Statistical Confidentiality and UK Population Censuses: a Summary
Total Page:16
File Type:pdf, Size:1020Kb
Statistical Confidentiality and UK Population Censuses: A Summary of Recent Findings and Ethical Issues William Seltzer Fordham University, Dept. of Sociology and Anthropology (Dealy 407), 441 East Fordham Road, Bronx, NY 10458 USA. E-mail: [email protected] Sessions STCPMs 1. Introduction The confidentiality of personal information provided to government statistical authorities during population censuses and similar statistical operations is a well-established principle, at least among statisticians. Accordingly, as discussed more fully in section 3 below, most sets of ethical norms in the field of statistics explicitly refer to the responsibility of maintaining statistical confidentiality on the grounds that such disclosures may lead to respondent harm. This ethical norm has been reflected, at least to some degree, in the confidentiality provisions of census and statistical laws adopted in most countries. These laws are of two broad types: first, those that prohibit disclosures for all types of non-statistical uses, and second, those that permit disclosures for certain important non-statistical state purposes. While those laws of the first type may permit some disclosures considered as harmless (for example, sharing data among statistical agencies to foster enhanced analytical possibilities) such strong statistical confidentiality laws adhere closely to the ethical principle that the personal information provided will not be used to harm or target individuals. Unfortunately, many other countries, whether by tradition or in response to perceived national threats, have adopted weaker census or other statistical confidentiality laws that allow for a distinction between authorized and unauthorized disclosures without reference to the issue of individual harm, and only bar the latter. Sessions To understand the implications of this distinction it is useful to consider how disclosures of personal STCPMs information provided to census and statistical agencies arise. Such disclosures arise from three main sources: 1) inadvertent disclosures (for example, lost laptops or flash drives, enumeration records erroneously put in the general trash, misdirected mail), 2) ad hoc disclosures (for example, those attributable to individual hackers, disgruntled or over-zealous census staff, or gossipy interviewers), and 3) targeted disclosures arising from the efforts of government or private sector entities external to the government statistical system to obtain personal information for some non-statistical purpose. The first two sources primarily use what might be termed “back-door” methods of obtaining this information, i.e., by means of the unauthorized disclosures prohibited by the confidentiality provisions of the census and statistical acts. The third type of disclosure, those arising from the efforts of other governmental agencies to gain access to personal information obtained in the census for non-statistical purposes, generally derive from the use of so-called “front-door” methods, i.e., by means of the authorized disclosures permitted under these laws. This distinction is important, both from policy and ethical perspectives. Most discussions of statistical confidentiality either ignore this distinction or focus only on methods used to deter “back-door” disclosures. On the other hand, it is the “front-door” disclosures that, in a number of countries, have been associated with substantial harm to vulnerable individuals or population subgroups (see, for example, Seltzer and Anderson, 2001; 2008). Sessions STCPMs The over-all goal of the line of research focusing on “front-door disclosures, of which the present paper is a part, is to explore the ethical issues and responsibilities associated with the prevention of disclosures of personal data gathered in censuses and other statistical operations, particularly those disclosures more often associated with respondent harm. How these issues play out is closely linked with a country’s legal and political history and traditions and its particular pattern of statistical organization. Accordingly, the paper focuses on the UK experience, with a particular reference to the forthcoming 2011 UK population census. This paper is a preliminary report of a larger study of the subject (Seltzer, 2009).1 The balance of the present paper is divided into five sections: a description of the confidentiality protections planned for the 2011 Census as articulated by the UK Office of National Statistics (section 2); a short presentation of the ethical context surrounding the topic of statistical confidentiality (section 3); a summary history of legal provisions relating to statistical confidentiality in UK censuses and the confidentiality assurances provided to the responding public on the census forms (section 4); a brief history of known and suspected disclosures of personal information from UK censuses (section 5); and a presentation of the main conclusions emerging from the findings presented here (section 6). 2. Plans for the 2011 UK Census Sessions Writing in the October 2008 issue of the Royal Statistical Society’s newsletter, RSS News, the UK Office of STCPMs National Statistics [ONS] Census Director strongly reaffirmed the commitment of the staff and management of the ONS to maintain the confidentiality of personal information provided by the responding public in the forthcoming 2011 Census. The census director wrote, in part, Existing UK law already prevents disclosure of census data. Under the Statistics and Registration Service Act 2007 it is a criminal offence to disclose personal census data, punishable by a fine or imprisonment or both . Further details of the . data security and confidentiality provisions are available on the ONS website . The protection given to personal census data has always been very strong throughout the 200 year history of census taking. ONS takes data security and the confidentiality of personal information extremely seriously, and we trust that the statistical community recognises the additional stringent measures that we have taken in pursuit of a successful and high quality census in 2011 (Watson, 2008). The ONS website postings referred to by the census director expand upon the points made in his letter, and include the following: ONS confirms its overriding commitment to ensuring the confidentiality of personal Census data for a period of 100 years, and its use strictly for statistical purposes only . All employees of both ONS and any appointed contractors working with Census data are bound by Regulations made under the 1920 Census Act and the confidentiality provisions of the Statistics and Registration Service Act 2007 (SRSA). Any breach of Sessions the SRSA confidentiality provisions is a criminal offence, subject to possible imprisonment and fines. All STCPMs staff working with personal Census data sign a confidentiality declaration to confirm their understanding and commitment to the legal confidentiality undertakings. (ONS website: 2011 Census project: 2011 Census Commitment to confidentiality and data security, accessed at: http://www.ons.gov.uk/census/2011-census/2011-census-project/commitment-to-confidentiality/index.html on 10-31-2008). Census data confidentiality is protected by the Statistics and Registration Service Act 2007 (SRSA) . Section 39 of the SRSA prohibits the disclosure of personal information with a penalty of imprisonment for a maximum of two years, a fine, or both (ONS website: 2011 Census Project: Census data confidentiality and UK law accessed at http://www.ons.gov.uk/census/2011-census/2011-census-project/census-data- confidentiality-and-uk-law/index.html accessed on 10-31-2008). Data security and confidentiality is a top priority for the Census. In addition to the strong protection provided by the law, ONS has put in place stringent additional safeguards . ONS will control system access rights to all systems and data. All security measures cover the completed questionnaires, the electronic data set, the website, the archive image system and the communications links relating to any of these items . We have secure systems in which to hold data, with stringent controls and procedures in place. We do not store any Sessions financial details, and names and addresses are removed from the data sources used for the day to day STCPMs production of statistical tables . The information in questionnaires is used only for Census related publications and analyses published for geographic areas. These outputs do not attribute any of the statistics back to specific individuals (ONS website: 2011 Census project: Census data security measures accessed at http://www.ons.gov.uk/census/2011-census/2011-census-project/census-data-security-measures/index.html on 10-31-2008). It is clear from even this summary that the commitments of the UK 2011 Census staff and management to the principle of statistical confidentiality are strong and that they are introducing many technical and operational safeguards to help protect census confidentiality. Moreover, based on the Census Director’s letter in the RSS News and the postings on the ONS website, one would be clearly justified, but mistaken, in assuming that the 2007 Statistics and Registration Service Act barred all potentially harmful disclosures. In fact, these protections seem largely aimed at deterring only the so-called “backdoor” disclosures arising from inadvertent and ad hoc sources referred to earlier. The questions the present paper raises relate primarily to the weaknesses of the underlying law with