The Bureau of Statistics has been quietly hanging on to the names it collects with the census to conduct studies, despite a public commitment to destroy them.
Australian statistician David Kalisch told Fairfax Media the Bureau had been keeping the names it collected for up to 18 months.
"They've done it under the guise of: 'this is while we are processing the data'," he said.
"They've done linkages, they've done other things. What's happening now is we are being more transparent about it."
The studies have been conducted despite a commitment on the ABS website that "name and address information will be destroyed once statistical processing has been completed".
They used the names and addresses on census forms to link the census answers to department of immigration records, to school enrolment records and to the Australian Early Development Index.
The names were destroyed only after the records were linked.
Separately, and without asking for consent, the Bureau has been tracking five per cent of the population (more than one million people) through what it calls the Australian Census Longitudinal Dataset.
It has been using the names on the forms to create "linkage keys", which enable it to follow respondents over time. Each census, the same name produces the same linkage key, enabling movements to be tracked. Once each key has been created, the name itself has been destroyed. It is impossible to reverse-engineer a key to derive the name.
"In 2016, I have decided to keep names and addresses for longer," Mr Kalisch writes in today's Sydney Morning Herald and Age. "This will enable the ABS to produce statistics on important economic and social areas such as educational outcomes, and measuring outcomes for migrants."
Labelled by former Australian Statistician Bill McLennan "the most significant invasion of privacy ever perpetrated on Australians by the ABS," the decision will formalise what was happening informally before Mr Kalisch joined the ABS in 2014. It will extend the period for research using names from 18 months to four years. All names collected will be deleted by August 2020 or when studies have been completed, whichever is the soonest.
The decision is a retreat on a announcement in December that names and addresses on census forms would be retained indefinitely.
"There are extremely robust safeguards in place to protect the privacy and confidentiality of the information collected in the census, including names and addresses," Mr Kalisch writes in today's Fairfax Media publications. "The ABS never has and never will release identifiable census data."
Kat Lane, vice-chair of the Australian Privacy Foundation, said the real issue wasn't the ABS security system. It was that there was no justification for tracking or personally identifying Australians.
In The Age and Sydney Morning Herald