Introduction
In Canada, the census of population is conducted every five years. It provides a snapshot of the population: its size and geographic distribution as well as its demographic, socio-cultural and socio-economic characteristics. The data produced are used widely by all levels of government for policy planning and program administration. Population estimates based on census counts are used to determine fiscal transfers between levels of government. Aggregated census data are also used by the private sector, educators and the general public.
Statistics Canada will be conducting the 2006 Census of Population on May 16th, 2006.
Objectives
A privacy impact assessment for the 2006 Census of Population was conducted to determine if there were any privacy, confidentiality and security issues associated with the census, and if so, to make recommendations for their resolution or mitigation.
Description
The 2006 Census of Population will collect detailed socio-demographic information on individuals and households through a long-form questionnaire which is completed by approximately one household in five. The remaining Canadian households will receive a short-form questionnaire asking basic demographic questions. Response to both questionnaires is mandatory under the Statistics Act.
Significant changes are being introduced into the collection and capture of data for the 2006 Census. The census will be more centralized and automated than in the past and respondents will be given the option of completing their questionnaire on-line as an alternative to mailing back a paper questionnaire. Questionnaires that are returned by mail will be imaged and data captured in a single Data Processing Centre using automated Optical Character Recognition technology before being edited and coded. Therefore local enumerators will no longer see the completed form and, overall, fewer people will handle respondents' information. These changes will improve the privacy, confidentiality and security of respondents' personal information.
Statistics Canada has reviewed the overall Census process and conducted a threat and risk assessment of the various collection and processing methods to be used in the 2006 Census. Some of the changes being introduced in 2006, however, warranted a more in-depth review: the use of the Internet for collection of Census data, the option of permitting use of tax records, the procurement of hardware, software and printing of questionnaires from the private sector for the 2006 Census, the capture, use and retention of names and addresses; and the implications of legislation allowing the archiving and eventual public release of Census records.
With respect to the introduction of an Internet option for completing the census questionnaire, Statistics Canada, in conjunction with the government's Secure Channel, has developed an approach that provides a much higher level of data security than that typically in place for commercial — including financial — transactions. While there are inherent risks in using the Internet, the use of Secure Channel and safeguards built into the Census application significantly reduce these risks, providing a secure and efficient on-line option to respond to the Census.
Also introduced in the 2006 Census is the option for respondents to give Statistics Canada explicit consent to obtain their income information from tax files rather than providing this information on the Census questionnaire. The questionnaire is designed to encourage the person completing it to consult each individual tax filer as to whether they grant permission or not. This option not only reduces respondent burden, but it also involves less privacy risk since sensitive income data will not appear on the census questionnaire.
The new methodology introduced for the 2006 Census required investment in hardware and systems development. Through a transparent and competitive procurement process, systems development for the Internet application, for the call centres, and for the Data Processing Centre was contracted out. To address concerns about private-sector contractors having access to Canadians' personal information, stringent security measures have been put in place to ensure that no confidential information is ever in the possession of contractors. All collection and processing of Census data is conducted exclusively by Statistics Canada employees in Statistics Canada facilities with no external connections. Regardless, all contractors must have the required security clearance and are sworn-in under the Statistics Act (thereby they are subject to sanctions for any breach of confidentiality). Contractors are under the direct supervision of Statistics Canada employees at all times. Finally, Statistics Canada is undertaking three independent Information Technology security assessments to further validate the security of contractor developed systems. With these measures, the privacy risk associated with the contracting out of work is mitigated.
The use of automated data capture from images makes it possible to capture names and addresses from Census questionnaires in a cost-effective manner. The availability of names and addresses in electronic format in turn improves the efficiency of collection, processing and evaluation activities. Other than in records retained for archival purposes, names will be retained on Census files for only a limited period of time. Strict controls have been put into place to limit access to identifiable information, such as names and addresses, which minimize the potential for misuse or disclosure of identifiable Census data.
In June 2005, Parliament passed an amendment to the Statistics Act allowing for the release of Census information by Library and Archives Canada after 92 years. For the 2006 Census and subsequent censuses, only information for persons who have given explicit consent will be released 92 years following a census. The wording of the question in the 2006 Census is designed to ensure that the responses reflect each individual's choice regarding the eventual release of their personal information.
Conclusion
This assessment concluded that the privacy risks related to the 2006 Census of Population were either negligible, were mitigated through existing safeguards or were addressed through the implementation of additional safeguards.