G.P.O.…

                                                              G.P.O. Box 1196
                                                             Sydney NSW 2001

                                                          enquiries@privacy.org.au

                                                         http://www.privacy.org.au/




                Submission to the Australian Bureau of Statistics
                                      re
                    Proposed Enhancements to the Census
                  (the 'Longitudinal Census Dataset (LCD)')
                          8 March 2004, with an Addendum in s. 5(f)


1.   Introduction

The Australian Bureau of Statistics (ABS) has invited the Australian Privacy Foundation (APF)
to comment on an undated Discussion Paper entitled 'Enhancing the Population Census Dataset'.

The APF notes that the ABS intends to promote the proposal widely later this month.

2.   Background

The APF has had previous involvement in discussions about Census design. Some of its Board
members have also been involved in previous consultations, on behalf of such organisations as the
Office of the N.S.W. Privacy Commissioner and its predecessor Privacy Committee, and the
Office of the Federal Privacy Commissioner.

The APF's policies on this matter are clear: the Census is a very privacy-intrusive process and
generates a potentially extraordinarily privacy-threatening database. The Census Act and the
ABS have traditionally managed to reconcile the important public interest in statistics with
privacy protection through the guarantee of early de-identification. This proposal would destroy
this delicate balance.

3.   The Nature of the Australian Census to 1996

The APF's understanding is that the Australian Census was run on much the same basis until
1996. The data was collected in an identified manner, but the identifying information, including
address, was retained only as long as necessary to enable administration of the collection
process. It was then removed and destroyed. After capture, the forms on which the data was
collected were destroyed.

Each record was thereafter associable only with statistical districts of considerable size.
Considerable attention has always been paid to control over access to the data, both in its
original form and subsequently. No credible report of abuse of the confidentiality of census data
has ever come to light. Moreover, great care has always been taken to avoid small counts in cells
disclosing data in a manner that might enable association with an individual.
4.    Changes in the 2001 Census

The APF understands that at least one major change was made in the 2001 Census.

(1)   Optional Permanent Identifiability of 2001 Census Data

The Discussion Paper states that "For the 2001 Census, the ABS captured name and address for
those people who chose to have their records retained by Australian Archives. The ABS passed
the name identified records to the Australian Archives, to be released to the public after 99 years.
The ABS did not retain name and address information" (1.3, on the un-numbered second page).

This appeared to the APF at the time to be a fairly sensitive initiative, although not without risks
to those who consented. Because of the consensual nature of the measure, and the reasonably
clear communication of the terms, the APF did not oppose it. We understand that just over 50%
of respondents agreed to the retention, on the clear basis that it was to be kept secure by
Archives, with no uses allowed for 99 years. This means that even without any organised
campaign of opposition, nearly half of all respondents - many millions of Australians - either did
not wish their Information kept separately and securely then released after 99 years, or did not
trust those assurances.

5.    Proposed Changes in the 2006 Census

The covering letter inviting the APF to participate in a consultation states that "the ABS is
proposing to enhance the value of the 2006 Population Census data by combining it with future
censuses. The main feature of the proposal is the creation of the Longitudinal Census Dataset
(LCD)".

This is a less than frank and open summary of the changes being proposed. The following
inferences can be drawn from various segments of text scattered through the document.

(a)   Compulsory Permanent Identifiability of Census Data

The relevant segments of text are:

      "retaining name and address for each person counted in the Census" (2.1)

      "All people counted in the census are covered by this proposal" (2.7)

The retention of a connection between every person's identity and the data that they disclose to
the Census would no longer be at each individual's choice, but would be mandatory.

The mirage of consent lasted a single Census. In retrospect it appears to have been the thin end
of the wedge of a much broader surveillance proposal.

(b)   Retention by the ABS Rather than Australian Archives

The relevant segments of text are:

      "retaining each person's name and address, as supplied in the 2006 ... census" (1.4)

      "retaining name and address for each person counted in the Census, to support the
      data combining process" (2.1)

Again, the promise of separation of the identifier from the data appears set to be broken after
only one Census. The separation, with a guarantee of secure storage by Archives and no uses for
99 years, was an essential condition for public acceptance of retention.



© Australian Privacy Foundation Inc., 2005                                                   Page 7
(c)   Compulsory Linkage of Personal Data From Successive Censuses

The relevant segments of text are:

      "creating the Longitudinal Census Dataset by combining the data each person
      provides in the 2006 Census with the data they provide in future censuses" (1.4)

      "retaining each person's name and address, as supplied in the 2006 and future
      censuses" (1.4)

      "combining data from the 2006 Census with all data from future censuses" (2.1)

      "All data collected in the census, for all individuals and households counted in
      Australia on census night will be included" (2.3)

      "For the 2011 Census the data for every person counted will be added to the data
      they provided in the 2006 Census. This would continue for future censuses" (2.4)

This assumes that the identifying data on successive Census forms will be the same. That is not
naturally the case, because a considerable proportion of the population changes address at a
considerable rate, and a smaller proportion changes name as well. To ensure linkage, other
changes would need to be made to the framework of identity management in Australia. This is
discussed further in section 6 below.

(d) Linkage with Other ABS Data

The relevant segments of text are:

      "retaining each person's name and address, as supplied ... in other relevant ABS
      collections" (1.4)

      "The LCD will be used with other ABS datasets" (2.2)

      "data ABS collects in other censuses and surveys" (2.5)

This presumably refers in particular to the data collected in other compulsory surveys. If so, this
step alone represents a gross breach of the trust of respondents to those surveys, and possibly of
the law of confidence and/or the Privacy Act.

It may indicate that the ABS has been assembling additional collections of personal data that
have not been generally-known to the public, and that the ABS intends consolidating those
collections as well into a citizen databank.

(e)   Addition to the Record of Data from Births and Deaths Registers

The relevant segments of text are:

      "adding Birth and Death register data including cause of death to the longitudinal
      census dataset" (1.4)

      "combining it over time with data from birth and death registers" (2.1)

      "From 2007, birth and death register information will be added at regular intervals
      (e.g. annually)" (2.3).

      "This would add new born children to the household into which they were born" (2.3)

      "This would record a person's cause of death" (2.3)


© Australian Privacy Foundation Inc., 2005                                                  Page 7
This would require unprecedented linkage of records between State and Territory Registers of
Births and Deaths and the ABS - in itself a major shift towards a comprehensive databank of
personal information about the people of Australia.

No mention is made of the marriages register, but presumably that would be discovered to be
useful at some stage as well, because it is a strongly reliable predictor of change of name.

This aspect appears to be remarkably naive, although possibly disingenuous. It takes no account
of the fluidity of names in a common law country like Australia. Many people fill in forms in
names other than those on their Birth Certificates. Many people's deaths are recorded in names
different from those on their Birth Certificates, and indeed from those on their census forms. The
significance of this is discussed in section 6 below.

(f)   Addition to the Record of Data from Diseases Registers

The relevant segments of text are:

      "disease registers set up for research purposes, brought within the ABS and covered
      by the provisions of the Census and Statistics Act 1905" (2.5)

There appears to have been an explosion in the number and type of these registers in recent
decades, and many of them contain a great deal of highly sensitive personal data. We
understood that access to such registers was restricted to health researchers, subject to strict
conditions. The APF was not previously aware that these registers had been made available to
ABS, and does not believe that the public is aware of it either. [ABS advise that they do not
have access, and that this is a proposal for ABS to have access to an additional source of data]

(g)   Addition to the Record of Unspecified Additional Data

The relevant segments of text are:

      "other datasets whose use for statistical purposes conforms with the requirements of
      the information privacy principles and which are brought within the ABS and
      covered by provisions of the Census and Statistics Act 1905" (2.5)

The privacy provisions of the Census Act have been effective in the past only because of the early
and permanent de-identification of the data, and more recently of retention with consent subject
to strict prohibition of use for 99 years. If these limits are removed, the IPPs of the Privacy Act
provide only limited and flimsy privacy protection, as there are many public interest exceptions
to IPPs 10 & 11. These principles are increasingly unable to apply an effective brake on the
growth of a surveillance state in the face of cynical exploitation of fears of terrorism and other
crime, and the protection they appear to offer is almost completely illusory.

The mooted privacy committee is likely to provide only a pretence of privacy protection without
having any real influence, let alone power.


(h) Other changes to the nature of data collection

Currently, the Census is completed by only one household member. To use the returns as the basis
of a permanent, ongoing, record about each individual, who may not have been aware of what
was recorded about him or her, raises significant privacy and data quality problems. If the
solution envisaged is to require every single individual adult to complete a form, it is vital that the
proposal be aired and discussed widely with the public.




© Australian Privacy Foundation Inc., 2005                                                     Page 7
6.   The Australia Card Scheme by Stealth

The ABS is proposing to move the Census towards the means by which a permanent Central
Population Register Is established and maintained. Such a databank is the storage element of a
national identification scheme.

In short, this proposal is nothing less than the latest attempt by government to introduce by
stealth a key element of the comprehensively discredited Australia Card scheme: the Australian
Card Register.

We note that in the original Australia Card proposal, the Health Insurance Commission did not
have access to anywhere near the range of personal data to which ABS will have access.

There are a number of inevitable further consequences of the proposal, which are not included in
the briefing paper.

The quality of linkages would be far too low, because of the difficulties with names noted above.
It would therefore be inevitable that a unique personal identifier would need to be established.

The current proposal, if it were to be implemented, would therefore lead inevitably, and quite
quickly, to the implementation of the full set of elements that comprise a total population
information and control scheme. The only thing missing would be a new plastic card. As this has
become unnecessary for the achievement of the desired level of information and control, this
proposal cleverly avoids including the very symbol around which opposition to the Australia
Card crystallised. It is far easier, but no more honest, to sell a scheme constructed around largely
hidden data linkage and matching.

7.   The Inevitability of Function Creep

There are several ways in which the data proposed to be held by the ABS would be at risk.
National security and intelligence agencies are increasingly being placed above the law, and they
and an even wider range of enforcement bodies have ever-increasing powers to demand
information, overriding existing legal and other limitations. Constraints on these powers, and the
limited machinery of accountability, are being progressively weakened such that there is no
effective brake on their use for wider and wider purposes, well beyond the threat of terrorism and
other serious crime originally used to justify them.

In the face of these drivers, there is no comfort whatsoever in the statement about "ensuring the
full protection of the Census and Statistics Act applies to this dataset and no data likely to enable
the identification of an individual is released from the ABS" (1.4). This assertion, made at least
six times in as many pages of the briefing, does not gain credibility from mere repetition.

Promises such as this are only as good as the next change to the legislation. From July, Australia
will have a government with control of both Houses of Parliament for the first time since modern
data surveillance became possible. The Census and Statistics Act will be changeable at the
government's whim.

It is salutary to recall the promises in the late 1980s and early 1990s of the then Treasurer that
the Tax File Number would never be used for anything other than tax administration, and that
this was enshrined in legislation ­ for about three years until the government changed its mind,
and introduced the data-matching scheme for social security, education and other purposes. Why
should Australians believe that today's promises of restraints on surveillance are any more
reliable?In the past, the ABS held nothing much of interest to investigative and national security
agencies, precisely because it held no identifiable data (except for a very short time-span). Now,
over the next decade it is proposed to convert the Bureau into a honey-pot of the broadest range
of the most sensitive personal data, and in forms susceptible to both simple and sophisticated
data mining.




© Australian Privacy Foundation Inc., 2005                                                   Page 7
If this proposal were to proceed, there is simply no doubt that personal data in the collections
would quickly come to be used in ways, and for purposes, additional to those envisaged by the
Discussion Paper.

8.   The APF's Position

The APF rejects utterly all elements of this proposal.

More significantly, it believes that the Australian public will resoundingly reject all elements of the
proposal. Whether that rejection occurs before the necessary legislative changes are made, or
only once the new Census and Central Population Register was commenced, is an open question.

Were this proposal to continue to public consultation stage, its actual meaning would be
communicated to the public in much clearer and simpler terms than those in the Discussion
Paper.

In the event that the government persists with the proposal, the airwaves will be filled with
stories about the intrusiveness of the Census, the breaches of trust by the ABS that it embodies,
the intention to centralise and retain permanently all personal data under government control,
and the inevitability of an accompanying identifier.

Australians have long shown a strong resistance to any proposal to adopt a national population
database and/or identity card. Even post 11 September 2001, research has indicated little
change to that level of resistance, and there is recent anecdotal evidence of a considerable
backlash against proposals of this kind. There is plenty of overseas experience of successful
resistance to proposals of this nature, such as Sweden's Project Metropolit, The Netherlands
Census, and actions in Germany, the Philippines and Korea.

The ABS is dependent on its reputation, until now well-deserved, for sensitivity to privacy
issues. If it were seen to be a proponent of, or even a participant in, such a scheme, the ABS'
reputation could be damaged severely and irrevocably in the process. It is very likely that the
public opprobrium would extend beyond the Census to the ABS' operations more generally,
including other compulsory surveys.

9.   Conclusion

The covering letter states that "[The proposal] will not proceed if there is significant community
concern".

But the Discussion Paper states that "An Information Paper, to be released on 23 March, will
describe in full the approach the ABS proposes to take" (4.2).

The APF submits that the mere existence of the proposal is extraordinarily damaging to the
hitherto strong reputation of the ABS as one of the very few agencies that has always been
attuned to the importance of privacy to Australians.

The APF strongly recommends that the ABS:
(a) immediately withdraw the proposal from consideration;
(b) communicate that withdrawal to every organisation to which it has made the Discussion
     Paper available, citing the very high level of community concern that is evident, and the
     damage that further consideration of the proposal would inevitably do to the ABS' work;
     and
(c) not release the Information Paper.

There is nothing to discuss about "improving" this proposal. We strongly urge that the proposal
simply be immediately withdrawn, in order to protect both the Australian people and the ABS.



© Australian Privacy Foundation Inc., 2005                                                     Page 7
We would appreciate an indication from you by Friday 11 March as to the ABS' intentions, so
that our Board may consider its position prior to the proposed meeting on 14 March.

____________________________________________________________________________

Anna Johnston
Board Chair
0400 432 241, anna_johnston@salingerco.com.au

Roger Clarke
Board Member
(02) 6288 1472, Roger.Clarke@xamax.com.au

Contact Details for the APF and its Board Members are at:
http://www.privacy.org.au/About/Contacts.html




© Australian Privacy Foundation Inc., 2005                                             Page 7