Although the census provides a useful way of obtaining statistical information about the population, such information can sometimes lead to abuses, political or otherwise, made possible by the linking of individuals' identities to anonymous census data. Jointly with
Eotvos Karoly Institute, HCLU criticized the current plan of the National Office of Statistics (hereinafter: Office), because some of its elements are not in line with the rules of data protection. Generally speaking, guarantees of protection of personal data are essential due to the nature of census. First, it is compulsory to provide information, and individuals can be fined for not completing census questionnaires. Fines are applicable when an individual does not fill out the form, as well as for providing false information. Secondly, individual enumeration is full scaled – everyone is counted: citizens, resident, etc. Finally, pieces of information of a sensitive nature are also included in the questionnaire.
The decisive element of the definition of personal data is that it allows for correlation with an individual. Consequently, anonymized data is not regarded as personal data as long as the person behind them can not be identified, because the personification of data is impossible. Data can only be regarded as personal if the correlation could be restored. Under the current data protection rules, collection of data for statistical purposes has to be stripped of its personal nature. In contrast to that, re-identification is the process of linking anonymous data to the actual identity of an individual. The Act of the Census 2011 obliges citizens to indicate an accurate address, which facilitates the process of re-identification. The use of information to identify individuals rather than for the statistical collection of information offers room for abuses of privacy and confidentiality. The mere fact of processing specific addresses – in itself and in correlation with other information – offers easy ways to restore personal data. As a consequence, anonymization is not guaranteed. Even though processing the address is essential for the completeness and correctness of the enumeration, we think that the address should be processed separately from the general questionnaire, and the separate sheet should be destroyed after the evaluation of completeness. Other, more general information on residence might be obtained and processed in anonymous way, so the general goal to survey housing can be fulfilled without the exact address.
Information on ethnicity, on national background, on the state of health and on mental or physical handicap is regarded as special data, because these pieces of information have deeper implications on data subjects, and as a consequence, a higher level of protection is granted. Widespread discrimination of Roma people and tragic historical experiences are the main reasons why individuals refrain from providing information on their ethnic background. The special nature of such data is recognized by the Act: answering related questions is optional. At the same time, one must not forget that it is the fundamental interest of the society to have reliable statistics on its ethnic compound for social policy planning. Furthermore, information on the state of the general public’s health and disabilities are indispensable for medium and long term scheming of core social issues like health care and pensions. (Statistics on religious views are not supposed to bear special importance due to the neutrality of state and the separation of state and church.) Consequently, it is crucial to inspire citizens to answer questions on such data. In order to build public trust, the state has to furnish physical and legal guarantees so that answers to questions about ethnic background, mother tongue, and religion will not make it possible to identify personally any single census respondent. In 2001, when the last census was held, the Office modified its instruction for census-takers to the effect of foregoing the registration of specific addresses by leaving blank the survey boxes for street, house number, floor, and apartment number after having conferred with the Data Protection Commissioner. Obviously, citizens might be concerned about the anonymity if they are required to fill the specific address box. As no one can be forced to answer questions targeting sensitive data, the lack of confidence will result incomplete and unreliable stats. In our view, greater success would result if the sensitive data would be handled separately, and attached only temporarily while the information is elaborated, and destroyed immediately after. Furthermore, it would help to build confidence if the census takers themselves could not come to know this information. In order to achieve this, firstly, census takers should not supervise these answers; secondly, the answers should be closed in a separate envelop. By using an artificially created code, the anonymized general questionnaire and the separate envelop can be attached while the elaboration is taking place.