Canada owes the success of its statistical system to the long-standing cooperation between Statistics Canada, the population of Canada, its businesses and its governments. Accurate and timely statistical information could not be produced without that sustained collaborative effort and goodwill. Statistics Canada attaches the highest importance to protecting the confidentiality of respondent information.
By law, Statistics Canada must protect the confidentiality of the information respondents provide on its surveys and censuses. When hired, Statistics Canada employees are screened for reliability and made aware of the confidential nature of the materials they will be handling. All Statistics Canada employees, including enumerators for the 2006 Census, must take an oath of secrecy, and are subject to fines and/or imprisonment should they reveal identifiable information derived from the census. Any possible breach of the confidentiality of census returns is an exceedingly serious matter which would be investigated immediately and thoroughly and be subject to the full force of the Statistics Act.
Contract staff is never in possession of confidential data. Contract staff is only allowed escorted access to Statistics Canada's secure facilities if they have been cleared by security and sworn-in, under the Statistics Act. They are accompanied by a Statistics Canada employee at all times during their visit to any secure facility. Contract employees are not allowed to bring in or take out any electronic devices such as a laptop, CD-ROM, USB key (Memory Stick), etc.
The security of respondent information is of paramount importance to Statistics Canada. Census data are stored on Statistics Canada systems that are isolated from any other network. External connections such as telephone dial-in services (cryptocard, for example) do not have access to Statistics Canada's systems where confidential data are stored: therefore, it is impossible to break into Statistics Canada's databases.
In addition, Statistics Canada has controlled access to its premises so that only persons with the appropriate security clearance and who have taken the oath of secrecy may enter facilities housing confidential data. Any private sector employees who may require entrance to these premises are escorted at all times by a Statistics Canada employee.
Even though respondents are asked to write their name, address and telephone number on the census form, that information is not entered in Statistics Canada's release database. It is used mainly for quality control during the collection, processing and data quality processes.
Names are requested only to ensure that each person is counted once and only once. The telephone number is needed so that households whose questionnaire is incomplete can be contacted. The address is used to make sure that respondents are enumerated at their usual place of residence on Census Day. It is also needed to ensure that, in cases where more than one questionnaire has been completed for a household, all the forms are processed together.
From time to time, Statistics Canada may use the census information to select households or individuals to participate in other important surveys. This is done only after it can be demonstrated that the census is the most cost-efficient and effective means to select the required sample. These uses are strictly for statistical purposes and no one outside of Statistics Canada can have access to any identifiable information.
Statistics Canada also ensures that respondents understand what is involved when they are asked for access to their personal records. In the 2006 Census, two new questions ask for respondents' permission to access their income tax files and to release their personal information after 92 years. Without permission from each respondent, Statistics Canada will neither access income tax records nor provide files for release in 92 years. Questions left blank will be viewed as a 'no' response.
Census questionnaires will be retained in accordance with legislative requirements and stored securely at Statistics Canada. It takes about six months for the questionnaires to be processed. An individual can request to see the personal information on his/her census questionnaire by writing to: Privacy Coordinator, Statistics Canada, R.H. Coats Building, 100 Tunney's Pasture Driveway, Ottawa, Ontario, K1A 0T6.
If an individual wants to see a household questionnaire, then every person in the household aged 14 years and older would have to give their permission to have their personal information made available.
In 2006, approximately 96.5% of households either self-enumerated online or by completing the paper questionnaire and mailing it back, or were enumerated by telephone interview or at their home. These households provided information for all members of the household as it pertained to Census Day, May 16.
If the questionnaire was completed on paper, the respondent returned it by mail in a pre-addressed yellow envelope to the Data Processing Centre. The questionnaire was then scanned and verified for completeness in an automated manner. If a questionnaire was completed and returned online, the information was directly submitted into the Data Processing Centre system and did not need to be scanned, but was verified for completeness.
The information in census questionnaires is seen by only the small number of employees who handle the questionnaires in the course of their duties.
Since the 2001 Census, the image of each questionnaire was placed in a database to speed up processing and simplify storage. The questionnaires were destroyed as soon as this operation was completed. Access to the questionnaire images is restricted, just as access to the completed forms was in previous censuses.
For the first time, the 2006 Census offered all households in Canada the option of completing their census questionnaire online.
To protect the information online, the following safeguards have been incorporated:
By law, Statistics Canada can use the responses in census questionnaires for statistical purposes only. The responses are inputted into a database—with no names, addresses or telephone numbers—and that database is used to prepare a variety of products for distribution.
Procedures are followed to ensure that the statistical data in those products cannot be associated with a particular individual.
Rounding is a mathematical operation that can increase a number, decrease a number or leave it unchanged; only certain predetermined values are permitted. For example, we could decide in advance to round figures to the nearest multiple of 10, the next highest multiple of 10, or the next lowest multiple of 10. So, if we round 10, 13 and 17 to the next lowest multiple of 10, the result would be 10 in all three cases.
The random rounding method is based on established probabilities. It involves rounding every figure in a table (including the totals) randomly up or down to the nearest multiple of 5, or, in some cases, 10. For instance, random rounding of 12 to a multiple of 5 would yield either 10 or 15; applying the same operation to 10 would produce 10. This technique provides strong protection against direct, residual or negative disclosure, without adding significant error to the census data.
Area suppression involves removing all characteristic data for geographic areas with populations below a specified size. A table is always associated with a geographic area, viewed from either the 'place of residence' standpoint or the 'place of work' standpoint. Also, for place of residence, the threshold depends on the number of people who live in the area, and for place of work, it depends on the number of people who work in the area. When a table involves both place of residence and place of work, the threshold depends on both the number of residents and the number of people employed in the area.
There are different thresholds for different cases:
Tables are sometimes accompanied by statistics such as averages, totals and standard deviations. There are various ways of ensuring that these statistics do not reveal sensitive information; for instance, they may be suppressed or made less precise. Some statistics, such as totals, ratios and percentages, are based on the rounded values in the tables to which they apply. A statistic will be suppressed if there are too few data to compute it. In cases of data items expressed in dollars, if the statistic must be calculated from data where the values are too close or if a value is too high compared to the others, then the statistic will be suppressed.
Since the 2001 Census, households, and their associated population and dwelling counts, were geographically referenced to the dissemination block at the time of collection. However, the linkage to the dissemination block-face level is a post-collection activity for areas having streets with address ranges. With the introduction of the block program, user-defined areas can be delineated with increased precision.
Only population and dwelling counts are disseminated by the dissemination block (with the dissemination area being the smallest standard geographic area for which characteristic data are disseminated). To ensure confidentiality, population counts are adjusted for dissemination blocks having a population of less than 15.