a) the preparation, administration and management on the part of the Australian Bureau of Statistics (ABS) and the Government in the lead up to the 2016 Census;
b) the scope, collection, retention, security and use of data obtained in the 2016 Census;
c) arrangements, including contractual arrangements, in respect of the information technology aspects of the Census;
d) the shutting down of the Census website on the evening of 9 August 2016, the factors leading to that shutdown and the reasons given, and the support provided by government agencies, including the Australian Signals Directorate;
e) the response rate to the Census and factors that may have affected the response rate;
f) privacy concerns in respect of the 2016 Census, including the use of data linking, information security and statistical linkage keys;
g) Australia’s Census of Population and Housing generally, including purpose, scope, regularity and cost and benefits;
h) the adequacy of funding and resources to the ABS;
i) ministerial oversight and responsibility; and
j) any related matters.The permissive report unfortunately fails to meaningfully engage with erosion by the ABS of public trust in the census.
The report features the following recommendations -
R1
4.81 The committee recommends that all future Privacy Impact Assessments relating to the census, are conducted externally with the final report published on the ABS website 12 months in advance of the census to which it relates.
4.82 Following the release of a PIA recommending changes to future censuses, consultation across the Australian community should be undertaken by the ABS with the outcomes clearly documented on the ABS website no less than six months before a future census.
R2
4.83 The committee recommends that the ABS update its internal guidelines to make clear that consultation requires active engagement with the nongovernment and private sector.
R3
5.46 The committee recommends that the ABS publicly commit to reporting any breach of census related data to the Office of the Australian Information Commissioner within one week of becoming aware of the breach.
R4
6.89 The committee recommends that the Australian Government commit the necessary funding for the 2021 census in the 2017–18 Budget.
R5
6.90 The committee recommends that the ABS conduct open tendering processes for future census solutions requiring the participation of the private sector.
R6
6.91 The committee recommends that the ABS give greater attention to intellectual property provisions in contracts that include licensing and royalty arrangements.
R7
6.92 The committee recommends that the 2021 eCensus application be subject to an Information Security Registered Assessors Program Assessment.
R8
6.93 The committee recommends that the ABS take a more proactive role in validating the resilience of the eCensus application for the 2021 census.
R9
6.94 The committee recommends that the Department of Finance review its ICT Investment Approval Process to ensure that projects such as the 2016 Census are covered by the cabinet two-pass process.
R10
6.95 The committee recommends that the Australian Government provide portfolio stability for the ABS.
R11
6.96 The committee recommends responsible ministers seek six-monthly briefings on the progress of census preparations. These briefings should cover issues including, but not limited to, cyber security, system redundancy, procurement processes and the capacity of the ABS to manage risks associated with the census.
R12
6.106 The committee recommends that the ABS consider establishing a dedicated telephone assistance line for people who require special assistance in completing the census.
R13
7.28 The committee recommends that the maximum value of fines and any other penalties relating to the census be explicitly stated.
R14
7.29 The committee recommends that the Australian Bureau of Statistics develop a clear communications strategy outlining the outcomes for non-compliance with the census, including resolution processes and the value of possible penalties.
R15
7.57 The committee recommends that the Australian Government provide sufficient funding for the ABS to undertake its legislated functions to a continued high standard.
R16
7.58 The committee recommends that the responsible minister act as a matter of urgency to assist the ABS in filling senior positions left vacant for greater thanIn noting privacy concerns the report states
4.54 It was argued to the committee that the destruction of name and address information is central to the willingness of individuals to give up their personal information to help society distribute goods and services equitably: There is an implicit social compact underpinning the Census: give us our anonymity and privacy, and every five years we will give you the data you want, in the form of a national, anonymous snapshot, to be used for planning, policy and research purposes. We will answer all those questions, truthfully, because we have been promised that our answers will never actually be linked back to us.
4.55 The CCHRL argued that the decision to retain names and addresses is a threat to privacy: We are concerned that the use of census data and data linkages across government agencies leads us into 'a system requiring personal information under compulsion of law where the system has increasingly powerful capacity to store, sort, match and predict' individual behaviour…Such a system, even if authorised by law, itself represents a fundamental breach of people's rights to privacy.
56 The APF argued that the changes introduced in the 2016 census have harmed the reputation of the ABS in the community: Before the 2016 census the Australian public generally trusted the ABS. This is no longer true for many Australians. That trust was destroyed by the ABS when it changed the purpose of the census from aggregated statistical data to personal tracking. It still remains unclear what the ABS plans to do with the personal information it has collected.
4.57 The committee heard that the willingness of the community to engage in statistical projects is proportionate to the trust the community has in that organisation. If respondents do not trust that their information is safe they are less likely to honestly participate in the activity.
4.58 Electronic Frontiers Australia argued that the changes to the 2016 census may represent an ongoing threat to future Censuses: The apparently significant erosion of public trust resulting from the manner in which the 2016 Census has been implemented represents a serious threat to both the integrity of the data collected in the 2016 Census and to all future Censuses.
4.59 It was put to the committee that while the ABS was a widely trusted organisation, it is necessary that the ABS continues to engage with stakeholders to assuage 'actual or perceived' risks in completing the census to ensure ongoing high data quality.
4.60 The ABS recognises the importance of community trust in completing its work, with the ABS' Corporate Plan citing trust as one of the essential components of its success. The ABS argues that it enjoys high levels of community support: An independent survey in 2015 found that institutional trust was high among general community respondents with 81 [per cent] indicating that they either trust greatly or tend to trust the ABS. Among the informed users of ABS products, the level of trust rose to 100 [per cent]. These are very high trust ratings for an organisation, and higher than comparable surveys of statistical organisations in other countries.
4.61 Although the final census results will not be ready for some time, the committee was informed that initial quality checks conducted by the ABS 'show low levels of item non-response to the known sensitive questions'. The ABS further reports a preliminary response rate in excess of 96 per cent, indicating that the concerns relating to the 2016 census did not tamper community enthusiasm for statistical participation.In discussing function creep the report states
4.62 The committee heard concerns regarding function creep where data collected for one purpose is later used for another. One of the key questions that anyone naturally has when asked to provide information, is the use to which that information will be put. This report has already canvassed some of the uses to which census data is put, including determining electoral boundaries, determining areas in need of greater public services, and tracking changes in demographics. A number of submissions queried how the enhanced dataset would be used by the ABS and government.
4.63 Australia has no privacy protections written into the Constitution. This means that there is no way the government can guarantee that the current and proposed legislative controls will remain indefinitely. Current protections might be robust, but there is no guarantee this will continue.
4.64 There are examples from Australia's past where governments have put short-term administrative need ahead of principle. Prior to the World War II, the then Tax Commissioner attempted to access census data for the purposes of a court action against a taxpayer. In that instance the Australian Statistician had, in the meantime, destroyed the name identified census card thereby preventing the use of this data. Although the legislative loophole that enabled the Tax Commissioner to make this claim has since been closed, it does highlight how data collected for one purpose at one point in time is often threatened with repurposing.
4.65 Even if consent is given initially to collect and use the data, we have no way to ensure that someone consents to that data being put to different uses. Salinger Privacy expressed concerns relating to the potential uses of the census dataset: It is my opinion that the risk of function creep was under-estimated by the ABS. Once they hold identifiable data on all 24 million people in Australia, I cannot believe that not a single government department, Minister or police force will be interested in tapping into that data for their own, non-research purposes. A list of the agencies queueing up to gain access to the metadata that telecommunications companies must now keep by law provides a salient example of the likelihood of function creep.
4.66 The committee heard that concerns regarding function creep featured prominently in the findings of the 2005 PIA, and were also cited by the ABS in a submission to the 1997 'Parliamentary Inquiry into the Treatment of Census Forms' in which the ABS recommended against the retention of identified census data.
4.67 The PIA prepared by the ABS relating to the retention of name and address data considered the possibility of function creep which it defined as: 'name and address information from the 2016 Census may be used for purposes beyond what is currently contemplated by the ABS'. The ABS assessed the likelihood as 'very low', and would mitigate against the risk by ensuring that 'any data integration project involving retained information is undertaken for statistical and research purposes only'.In relation to linking to administrative datasets the report states
4.68 A further criticism of the ABS' handling of the decision to retain name and address information was the lack of clarity regarding how this data would be used in linking datasets. Legal academic Dr Cassandra Cross argued that linked data sets represent a growing threat to individual privacy: The linking of Census data to these other administrative data sets has the ability to paint a detailed picture of individuals and in and of itself, poses challenges to the privacy and anonymity of those subjected to it.
4.69 Assistant Professor Kate Galloway similarly argued that the linkage of compulsorily acquired data under the census to other data sets itself represents 'an increase in scope of the census' and an erosion of individual privacy.
4.70 The committee also heard views in support of linking census data with other data sets. Dr Liz Allen from the Australian National University (ANU) argued that many countries have been using statistically linked census data for decades, and that: The benefits of data linkage outweigh any potential harm which may be associated with the statistical undertaking. An example of the power of Census linkage is the methodological work by the ABS estimating Aboriginal and Torres Strait Islander life expectancy.
4.71 The committee similarly heard support for data linkages from the ANU School of Demography: Our second point is that the linkage of census data and other sources synergistically increases their value, and we would like to see more linkage in Australia. We provide an example to illustrate this point. Census data are necessary to provide the denominators for many indices, including demographic rates and many health measures. Without data linkage, the numerators and denominators, for example, to calculate the mortality from registered deaths and population numbers can only be aligned by reference to geographic area. Any additional information on the characteristics, such as the socioeconomic status, is assumed on the basis of the average socioeconomic status of people living in the area. In other words, the mortality of the individual is not directly linked to the socioeconomic status of the individual.
4.72 It may be that at this point the ABS itself has not fully decided upon the scale of potential data linkages. Internal ABS documents from 2015 discuss some of the potential applications of improved statistical linkages: ABS data integration activities can be expected to expand significantly in the coming years as ABS gains access to additional key nationally important administrative datasets. Maximising the utility of these datasets, as well as of the Census and survey datasets, will result from the ability to conduct multiple high quality linkage projects, through linking multiple administrative datasets, linking administrative datasets to surveys and/or the Census, and linking the Census to surveys. Name and address information has the potential to markedly improve the quality of data linkage. … Statistical data integration offers the potential to produce new data products, as well as enrich existing data products. There are many administrative datasets that are likely to have considerable statistical value. In addition to the Personal Income tax data which has already been used in data integration projects, future data integration projects could include the use of FaHCSIA welfare payments data, Centrelink unemployment benefits data, Medicare and Pharmaceutical Benefits Scheme data, Australian Immunisation Register, the AEC electoral role, and other nationally important datasets.
4.73 The ABS informed the committee that there currently exists strong demand for the delivery of greater statistical information on: the nature, extent and outcomes of industrial changes that are taking place in the economy; changes in in the community as the population ages and work and family patterns change; the education and health interventions most likely to produce outcomes; and the outcomes of government programs and services.
4.74 The ABS reported to the committee that there was 'strong community support for high quality data linkage'.The Committee's view is
that overturning the long-standing practice of destroying name and address data collected through the census is a significant change that warranted significantly more public consultation and external scrutiny than it received.
4.76 It is apparent to the committee that level of consultation undertaken by the ABS in the lead-up to this decision was manifestly inadequate, especially considering the changes affect every Australian household. At a minimum, the PIA should have been conducted by an independent body. This is especially so considering that the ABS Executive Leadership Group was aware that within the organisation there was a 'widely held view' that the practice of destroying name and address was a barrier to meeting organisational objectives.
4.77 As discussed in chapter 2, previous privacy concerns regarding the census had resulted in reduced community participation in the census. We may live in an age where more and more personal data is voluntarily shared electronically, but we also cannot assume that Australians do not take their privacy seriously.
4.78 Based on the evidence received, the committee remains confident that the ABS is committed to using census data for the purpose for which it was collected. In weighing the prospect of any future function creep, the committee notes the ABS' strong track record of protecting personal information privacy. This can give Australian's confidence that the data collected through the census will be used for improving public services and the ability of governments to meet the needs of the Australian population.
4.79 Although the ABS has repeatedly declined to provide the legal advice received from the Australian Government Solicitor to the Senate—presumably confirming its authority to collect, retain and use names and addresses—the committee is not convinced that the ABS has acted beyond its powers, although some submissions expressed contrary views. The move to change how names and addresses are used is not insignificant however, as evidenced by the completion of a PIA in 2015, as well as similar investigations into the merits of such a scheme over the preceding decade.
4.80 As such, the committee is in agreement that all future PIAs relating to the census need to be undertaken by a suitably qualified external body and that the outcomes of this assessment are made publically available on the ABS website well in advance of any census. In addition, the committee is cognisant of the great work the ABS undertakes but is also aware of the significant negative impact the 2016 census has had on the ABS reputation. Once a new PIA is completed, the ABS should undertake extensive public consultations regarding any future changes or impact a new census might have in order to adequately inform the Australian public and its parliament, but also to re-establish its public credibility.
