ABS Privacy Policy for Statistical Information

The ABS collects personal information in its role as Australia's national statistical agency.  We collect this information under the ABS Act and the C&S Act. 

We collect only the personal information reasonably necessary to produce official statistics. These statistics support decision-making across the community, businesses and government. They provide information about Australia's economy, population, society and environment. We also provide valuable integrated data assets for research in the public interest.

We may also use personal information to:

• check the quality of information we collect 
• communicate with respondents
• improve how we collect information 
• run statistical collections
• review and improve our statistical business processes
• understand and improve participation. 

Where it makes sense, information will be combined or have identifying details removed.

We aim to collect only the personal information needed to carry out our statistical work. This includes producing official statistics for Australia, facilitating research, and running statistical collections.

For the types of personal information we collect for statistical collections, please refer to Your personal information – statistical purposes. 

We collect personal information directly from you through:

• administrative forms 
• Censuses 
• correspondence and other interactions
• surveys.

This may include when you complete a survey with ABS staff, use a paper or online form, or when you contact us.

We also collect personal information indirectly where authorised to do so. This may include collection from:

• a member of your household 
• an employee or your business representative when they are completing our surveys
• other government agencies and organisations that can share their data with us
• publicly available sources.

We take reasonable steps to ensure personal information is accurate, up to date, complete and relevant before we use or share it. Where needed, the ABS updates records, confirms information and investigates data quality issues.

We use your personal information only to perform our work under the ABS Act and the C&S Act. 

We mainly use personal information to:

• analyse statistics
• maintain statistical datasets 
• produce and publish official statistics 
• support statistical research.

We may also use personal information to:

• check the quality of our statistics and processes
• improve statistical methods
• manage our systems.
• support survey respondents.

We may combine your information with other sources of data. We do this to help policy makers and researchers gain a better understanding of Australia. This is known as data integration. This often helps reduce the number of questions you need to answer when completing a survey.  Further details are available in Keeping integrated data safe.

In the event of a data breach, we may use your personal information to inform you and keep you updated. 

We publish more details about the use of personal information in our Collection Notices.

We will not share any personal information provided for statistical purposes in a way that is likely to identify you, unless:

• we are returning it to you
• you have given us permission 
• it is required or authorised by law.

The ABS will not share your personal information with organisations outside Australia. We will also not share it to check if people have been following the law.

Storage

We store personal information for statistical purposes in different ways, including: 

• our document and records management systems 
• cloud storage.

We store all personal information collected online on servers located in Australia. The ABS keeps control of any personal information held on those servers.

Security

We set high standards and take the security of your personal information seriously. We protect it from:

• interference 
• loss 
• misuse 
• unauthorised access, changes or sharing.

We keep your personal information safe with: 

• access controls 
• monitoring and audit processes 
• procedures for responding to data breaches
• secure environments for handling data 
• security assessments 
• staff training. 

The ABS regularly reviews its security arrangements to respond to emerging risks. 

We secure all our information in line with the Protective Security Policy Framework. Our IT systems meet the Australian Signals Directorate's (ASD) Information Security Manual requirements. ABS systems that store and process statistical data undergo independent security assessments. These are carried out by independent ASD certified security assessors.

For more information see: Privacy and Security 

Keeping and deleting your information

We keep and destroy personal information in line with the Archives Act 1983. This means we will destroy your personal information when we no longer need it and are legally able to do so.

We publish more details about retention and deletion of personal information in our Collection Notices.

Protecting your information

Our staff are legally bound to protect your data. It is illegal for them to share information collected under the C&S Act unless they have permission to do so. If someone breaks this rule, they could face large fines or go to prison.

Privacy Impact Assessments

We assess the impact of our activities on your individual privacy. These assessments are called Privacy Impact Assessments (PIAs). They help the ABS to:

• design new processes
• keep your information safe
• manage change
• minimise privacy risks 
• undertake new projects or programs.

We undertake PIAs when introducing new or changed ways of handling personal information that may present a high privacy risk. A high privacy risk arises when the way personal information is handled could seriously affect a person’s privacy.

Third-party partnerships

 To help us carry out our work, we sometimes:

• engage external experts, such as independent advisers, for help and advice
• contract third-party providers, such as recruitment services, IT software and applications, and contact centre services for general enquiries.

These partners must follow the Privacy Act. They will also have their own privacy policies, processes and security protections. Where these third-parties handle personal information for us, we: 

• conduct privacy and security assessments, when needed
• make sure they protect the information in line with privacy and security standards 
• put agreements in place that set out how personal information must be handled
• take reasonable steps to make sure they follow privacy laws.

Survey responses are collected by ABS authorised officers. We do not use outsourced contact centre services for surveys. 

You can ask to see the personal information we hold about you and ask us to correct it if it is wrong. We will respond to requests as soon as possible and in line with the Privacy Act. 

In some cases, we won’t be able to provide access to, or correction of, your personal information as we have:

• destroyed the physical forms; and
• deleted personal identifiers (such as name and address) from the statistical data.

We are committed to protecting your privacy. If you believe the ABS has not protected your privacy, you can make a complaint to the ABS Privacy Officer. We will acknowledge your complaint, investigate the matter and respond. 

If you submit a privacy complaint, we will:

• confirm that we have received your complaint within five working days 
• ask for more information to help with our investigation, if needed.

If the matter is complex and we need more than 60 days to investigate, we will let you know and provide an updated timeframe.

If you are not satisfied with our response to your complaint, you can request a review. The ABS Privacy Officer will undertake this review. You may also refer your complaint to the Office of the Australian Information Commissioner.