For years the Australian Bureau of Statistics has been able to link its data in secret without retaining names and addresses for four years — and some staff have access to the full data of your name, address and census information before it is anonymised, Crikey can reveal.

The Australian Bureau of Statistics has come under fire this year for its new policy of keeping names and addresses for four years. But Crikey has learned that as with much of this process, the ABS has not been fully upfront with the public about how much access is given to the uncensored census forms, and how necessary it is to retain the names and addresses.

[Govt to store a trove of highly personal data, putting you at risk]

Just before Christmas last year, the ABS announced it would retain names and addresses in separate files along with the census data in order to “provide a richer and dynamic statistical picture of Australia”. As controversy over the change in policy brewed over May, June and July this year, the ABS has stuck to this claim, arguing that the data will provide valuable insights and offer better data for government policy around indigenous Australians, health and education. However, the ABS has not been entirely upfront with its processes in how it will handle — and how it has handled — census data.

In a Q&A for the ABC last week, ABS census data processing director Tracey Chester said most census forms were processed automatically, and no one should have access to an entire census form. But this is not entirely true.

The ABS employs about 50-100 data-quality experts to fix mistakes in the 18-month processing stage, and to do this, the staff are able to access images of online and paper forms. They can access forms in their entirety, including the names and addresses.

Instead of anonymising the data after 18 months, it will now be kept for four years, with names and addresses kept in one database and census data in another. The ABS has long been able to link personally identifiable details without the need to retain names and addresses. The bureau is able to line up date of birth, sex and age data — but using names and addresses can give analysts greater confidence that records have been linked correctly.

An ABS insider has told Crikey that the ABS’ census data enhancement team has also had access to names and addresses in the past and can use the name and address data to link census data with data provided from other agencies (like educational data). This was done in the 2006 and 2011 censuses. It is this matching of census data against other agencies’ data that makes the ABS so keen to retain names and addresses, but so far it has only made the case about the quality of linking its own data internally.

[Why you should boycott the census]

Crikey asked the ABS the following questions about the handling of the data:

  • Has ABS used date of birth, sex, and age to match data in the past? Why is keeping names and addresses more effective than this method?
  • What does the ABS’ Data Quality and Assurance team do during Census processing?
  • Are staff in this section able to view Census forms?
  • What security protections are in place to ensure that the data these officers are viewing is secure (are mobile phones banned?)
  • Is the data de-identified when they view it?
  • How long has the Census Data Enhancement team been in existence?

The ABS refused to provide specific responses, and instead provided a generic response regarding privacy of data:

“The ABS has stringent privacy practices, starting with employee training and the signing of an Undertaking of Fidelity and Secrecy. This ensures staff understand and uphold their obligations, and perform their duties in accordance with the Census and Statistics Act 1905. The ABS’ data handling policies and procedures are subject to audit by external assessors as well as international peer reviews. ABS’ IT security conforms to Australian Government Standards and is compliance tested by the Australian Signals Directorate,” the spokesperson said.

“The ABS securely manages hundreds of thousands of electronic and paper forms every year – with more than 9 million forms received during a Census year alone. Forms are tracked from the point of collection to secure destruction. On-line forms are increasingly used to capture information. A benefit of on-line forms is the added security – the content is encrypted and received directly by the ABS.  The public can be confident that the ABS has stringent policies and vigilant staff to protect privacy and confidentiality.  The ABS is committed to maintaining the privacy of people who supply their information.”

Crikey has previously reported that, internally, much of the justification around retention of names and addresses is that — in addition to better sampling — keeping names and addresses would allow for “ABS organisational efficiencies”.