The decision by the Australian Bureau of Statistics to include personal identifiers on ballot papers for the same-sex marriage postalvote has sparked concerns from privacy experts that answers may not be kept secret.
On Monday the ABS revealed that the ballot papers asking if Australians want the law changed to allow couples of the same sex to marry, to be mailed out from 12 September, will contain barcodes to identify responses.
The statement addresses concerns that, without personal identifiers, the survey would be vulnerable to fraud and multiple voting but contradicts an ABS statement on Thursday that no personal identifiers would be used. No reason was given for the change in policy.
On Monday the ABS said it would “keep the identity of all respondents separate from their survey responses at all times”.
“The barcode on the survey form will be used for ‘mark-in’ purposes only and is a single-use, anonymous, code.
“No person who sees or has any access to any completed forms will know both the name of eligible Australians and the related single-use code.”
The ABS said it would record the response and the electoral division of the voter but “there will be no linkage of survey responses to other data”.
Monique Mann, co-chair of the surveillance committee of the Australian Privacy Foundation, said if the barcode correlated to a voter and a postal address “[the ABS would] quite readily be able to link that information”.
She said it was not clear what arrangements the ABS would make to silo information, separate and de-identify it but “it’s questionable that the information is secret, if it’s attached to a barcode”.
The ABS said survey responses would be “anonymous and protected under the secrecy provisions” of the Census and Statistics Act. These include the threat against ABS officers that they could face fines of up to $21,600 or imprisonment for up to two years, or both, if convicted of breaching a mandatory secrecy undertaking.
Mann said use of identifiers exposed the ABS to the risk of data breaches, either through hacking or an “insider threat” from officers with access. Secrecy provisions were “incredibly difficult to enforce”, because people would not necessarily be notified if their vote was accessed, Mann said.
“There is a real potential for a chilling effect – if people believe that their vote in the survey not secret, that may influence the way they choose to vote, or indeed if they vote at all.”
Mann accused the ABS of “flying by the seat of their pants” for first promising no personal identifier would be issued before quietly removing that assurance from their website on Friday.
The director of the privacy law practice Salinger Privacy, Anna Johnston, said the fact the ABS had changed position showed “a disturbing lack of proper consideration of the privacy impacts of the same-sex marriage survey”.
“That privacy promises made one day are withdrawn the next is not a good look for an agency asking us to also trust … their word that they won’t use same-sex survey data for any other purpose.”
Johnston said since the ABS had created statistical linkage keys for the 2016 census, which allow census responses to be linked to an individual, “the level of data security risk has increased exponentially” at the agency.
She said when it ran the 2016 census the ABS argued that “everything they collect is statistical info … which they can use for data matching without any further limitations”.
Johnston said the Census and Statistics Act “doesn’t really place limitations on how the ABS uses the data once they’ve got it”, meaning voters would have no means of enforcing the ABS promises their vote would not be accessed.
She said there was an “insider threat” because “ABS staff are not infallible”, citing the fact a former ABS employee had been convicted of insider trading using ABS data in 2015.
Asked about the risk the vote would not be secret, the acting special minister of state, Mathias Cormann, told Senate question time the Australian statistician had given him assurances there would be “no capacity for anybody” to identify how an Australian has voted in the postal survey.