rest of the person’s information:
Data records are de-identified as soon as possible. Once quality has been assured, names and addresses are removed, because this information is not needed for the production of statistics. Removal provides added protection against any breach of security of confidential information.
Internally generated identifiers are usually attached to each record, but cannot be used to identify a respondent. Nevertheless, the combination of these identifiers and the name and address to which they refer can be used to make records identifiable. Hence any linked files are carefully protected and only available on a strict need to use for work basis. (Source - abs.gov.au)
So, if we are told that “personal privacy is paramount at the ABS”, that personal information “is not needed for the production of statistics”, that ABS collects information “only for statistical purposes”, and that “ABS has never and will never release identifiable personal information to any outside organisation, agency or project”, then why is the personal information kept at all? Why not destroy it once and forever, and by doing so actually guarantee the safety? Why retain it? Why wait for a breach, a hacker attack or a new law that will permit a new usage of this information? ABS doesn’t answer these questions.
ABS keeps saying that they haven’t had a privacy breach before. That’s great, but it doesn’t mean it can’t happen in the future. Technology is getting more sophisticated. And the public should keep in mind that before 2006 there was no linking between census data, other ABS surveys and government databases, and people weren’t traced and followed through their lives. A breach before 2006 would only leak data from one census or survey. A breach now will compromise the privacy of the whole life or individuals and their whole families.
4. You don’t have to give the ABS your contact phone number, as we are not allowed to have anonymous phone numbers in Australia like, for example, in UK. If ABS is conducting one of the lengthy surveys (some take up to 8 months), they may offer to do subsequent interviews over phone. If you want to keep your contact details private, they will have to come to your door instead.
5. You don’t have to let ABS employees into your house.
6. Make sure the person is really working for ABS. A card dangling on someone’s neck is not a magic pass into everyone’s personal life. How can we know their ID card is legit? Would that card be accepted as an ID by Driver Licensing Authorities, Centrelink, Police, Australia Post or any bank? No? Then why should the public accept it? If you decide to proceed, take a photo of their ID and ask them to come later. In the meantime, call the ABS office using their official phone number (not the number the surveyor may give you) and confirm the identity of the door knocker. We all know that these days anyone can print out any sort of cards and start knocking people’s doors, and ABS created a perfect opportunity for criminals gaining access to people’s homes and personal information by masquerading as ABS collectors.
Check the list of the current ABS surveys, do a research about the survey and learn what you can say and do to maximise the protection of your sensitive information. ABS subcontracts all sorts of companies and individuals to do surveys for them, so you never know whose hands your private or sensitive information is passed through. Keep that photo of the ID card you have taken, and if any identity theft, fraud or house break-in happens in your family, pass the facts about the recent ABS survey and the ID of the surveyor to the police.
7. It may also be helpful to insist that you film/record the interview and keep the copy of all questions and answers, while refusing for ABS to make any audio or video recordings of you. These days, ABS surveyors use laptops to record your answers, so you can demand to watch what they are entering and take a photo of each screen. Insists that you need it for your protection and for making sure the answers are entered correctly. Remember, ABS may have power to force you to give the answers, but you still have rights to access the information collected and held about you and make sure it is correct.
8. Before letting the survey start, demand a written guarantee from ABS that your answers will either be permanently and irreversibly de-identified, or that ABS will not attach any identifying information to your answers, link them to other data that may help to identify you, or attempt to trace you later in life, ever. ABS “promises” that this is what it is doing anyway, so, if they are telling the truth, presenting you with such guarantee should not be a problem for them at all. However, if they refuse, make your conclusions and take actions.
9. Ask if ABS can give you a proof that your household was chosen absolutely randomly, and was not targeted with any intention, malicious or otherwise.
10. Voice your concerns, disapproval or objections regarding privacy issues. Australian Privacy Foundation published the “What Concerned People Are Doing” lists about census and about surveys. While the Census and Statistics Act 1905 provides for the compulsory provision of census and survey forms and of accurate data, those provisions are unlikely to be sufficient to ensure an effective census or survey in the face of widespread public opposition.
Related articles: Protect Your Privacy in Everyday Life
First published 1 November 2012, updated 5 January 2016
10 August 2016 update: Census has been hacked, despite ABS’s assurances that they are well-prepared and absolutely secured.
More information about the ABS compulsory surveys from Australian Privacy Foundation