Your Census Data, Your Legal Name and the Risk of Breach
Dawn Kelly | AsKING QUESTIONS
The Census is presented as a national count of the population, but it involves much more than counting people. It collects detailed information about individuals, households, relationships, employment, income, education, health, culture and living arrangements.
This information is supplied together with a person’s legal name and residential address. According to the Australian Bureau of Statistics, names help prevent double-counting, connect people with the correct household information and support approved data-linking projects.
My concern is simple: if the government requires people to provide personal and confidential information connected to their legal name, what guarantee do those people have that their information will remain secure?
Can any computer system be guaranteed secure?
No computer system can honestly be described as completely immune from hacking, human error, unauthorised access or accidental disclosure.
The ABS states that Census information is protected through encryption, access controls, security testing, audit logging, Australian-based data centres and legal secrecy obligations.
However, the ABS also acknowledges that not every privacy and information-security risk can be reduced to a low level.
That raises an important question:
If the government cannot guarantee the security of information connected to the legal name, should individuals be required to carry all the consequences if that information is compromised?
Australian government systems have been compromised
Concerns about government cybersecurity are not merely theoretical.
The Australian Cyber Security Centre Threat Report 2016 states that the Australian Signals Directorate responded to 1,095 cybersecurity incidents involving Australian government systems between 1 January 2015 and 30 June 2016.
The report also records that the Bureau of Meteorology network was compromised in 2015. Investigators found evidence that an unknown quantity of documents had been searched for and copied. The information was considered likely to have been stolen, and the primary compromise was attributed to a foreign intelligence service.
During the 2016 Census, multiple distributed denial-of-service attacks resulted in the online Census form being closed for approximately 40 hours. This caused a major disruption, although the ABS stated that no Census information was compromised.
The ABS reported that it repelled almost one billion attempted cyberattacks and blocked approximately 130,000 malicious IP addresses during the 2021 Census. This demonstrates both the security work undertaken by the ABS and the extraordinary level of interest that malicious actors have in government systems.
Concerns identified for the 2026 Census
On 27 May 2026, the Australian National Audit Office published Auditor-General Report No. 34 of 2025–26: Cyber Security Readiness for the 2026 Census.
The audit found that the ABS needed to address key remaining cybersecurity vulnerabilities. It identified:
- Delayed identification of some cybersecurity vulnerabilities
- Shortcomings in the completeness and timeliness of risk reviews
- Gaps in security architecture and design reviews
- Risks arising from the broader ABS technology environment
- Further work required to identify and address residual vulnerabilities
The ABS accepted the Auditor-General’s four recommendations and stated that work was underway to address them.
It is important to recognise that the audit did not directly test the operational effectiveness of every security control used for the 2026 Census. Therefore, the report should not be interpreted as proof that Census information has been breached. It does, however, confirm that cybersecurity risks exist and must be actively managed.
How long is identifying information retained?
The 2026 Census Privacy Statement says:
- Names entered on Census forms may be retained until the end of February 2028.
- Addresses may be retained until the end of August 2029.
- Names and addresses are removed from the other Census information during processing.
- Names and addresses are then stored separately before destruction.
- De-identified Census information may be integrated with other datasets for statistical research.
- Census information may be shared under the Data Availability and Transparency Act 2022, subject to legislative safeguards and approval.
The ABS states that identifiable Census information is not supplied to police, taxation, immigration, Centrelink or marketing organisations for enforcement, compliance or marketing purposes.
These protections are important, but they do not eliminate every possible security risk.
Duty of care
When an organisation requires people to provide sensitive information, it assumes a serious responsibility to protect that information.
The Privacy Act 1988 and Australian Privacy Principle 11 require the ABS to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.
The Census and Statistics Act 1905 also imposes confidentiality and secrecy obligations relating to Census information.
In my view, this responsibility should include:
- Secure collection, transmission, storage and destruction
- Protection against hacking and unauthorised access
- Proper supervision of employees, contractors and service providers
- Regular independent security testing
- Immediate investigation and containment of suspected breaches
- Prompt notification of affected individuals
- Clear accountability where a failure to take reasonable care causes harm
If disclosure of information is compulsory, responsibility for protecting it should be equally clear.
A notice of conditional acceptance
The following generic notice may be used by anyone wishing to formally record their privacy concerns and request evidence about the protection of their Census information.
NOTICE OF CONDITIONAL ACCEPTANCE
To: Australian Bureau of Statistics
From: [Insert sender’s details]
Date: [Insert date]
Census reference: [Insert reference number]
Re: Security of Census information connected to the legal name
I conditionally accept the requirement to provide personal and confidential information connected to the legal name, upon receiving satisfactory written proof that the information will be protected from hacking, unauthorised access, loss, misuse or disclosure.
Grounds for concern
- The Australian Cyber Security Centre Threat Report 2016 states that, between 1 January 2015 and 30 June 2016, the Australian Signals Directorate responded to 1,095 cybersecurity incidents involving government systems.
- The report records that the Bureau of Meteorology network was compromised in 2015. An unknown quantity of documents was copied and was considered likely to have been stolen. The primary compromise was attributed to a foreign intelligence service.
- During the 2016 Census, distributed denial-of-service attacks caused the online Census form to be closed for approximately 40 hours. This was a disruption rather than a confirmed disclosure of Census information.
- The ABS reported that almost one billion attempted cyberattacks were repelled and approximately 130,000 malicious IP addresses were blocked during the 2021 Census.
- Auditor-General Report No. 34 of 2025–26, Cyber Security Readiness for the 2026 Census, published on 27 May 2026, identified remaining cybersecurity vulnerabilities, shortcomings in risk reviews and gaps in security architecture and design reviews.
- The ABS has acknowledged that not all privacy and information-security risks can be reduced to a low level, even after reasonably practicable measures have been taken.
Duty of care
By requiring, collecting, processing and retaining personal information connected to the legal name, the ABS has a responsibility to take reasonable care to protect that information from foreseeable harm.
This responsibility includes:
- Secure collection, transmission, storage, processing and destruction of the information.
- Protection against hacking, unauthorised access, misuse, interference, loss, modification and disclosure.
- Proper supervision of employees, contractors and external service providers.
- Regular security testing, auditing and correction of identified vulnerabilities.
- Immediate action to contain and investigate any suspected breach.
- Prompt notification to affected individuals where their information may have been compromised.
- Accountability for reasonably foreseeable harm, including identity theft, financial loss, reputational damage and distress.
This notice places the ABS on express notice of the foreseeable risks associated with collecting and retaining information connected to the legal name.
Proof required
Please provide:
- Evidence of the security measures protecting Census information connected to the legal name.
- Confirmation of who may access, process, link, share or store the information.
- Details of external service providers with access to identifiable Census information.
- Confirmation that the legal name will be retained only until the end of February 2028 and the address only until the end of August 2029.
- Confirmation of the officer or authority responsible for maintaining the security of the information.
- Confirmation that affected individuals will be promptly notified of any security breach.
- Confirmation of who will accept responsibility for any loss or harm caused by a failure to take reasonable care.
- A 100 per cent guarantee that information connected to the legal name cannot be hacked or unlawfully accessed. If this guarantee cannot be provided, clearly disclose all remaining risks in writing.
Please provide a written response within 14 days.
This notice records a willingness to provide the requested information upon satisfactory proof of security, duty of care and accountability.
Signed: ______________________________
Printed legal name: ___________________
Date: ________________________________
References
- Australian National Audit Office, Cyber Security Readiness for the 2026 Census
- Australian Cyber Security Centre Threat Report 2016
- Australian Bureau of Statistics, 2026 Census Privacy Statement
- [Census and Statistics Act 1905](https://www.legislation.gov.au/C1905A
Recent Comments