MADIP Privacy Impact Assessment

The ABS and the MADIP Board are committed to upholding the privacy, confidentiality and security of information in the Multi-Agency Data Integration Project (MADIP). The ABS continually assesses MADIP operations for potential privacy impacts and will continue to take a privacy by design approach for MADIP.

Privacy Impact Assessments (PIAs) are an important part of the governance and accountability framework for MADIP. PIAs help identify and manage the privacy impacts of MADIP. 

The ABS is trusted as the Accredited Integrating Authority for MADIP. We lead, publish, and implement recommendations for MADIP PIAs on behalf of the MADIP Board. The ABS generally conduct updates to the MADIP PIA every two years to assess and minimise privacy risks of MADIP. 

MADIP continues to evolve in response to an increasing demand for integrated data to fill crucial information gaps about our community. MADIP PIAs reflect the evolution of MADIP data and uses and are consistent with privacy best practice in Australia.

Since MADIP was established, the ABS has undertaken several PIAs that have been published on the ABS website. The original MADIP PIA was completed in March 2018 by privacy consultant Galexia. The ABS conducted an update to build upon the original PIA in November 2019. The 2019 MADIP PIA Update was quality assured by privacy consultant Maddocks. Several project specific PIAs involving MADIP data were also conducted following the 2019 MADIP PIA Update.

A second MADIP PIA update was undertaken by Maddocks in 2022 to build upon the previous MADIP PIAs.

The MADIP PIA was updated in 2022 to consolidate the findings from PIA processes undertaken since the 2019 MADIP PIA Update and to consider planned changes or updates to MADIP. The ABS engaged independent privacy consultant Maddocks, on behalf of the MADIP Board, to conduct the 2022 MADIP PIA update.

Maddocks found that:

• MADIP continues to be compliant with the Privacy Act 1988 and the Australian Privacy Principles (APPs) and
• existing mitigation strategies were sufficient to address privacy risks.

Maddocks made six recommendations to advance privacy best practice and enhance compliance with the APPss.

Targeted stakeholder consultation

Consultation is a valuable part of conducting a PIA. The ABS and Maddocks held targeted stakeholder consultation sessions during February 2022 to inform the PIA. Consultation aimed to inform stakeholders about MADIP, including its current privacy practices and protections, and identify and discuss stakeholder views on potential changes to MADIP.

Participating stakeholders included the Office of the Australian Information Commissioner (OAIC), Commonwealth and State Government agencies, State and Territory privacy regulators, universities and research institutions, Aboriginal and Torres Strait Islander stakeholder groups, peak bodies, privacy advocates and consumer advocates.

The MADIP Board and the ABS thank stakeholders for their significant contributions to the 2022 PIA Update. You can find out more about the consultation process and stakeholder views in the Consultation Report.

Implementation commitment

The MADIP Board has agreed with all the recommendations from the 2022 MADIP PIA Update. The MADIP Board Response provides a summary of recommendations together with how the recommendations will be implemented.

Further information

You can find out more about the 2022 MADIP PIA Update from the reports published to the ABS Privacy Impact Assessments web page. 

• 2022 MADIP PIA Update
• 2022 MADIP PIA Update - Consultation Report
• 2022 MADIP PIA Update - MADIP Board Response

Can I be identified in MADIP?

No. MADIP information is protected by the Census and Statistics Act 1905. This ensures that no information is released in a way that is likely to enable an individual to be identified.

Only aggregate statistics - not data about individuals – are produced from MADIP.

Can MADIP be used for enforcement or compliance purposes?

No. MADIP data is made available to researchers under section 15 of the Census and Statistics (Information Release and Access) Determination 2018. This section does not permit direct identifiers (such as names and addresses) to be disclosed and also restricts use of the information to statistical and research purposes only. The ABS applies the principles of the internationally recognised Five Safes Framework including assessment of safe data and safe projects. Projects that seek to use data for compliance purposes would not be approved. The protections applied to the data ensure individuals are not able to be identified and this also prevents use for enforcement or compliance purposes.

How are government agencies authorised to share my information to the ABS for MADIP?

Each agency involved in MADIP collects personal information related to its functions or activities. This information is disclosed to the ABS for MADIP as authorised by law for policy analysis, research and statistical purposes, consistent with the Privacy Act 1988.

For more information about the legislative authorities for agencies to share information with the ABS for MADIP, see MADIP data and legislation.

The ABS Privacy Impact Assessments web page provides a register of PIAs that have been conducted for all ABS projects, including ABS data integration projects and MADIP-related PIAs.

More information on the ABS privacy and security protections for MADIP is available on the Keeping integrated data safe web page.

More information on how the ABS handles personal information for MADIP is available on the MADIP Privacy Policy web page.

For more information about MADIP privacy processes, please contact us via data.integration.privacy@abs.gov.au.