Demographics and privacy
This guideline provides information about the collection of demographic data and its potential impact on an agency’s obligations under the Information Privacy Act 2009 (Qld) (IP Act).
Demographics are statistical data relating to the population and particular groups within it.1
Example
Demographic characteristics include a person’s age, gender, postcode, country of birth, indigenous status, occupation, disability status, language spoken or religious affiliation.
Obtaining and analysing the demographics of an agency’s customers can be a useful tool to inform and guide policy development, service planning and quality improvement activities.
When is information personal information?
Personal information is defined in section 12 of the IP Act. It is a broad definition that encompasses any information about an individual who can be identified directly from the information, or whose identity can be reasonably ascertained from that information. It includes information which directly identifies an individual and information that can be compared or cross-referenced with other information to identify an individual.
Demographic characteristics may qualify as ‘sensitive information’2 under the National Privacy Principles (NPPs).3 NPPs only apply to health agencies4. When health agencies collect demographic information they should be mindful of the potential obligations arising under the NPPs.
Generally, demographic information in itself does not identify a particular individual. However, there may be circumstances where an individual’s identity is ‘reasonably ascertainable’ from demographic information due to the combination of demographic characteristics.
For example, some Queensland postcodes have very small populations, sometimes with only a few hundred individuals. If an individual with a ‘rare characteristic’ resides in such a postcode, this may make the identification of this individual a relatively easy task. Reducing the precision of the characteristic, such as collecting an individual’s age group instead of their age, may lessen the likelihood of identification.5
Collecting demographic information
Is the ‘demographic purpose’ a lawful function or activity of the agency?
Under Information Privacy Principle (IPP) 1 and NPP 1, agencies must have a lawful purpose for collecting demographic information and this purpose needs to be directly related to a function or activity of the agency.
The agency should have a specific purpose in mind for the demographic information before collecting it. Collecting personal information the agency thinks may be useful at some time in the future is a potential breach of the privacy principles relating to collection.
A clearly defined purpose is fundamental to identifying what information needs to be collected.
Is the information being sought relevant for the purpose it was collected for?
IPP 3 requires that when an agency collects personal information, that the information must be relevant to the purpose for which it is collected and that it is not an ‘unreasonable intrusion into the personal affairs of the individual’. NPP 1 requires health agencies to collect information in a way that is not unreasonably intrusive.
Arguably, a lot of demographic information, for example marital status, does concern the personal affairs of individuals. People can consider demographic questions to be highly personal and/or intrusive6 and there is the potential for this to affect the way they engage with the agency, for example they may provide false information.
An agency should give careful consideration to what demographic information is relevant to the identified purpose and only collect information that is necessary to fulfil that purpose.
Think about what you plan to do with the information. Can you explain why each piece of information is necessary to achieve the purpose for which you are collecting it?
Example
The Department of Small Furry Animals has difficulty in getting pet mouse owners to register their mice.
The Department intends to collect demographic information to identify whether improvements could be made to communication methods used to advise the community of the need to register their mice.
In this example, it might be relevant to collect information about an individual’s preferred language or the individual’s capacity to access the internet. This may assist the Department in analysing whether there is any need to provide application forms in multiple languages or in digital form.
However it would not be appropriate to collect information about an individual’s religion or sexual orientation as this information would not assist in improving communications.
Does the primary collection notice cover off the purpose for collection of the demographic information?
IPP 2 requires that agencies take all reasonable steps when collecting personal information from an individual to ensure that the individual is generally aware of:
- the purpose of the collection
- any law that might authorise or require the collection; and
- to whom the information may be passed onto.
This information is often referred to as a 'collection notice'.7 Collection notices do not have any standard wording and are usually crafted for each particular collection.
Agencies often collect demographic information at the same time they are collecting other information which does identify an individual, such as their name or address. Questions seeking demographic information may not be obviously related to the purpose provided in the collection notice and can give rise to suspicions or concerns. While convenient, the demographic information is likely to be used for a different purpose to the other collected information.
Care needs to be taken to ensure that an individual is made aware of the differing purposes and what information will be used for which purpose.
The collection of demographic information is secondary to the collection of personal information related to a function or activity of the agency. The purpose for collecting the demographic information may be different from that of the primary collection. While it is convenient to collect demographic information at the same time as other information, the demographic component will require a specific collection notice or a specific reference in the primary collection notice explaining the purpose of the collection of the other information.
The following example is a collection notice that covers off two different purposes: the first, to provide updates about community consultations; the second, to assess whether there is balanced and inclusive participation in the agency’s community consultation process.
Example
We are collecting your personal information for the purpose of informing you about new community consultations that you can get involved in and to send you regular updates on the progress of programs and projects that are the subject of the consultations.
We are also collecting demographic information, such as your age, gender and cultural background so that we can identify whether we can improve the way in which we support engagement with culturally and linguistically diverse communities and other target groups such as women and seniors.
Is provision of the demographic data optional?
Where a form is used to collect information for more than one purpose, it is important that an individual can clearly identify what information will be used for which purpose. As the provision of the demographic information will usually be optional, the individual should also be assured that their non-provision of demographic information will have no adverse impact on the primary purpose for the collection.
A practical approach is to provide the demographic questions in a separate area of the form, such as a a feature box, table, or separate page. This makes it is clear to the individual what information is being used for which purpose.
The following example is a collection notice that incorporates advice that the provision of demographic information is optional and will not be used to fulfil the primary purpose for the collection.
Example
We are collecting this information to identify whether we can improve the way in which we support engagement with culturally and linguistically diverse communities and other target groups such as women and seniors.
Providing this information is optional and will not affect our agency’s consideration of any feedback you provide on programs and projects that are the subject of the consultations.
- 1 Oxford Dictionary, Oxford University Press. http://www.oxforddictionaries.com/definition/english/demographics (accessed 31 October 2013).
2 See the definition of ‘sensitive information’ in Schedule 5 of the IP Act.
See NPP 9.
3 Other agencies are required to comply with the Information Privacy Principles.
4 For more information on tools and techniques for de-identifying data refer to OIC’s Guideline: Dataset publication and de-identification techniques.
5 In the National Privacy Principles, some demographic information will fall within the definition of ‘sensitive information’, which attracts additional protections.
6 NPP1 (3) places these and additional obligations on health agencies.
7 For more information on collection notices refer to OIC’s Guideline: Collection notes – making people generally aware and Basic Guide to NPP 1 for health agencies
Current as at: March 5, 2014