The Census website crashed as an estimated 16 million people tried to log on on Tuesday. Credit:gizmodo.com.au To them I say: hello, that's the point! It's my health information, not yours. You should ask me nicely, and persuade me about your public interest research purpose, if you want access to my identifiable health records. Maybe then I will say yes. This morning I suddenly realised: the ABS is behaving like a very, very bad boyfriend. He keeps on breaking promises, pushing boundaries and disappointing you, but you forgive him each time. You don't want to call him out in case then he gets angry and dumps you. So you just put up with it, and grumble over drinks to your girlfriends. And this bad boyfriend keeps saying these reassuring things, like "oh we'll only keep the data for four years", and "the names and addresses are in a separate database". To that I say: nice try, but that's a red herring.

Although there are certainly heightened privacy and security risks of accidental loss or malicious misuse with storing names and addresses, the deliberate privacy invasion starts with the use of that data to create a Statistical Linkage Key (SLK) for each individual, to use in linking data from other sources. Please don't believe that SLKs offer anonymity. SLKs are easy to generate, with the same standard used across multiple datasets. For example, Malcolm Turnbull would be known by the SLK URBAL241019541 in the type of datasets the ABS wants to match Census data against, including mental health services (yes, mental health!) and other health records, disability services records, early childhood records, community services records, as well as data about housing assistance and homelessness. Anyone with access to these types of health and human services datasets can search for individuals by generating and searching against their SLK. All you need to know is their first and last names, gender and date of birth. Now tell me that privacy will be absolutely protected if census data is coded and linked using an SLK as well. Never mind four years; the ABS could destroy all the actual name and address data after only four days or four seconds – but if they have already used it to generate an SLK for each individual census record, the privacy damage has been done.

I know that I could give the ABS misinformation instead. Say my name is Boaty McBoatface and that I am a 97-year-old man living with eight wives, that I have 14 cars, my language at home is Gibberish and that my religion is Jedi. Giving misinformation is a common, rational response by about three in ten people who want to protect their privacy when faced with the collection of personal data they have no choice about. Of course, that is also a crime in relation to the census, but at least that one maxes out at an $1,800 fine. But I won't do that, because I do believe in the integrity of the census data. I don't want people to have to give misinformation in order to protect themselves. We shouldn't be placed in that position. I have thought about just refusing to provide my name. But even if I don't give my name, if the ABS is determined to link my census data with other datasets, there would be enough other information in my census answers (sex, age, home address, previous home address, work address) to let them proceed regardless. It won't be enough to protect my privacy. So until the ABS reverses its decision to match census data about individuals with other datasets about individuals, I am not going to answer the Census questions at all. I am sorry, Your Worship. I don't like being forced to choose, because I believe Australians deserve to have both good quality statistical data for government decision-making, AND their privacy respected. But on Tuesday night, I will choose privacy.

The census should be a national snapshot, not a tool for detailed data-linking on every individual. Now convict and fine me if you disagree. Loading Yours sincerely, Anna Johnston Anna Johnston is the Director of Salinger Privacy, and a former deputy privacy commissioner of NSW.