[Linux-aus] Census data risks - retention and correlation of records

[Glen Turner]

Neill Cox wrote:
> IANAS (I am not a statistician)

Hi Neill

I was :-)  I did a degree in CompSci, Math and Economics. I worked for
the Australian Bureau of Statistics from 1988 for about a decade.
During that time I worked on a population census (and a heap of other
things).

> My understanding is that the census has always collected names and
> addresses and always kept those on the paper records.

Correct, but only because you used the word "collected". Names and
addresses were not retained beyond the end of census input processing
(data entry, editing, follow up of outliers).

Names and addresses were on tear-off sheets on the front of the form.
Once we were happy there was no follow-up required then that page was
torn off and shredded. From that point onwards there was no way to get
from the form to an individual (well, induction from the answers given,
but you get my point).

>  Given that they're moving to online data collection this change
> seems inevitable.

Disagree. Just as a page can be thrown away once it is no longer
required, a database column can be dropped once it is no longer
required. You can arrange it so that backups containing the deleted
data are destroyed.

> The change here is that the ABS is now storing the names and
> addresses online and making that data available to researchers in
> anonymised forms. The ABS are good at anonymising data and very
> careful about releasing even tabular data that might be used to
> identify people.  If the population of a category in a table is small
> enough that individuals can be identified they won't release the
> data.

You only have the Bureau's word that this is what they will do in the
future. If the government alters the Census and Statistics Act then the
data is still there for the Bureau or others to do whatever they are
then allowed.

This isn't a "pie in the sky' issue. Consider that the NSDAP was
founded in 1920 and had totalitarian control of Germany by 1938. The
population census forms were used to identify people of Jewish heritage
for killing.  You could have very well argued in 1920 that legislation
'prevented' this use of Germany's population census; but 18 years later
you would find that the law was no prevention at all. What would have
prevented this use would be not archiving names and addresses.

> The question about religion is optional and always has been. If you
> don't want to answer leave it blank.

I'd answer "Jedi" instead. The question is a complete farce, roughly
equivalent to asking people's allegiance to a football team with the
claim that it can be used to size stadiums. The ABS deserves to have
the nature of the question represented in the resulting statistics (not
that they do, they've declared "jedi" an outlier, which is an abuse of
that statistical term. But the fact they've had to lie not be
embarrassed shows what happens when surveys ask the unanswerable).

> Frankly of all the agencies / businesses that might leak my data the
> ABS is pretty much at the bottom of my list.

You write as if large leaks are difficult for individuals to do. The
entire census data will fit onto one USB. ABS employees have been
motivated by financial gain to leak economic data, there's nothing
special about census data which prevents other staff also breaking the
law. Computing has made population data worth a fortune (all those
current names, addressses, birthdates: no one's credit card would be
safe).

It's to the staff's credit that leaks are rare. But there's no need to
increase the danger to the common person from such a leak.  

> I used to work at the ABS in 80s and they took data protection very
> seriously.  They are not a government department but a statutory
> authority and they also take their independence very seriously.

Have you read what Bill McLennan and other people with ideals from the
1980s have written?  The current ABS staff can't speak out. They are
relying on former staff to uphold those values which we lived when
working at the ABS in the 1980s.

http://www.afr.com/news/economy/abs-slammed-for-breach-of-trust-over-intrusive-2016-census-data-matching-plan-20160309-gnebci

Best wishes,
glen