View the most recent version.

Confidentiality

• Introduction
• Protecting the information provided by respondents
  • Statistics Canada employees
  • Contractors
  • Security of respondent information
  • Names, addresses and telephone numbers
  • New questions on the 2006 Census questionnaire
  • What happens to census questionnaires?
  • Handling of questionnaires
• Confidentiality of information provided online
• Protection of disseminated statistics
• Random rounding
• Area suppression
• Dissemination rules for statistics

---

Introduction

Canada owes the success of its statistical system to the long-standing cooperation between Statistics Canada, the population of Canada, its businesses and its governments. Accurate and timely statistical information could not be produced without that sustained collaborative effort and goodwill. Statistics Canada attaches the highest importance to protecting the confidentiality of respondent information.

Protecting the information provided by respondents

Statistics Canada employees

By law, Statistics Canada must protect the confidentiality of the information respondents provide on its surveys and censuses. When hired, Statistics Canada employees are screened for reliability and made aware of the confidential nature of the materials they will be handling. All Statistics Canada employees, including enumerators for the 2006 Census, must take an oath of secrecy, and are subject to fines and/or imprisonment should they reveal identifiable information derived from the census. Any possible breach of the confidentiality of census returns is an exceedingly serious matter which would be investigated immediately and thoroughly and be subject to the full force of the Statistics Act.

Contractors

Contract staff is never in possession of confidential data. Contract staff is only allowed escorted access to Statistics Canada's secure facilities if they have been cleared by security and sworn-in, under the Statistics Act. They are accompanied by a Statistics Canada employee at all times during their visit to any secure facility. Contract employees are not allowed to bring in or take out any electronic devices such as a laptop, CD-ROM, USB key (Memory Stick), etc.

Security of respondent information

The security of respondent information is of paramount importance to Statistics Canada. Census data are stored on Statistics Canada systems that are isolated from any other network. External connections such as telephone dial-in services (cryptocard, for example) do not have access to Statistics Canada's systems where confidential data are stored: therefore, it is impossible to break into Statistics Canada's databases.

In addition, Statistics Canada has controlled access to its premises so that only persons with the appropriate security clearance and who have taken the oath of secrecy may enter facilities housing confidential data. Any private sector employees who may require entrance to these premises are escorted at all times by a Statistics Canada employee.

Names, addresses and telephone numbers

Even though respondents are asked to write their name, address and telephone number on the census form, that information is not entered in Statistics Canada's release database. It is used mainly for quality control during the collection, processing and data quality processes.

Names are requested only to ensure that each person is counted once and only once. The telephone number is needed so that households whose questionnaire is incomplete can be contacted. The address is used to make sure that respondents are enumerated at their usual place of residence on Census Day. It is also needed to ensure that, in cases where more than one questionnaire has been completed for a household, all the forms are processed together.

From time to time, Statistics Canada may use the census information to select households or individuals to participate in other important surveys. This is done only after it can be demonstrated that the census is the most cost-efficient and effective means to select the required sample.  These uses are strictly for statistical purposes and no one outside of Statistics Canada can have access to any identifiable information.

New questions on the 2006 Census questionnaire

Statistics Canada also ensures that respondents understand what is involved when they are asked for access to their personal records. In the 2006 Census, two new questions ask for respondents' permission to access their income tax files and to release their personal information after 92 years. Without permission from each respondent, Statistics Canada will neither access income tax records nor provide files for release in 92 years. Questions left blank will be viewed as a 'no' response.

What happens to census questionnaires?

Census questionnaires will be retained in accordance with legislative requirements and stored securely at Statistics Canada. It takes about six months for the questionnaires to be processed. An individual can request to see the personal information on his/her census questionnaire by writing to: Privacy Coordinator, Statistics Canada, R.H. Coats Building, 100 Tunney's Pasture Driveway, Ottawa, Ontario, K1A 0T6.

If an individual wants to see a household questionnaire, then every person in the household aged 14 years and older would have to give their permission to have their personal information made available.

Handling of questionnaires

In 2006, approximately 96.5% of households either self-enumerated online or by completing the paper questionnaire and mailing it back, or were enumerated by telephone interview or at their home. These households provided information for all members of the household as it pertained to Census Day, May 16.

If the questionnaire was completed on paper, the respondent returned it by mail in a pre-addressed yellow envelope to the Data Processing Centre. The questionnaire was then scanned and verified for completeness in an automated manner. If a questionnaire was completed and returned online, the information was directly submitted into the Data Processing Centre system and did not need to be scanned, but was verified for completeness.

The information in census questionnaires is seen by only the small number of employees who handle the questionnaires in the course of their duties.

Since the 2001 Census, the image of each questionnaire was placed in a database to speed up processing and simplify storage. The questionnaires were destroyed as soon as this operation was completed. Access to the questionnaire images is restricted, just as access to the completed forms was in previous censuses.

Confidentiality of information provided online

For the first time, the 2006 Census offered all households in Canada the option of completing their census questionnaire online.  

To protect the information online, the following safeguards have been incorporated:

• Encryption – the scrambling of data into a code that is unreadable to anyone who does not have the key to decipher the information. The multiple encryption technologies used by Statistics Canada offer one of the highest levels of encryption security available anywhere. These encryption methods include:
  • bi-directional encryption technologies that ensure end-to-end security of data passing between your PC and our Web server
  • encryption methods based on secure socket layer (SSL) and on a public key infrastructure (PKI).
• Once the information arrived at Statistics Canada, it was electronically isolated using firewalls and independent verification. It is inaccessible by any outside link, personnel or organization.

Protection of disseminated statistics

By law, Statistics Canada can use the responses in census questionnaires for statistical purposes only. The responses are inputted into a database—with no names, addresses or telephone numbers—and that database is used to prepare a variety of products for distribution.

Procedures are followed to ensure that the statistical data in those products cannot be associated with a particular individual.

Random rounding

Rounding is a mathematical operation that can increase a number, decrease a number or leave it unchanged; only certain predetermined values are permitted. For example, we could decide in advance to round figures to the nearest multiple of 10, the next highest multiple of 10, or the next lowest multiple of 10. So, if we round 10, 13 and 17 to the next lowest multiple of 10, the result would be 10 in all three cases.

The random rounding method is based on established probabilities. It involves rounding every figure in a table (including the totals) randomly up or down to the nearest multiple of 5, or, in some cases, 10. For instance, random rounding of 12 to a multiple of 5 would yield either 10 or 15; applying the same operation to 10 would produce 10. This technique provides strong protection against direct, residual or negative disclosure, without adding significant error to the census data.

Area suppression

Area suppression involves removing all characteristic data for geographic areas with populations below a specified size. A table is always associated with a geographic area, viewed from either the 'place of residence' standpoint or the 'place of work' standpoint. Also, for place of residence, the threshold depends on the number of people who live in the area, and for place of work, it depends on the number of people who work in the area. When a table involves both place of residence and place of work, the threshold depends on both the number of residents and the number of people employed in the area.

There are different thresholds for different cases:

• 250 people, if the table contains income data, and if the table also contains place-of-residence data, at least 40 private households
• 100 people, if it is a six-character postal code area, that is, a local delivery unit (LDU), or if it is a custom area
• 40 people, in all other cases.

Dissemination rules for statistics

Tables are sometimes accompanied by statistics such as averages, totals and standard deviations. There are various ways of ensuring that these statistics do not reveal sensitive information; for instance, they may be suppressed or made less precise. Some statistics, such as totals, ratios and percentages, are based on the rounded values in the tables to which they apply. A statistic will be suppressed if there are too few data to compute it. In cases of data items expressed in dollars, if the statistic must be calculated from data where the values are too close or if a value is too high compared to the others, then the statistic will be suppressed.

Since the 2001 Census, households, and their associated population and dwelling counts, were geographically referenced to the dissemination block at the time of collection. However, the linkage to the dissemination block-face level is a post-collection activity for areas having streets with address ranges. With the introduction of the block program, user-defined areas can be delineated with increased precision.

Only population and dwelling counts are disseminated by the dissemination block (with the dissemination area being the smallest standard geographic area for which characteristic data are disseminated). To ensure confidentiality, population counts are adjusted for dissemination blocks having a population of less than 15.

< Previous page | Table of contents | Next page >