Census

The census returns, privacy, and questions of governance

A submission by the Privacy Commissioner of Canada to the Expert Panel on Access to Historical Census Records

February 9, 2000

The Privacy Act does not prevent the 1906 and 1911 census records from being released to the National Archives. Nonetheless, the proposal to release census records raises important issues of privacy. It also raises important issues of governance.

This is not an question of an "individual" interest in privacy against a "societal" interest in research. Privacy is not simply an individual right, but a public right, of value to society. Implications for privacy are implications for society.

Privacy protection is based on the notion that people have a right to control their personal information: to know why it is being collected, how it will be used, how long it will be kept, and who will have access to it. Use of information for purposes other than those for which it was collected should be subject to consent.

What is being proposed would violate these fundamental principles. Information collected for one purpose, which should have been disposed of after its statistical purpose was fulfilled, would be used for another, and disclosed to third parties, without consent.

Census information can be extremely personal, including genetic and other health information about respondents and their families. We should not decide for other people what constitutes an acceptable disclosure of such information.

Census response has rested on a balance between coercion and confidentiality. Respondents agree to answer intrusive questions, on an understanding that the information will be used for specific purposes, and no other. The instructions that the census returns were to be confidential and only for statistical purposes are unambiguous.

The proposal to change the law retroactively eliminates this balance. This is an issue for all Canadians, with implications for all of their relations with government.

Should the Panel decide to recommend the release of the records, the privacy impact could be reduced by using a cut-off date, after which the census materials would not be so critical to research. Census returns from before that date could be transferred to the National Archives and made subject to a set of rules; those after would be destroyed.

If the Panel recommends that future census returns not be kept confidential, an "opt-in" consent model would allow respondents the choice to consent to have their returns retained and released after 92 years.

If the Panel decides that the system should be changed retroactively, it is urged that the process be transparent, and that every Member of Parliament have the opportunity to speak to it.

Some of you may wonder what I am doing here.First, I would like to clear up a possible misconception. As the Privacy Commissioner, I am responsible for the administration of the Privacy Act. It is not the Privacy Act that prevents 1906 and 1911 census records from being released to the National Archives. Indeed, proponents of the release of the information maintain that removing the legislative impediment, a "legal technicality in an outdated piece of legislation," would simply bring things into line with the Privacy Act. The Act, after all, permits the release of personal information to the National Archives for archival purposes, and permits institutions to release material for statistical and research purposes. The Privacy Regulations pursuant to the Act permit the release of census material after 92 years.

I am appearing before the Panel nonetheless, because the proposal to release census records gathered from Canadians under a promise of confidentiality raises important social issues: issues of privacy, despite the limitations of the Privacy Act, and more generally, issues of governance. As Privacy Commissioner, I am happy to talk about the privacy issues, to try to emphasize and clarify them, to try to ensure that they receive the attention and understanding they deserve. As a citizen, I am compelled to comment on the issues of governance, because they go to the fundamentals of the relationship between Canadians and their government.

Census returns in Canada up to and including 1901 were not covered by a legislative guarantee of confidentiality. There was thus no impediment to their being released by the National Archives in accordance with the "92-year rule" under the Privacy Act.

The Privacy Act appears to indicate that census returns can be considered privacy-neutral after 92 years. The information in them may still be personal—the Act considers that personal information continues to be such until 20 years after the death of the person, and it may well be less than 20 years since some of those census respondents died—but it can be released by the National Archives nonetheless. From a strictly legal point of view, the Privacy Act does not present any impediment to the release of the information. Only the legislative promise of confidentiality, made by the Government in 1905 and repeated in every census since, stands in the way. If that is the case, why is the Privacy Commissioner concerned? The promise of confidentiality flows from the Statistics Act, not the Privacy Act, and is the concern of Statistics Canada, immediately, and Parliament, ultimately. What privacy concern could conceivably attach to census returns that meet the 92 year rule?

The answer is simple enough. As the Privacy Commissioner, I am mandated to administer monitor the administration of the Privacy Act, but my responsibility does not stop there. My job, to quote my own communications staff, is to be "Parliament's window on privacy issues, arming it with the facts needed to make informed judgements through research and communications."

The Privacy Act is a good, workable data protection statute, but it is not perfect, and it is not the last word on privacy protection principles. (One of the amendments included in our proposal for reform of the Privacy Act is that there be no limitation of a person’s right to privacy, whether they are living or dead.) Given what is at stake here—the disclosure by the state of citizens’ personal information, without consent, and contrary to what was stated to be the only use of the information when it was collected—I would urge the Panel to look farther than the explicit provisions of the Privacy Act. I will have more to say below about the promise of confidentiality and the issue of retroactive legislative change. But for the moment I want to focus the Panel’s attention on the privacy issues at stake, because an examination of the Privacy Act does not exhaust the issue. The question before the Panel is not, "Is this permitted under the Privacy Act?" Anyone who can read the statute can answer that. The question is, "Is this an acceptable violation of privacy?" The answer to that question has as much importance for governance, for the relations between Canadians and their government, as the question about confidentiality and retroactive legislation.

First, I want to ensure that the Panel understands the nature of the privacy interests at stake, and for this I ask that you forgive what might seem like an academic digression.

This debate has been too often presented as being about the point at which a "personal" or "individual" interest in privacy should cede to a "public" or "societal" interest in genealogical and historical research.

This facile dichotomy holds up poorly under scrutiny. For one thing, there is nothing self-evident about the claim that organizational interests—the interests of genealogists and historians—are somehow privileged as "social." More fundamentally, the dichotomy underplays the social importance of privacy interests. Because despite the appeal of the image of the embattled individual squaring off against the Leviathans of state, society, or commerce, privacy is best understood not simply as an individual right but as a social, collective value—a public interest, a public right.

Though we tend to forget it, this is the way privacy has been theorized by its leading scholars and proponents, those who have emphasized the fundamental link between privacy and freedom. Privacy is not an individualistic quirk, but a shared, common value, held by all of us to some degree, however we define, understand, or delimit it. It is a cornerstone of an effective liberal democracy, permitting, in its relationship with freedom of thought, the development of individual identity and autonomy essential to democratic participation. At the same time, and perhaps paradoxically, it permits the development of a political community, by enabling a clear distinction between public life and private lives, ensuring that individual differences can be relegated to the private sphere and commonality can be expressed in the body politic.

Finally, privacy is not a matter that can be left up to individuals to establish, protect, and, if they like, barter away. Increasingly, if any of us are to have any privacy, it has to be established and protected at a certain minimum level for all of us.

The point of all this is to stress to the Panel that in the current debate, it is not just the privacy of individuals that is at stake. The historians and genealogists who want access to the census materials do not have an exclusive claim to represent the public interest or express a public right. Privacy is also a public right; privacy interests are also social interests. What is facing the Panel is more than a decision about the privacy of the respondents to the 1906 or 1911 census. The Panel’s decision will have implications for their privacy, but also for the privacy of all Canadians. And implications for privacy are implications not just for individuals, but for the collective good: for society.

What privacy principles, then, are at issue?

At the heart of any conception of privacy, and any code of privacy protection, lies the notion that people have a basic right to control their personal information. What this means, in concrete terms, is that when the government comes to collect information from people, they have the right to know why the information is being collected, how it will be used, how long it will be kept, and who will have access to it. The government has an obligation to tell them, and then proceed accordingly. This means that the government may use the information only for the purposes for which it was collected. And if personal information is going to be given to third parties, people need to be told that at the time it is collected. If they were not told that, release of the information to third parties should be subject to their consent.

Release of the information collected through the census violates the principle that information collected for one purpose should not be used for another without consent. The very fact that the census returns have been retained, long after their explicitly stated statistical purpose has been fulfilled, violates the principle that information should be disposed of after it has been used in the way it is supposed to be. The disclosure of the information to third parties, without the explicit consent of the people who provided the information, violates the principle of finality.

So, the very nature of what is being proposed violates fundamental principles of privacy protection. Again, I remind the Panel that we need to look at more than the strict legality of the Privacy Act. These principles of privacy protection did not originate with me or my office. They are widespread and basic, found in one form or another in every data protection statute, sectoral code, and company privacy policy.

But this is only part of the picture. To understand the impact of these violations, we have to recall the nature of the information gathered in the census, and the possible implications of that information for both census respondents and their families—what is being revealed, and, in both the direct and the larger senses, about whom.

Questions asked in censuses have become increasingly intrusive over the years. Already in the 1906 and 1911 censuses, they went well beyond mere head-counting. In the 1905 Census and Statistics Act, the details required in a general (decennial) census included "name, age, sex, colour, social condition, nationality, race, education, religion, occupation and otherwise," as well as earnings. Questions on topics ranging from relationships, disabilities, languages, ancestry, education, household activities, employment, income and dwelling were progressively added from one census to the next.

It is important to put a human face on these questions. Those who consider the privacy intrusion to be minimal should look at the questions, and imagine their or their relatives’ responses to them publicized freely. Even in the relatively short list from the 1905 Census and Statistics Act, questions about ethnic origin, education, religion, or occupation might easily raise sensitive issues among respondents. Information about criminal activity or conviction, religious conversion, adoption, or abandonment—to take just a few extreme examples—are not necessarily the kind of thing anyone wants revealed about themselves or about their family. One has only to look at the long and intense debates about the rights of adopted children to know the identity of their parents to see that these questions are not necessarily innocuous.

If we jump through the years to the 1996 census and to proposals for the 2001 census, we see, for every member of a household, questions concerning marital status (including same-sex partnerships), birthplace, citizenship, ethnic identity, religion, and source of income, including social assistance. Respondents are asked to indicate limitations on activities, at home or at work, from physical or mental conditions or health problems. Women are to indicate how many children they have had. The number of hours doing unpaid domestic work has to be estimated. Labour market activities, including efforts to find work, must be indicated. Information about housing includes a question about who pays the rent or the mortgage. Again, it does not take a great deal of imagination to see how such information could be deemed extremely personal, and not just by the individual respondent.

One of the issues that needs to be addressed is that of genetic and other health information that can be extracted from the census records. It has been pointed out to me that one interest in the census material is that of genetics and health researchers hoping to determine the nature and tendency of the risk of hereditary diseases. It is argued that the construction of genealogies may make it possible to reconstitute harmful gene transmission circuits or estimate the probability that such genes will be disseminated among offspring and families.

Although I recognize the potential value of this information, I also recognize that the use of this knowledge may lead to serious breaches of privacy. The uncontrolled disclosure or dissemination of information about individuals, who are related to subjects with hereditary diseases, may create unforeseen risks or lead to erroneous conclusions. One need only think of the potential for linking these data with the information of prospective insurance company clients. Even leaving aside that possibility, this is extremely sensitive information.

Proponents of release of the census information refer frequently to the "right" of Canadians to know their past. But to know things about our ancestors is sometimes to know things about ourselves. What of the right not to know those things? This is not, as the Globe and Mail claimed, an "anti-intellectual bias" of mine. We need to consider that people often have a legitimate interest in not knowing certain information about themselves. It is generally recognized, for example, that genetic testing for disease predisposition or biological kinship should be a matter of individual choice. At the very least it is a matter for debate. Yet historical research, including some proposed for the census returns in question, can bring exactly this kind of information to light, without the consent of any of the affected people.

So this is the kind of information that could be revealed, and these are the possible extent of its effects.

In order to fully understand the privacy issues, however, another aspect must be considered. That aspect is this: the decision about what constitutes an unacceptable intrusion into private affairs is an individual one. It varies with individual circumstances and individual definitions of the private sphere. This comes back to the fundamental principle of privacy noted above: that individuals have a basic right to control their personal information.

What is an unacceptable intrusion for one person may not be for another. I may be unconcerned with someone knowing my income; someone else may object strenuously. I may guard jealously information about my education; someone else may see it as inconsequential. The point is that while, as noted above, each of us has some notion of privacy, that notion varies from one to another. While social life dictates some restrictions on that control, privacy principles allow, to the greatest degree possible, individuals to decide what information is important to them, and how much public knowledge of their personal information they are prepared to consent to.

We need to be very careful about presuming to make those decisions for other people—about deciding, perhaps based on our own notion of privacy, what constitutes an acceptable disclosure without consent.

I have tried here to show the intrusiveness of the census questions, to show that responding to them is not something that the average Canadian would automatically view with indifference or equanimity.

My office has had occasion to discuss census questions with Statistics Canada over the years. On some occasions we have recommended that particularly intrusive ones be removed from future censuses. But iIn general, Statistics Canada manages strives to strike a reasonable balance between the value of a census to the nation and the healthy reluctance of citizens to provide detailed information about their private lives. It has been able to do this, I would argue, because it has been able to guarantee the confidentiality of the process. But whether it succeeds or otherwise, its guarantee of the confidentiality of the process is seen by its authors as essential to obtaining a satisfactory level of response.

The response rate is extremely good. Something like 96 percent of Canadians complyIn 1991 and 1996, more than 97% of census respondents complied when summoned to answer the intrusive questions sent to them by Statistics Canada. This compares favourably with the U.S., where the response rate for the last census, in 1990, was only 63 percent.

Response to the census is compulsory; failure to comply can have punitive consequences, including fines or imprisonment. Is this a factor behind the high response rate? To some degree, probably, yes. The state’s coercive arm usually is effective, especially where there is no financial incentive for non-compliance.

But the state’s coercive arm can also be twisted by the electorate. If the census really rested only on naked force, if Canadians were told to answer intrusive questions simply under threat of fine or imprisonment, they would have the option of refusing—not at census time, but at election time.

This is the essential issue of governance raised by the census: responsible government. Government based on the consent of the governed.

I don’t really know if Canadians would bring down a government over the issue of a census. As a Privacy Commissioner, I like to think that privacy would mean that much to them. Others might scoff at the idea.

But the point is that it has never come to that, becauseHowever, the naked, coercive arm of the state has not been the only basis of census response. The census questions are given to Canadians with the understanding that the information will be confidential. Census respondents consent to answer intrusive questions, and their consent is based on a particular understanding: that the information will be used by Statistics Canada for specific purposes, and neither disclosed to nor used by anyone else for any other purpose.

This is the basis on which Canadians, since 1906, have consented to answer the Government’s intrusive questions. In exchange for confidentiality, they have agreed to respond to the census.

And now the proposal is to retroactively remove the basis of that consent. The past will be altered. It will be as though the basis of the censuses were never a balance between coercion and consent, but simply coercion. But because it is retroactive, the right of those Canadians, had they been confronted with pure state coercion—the right to hold the Government responsible, the right of electoral political protest or other forms of action—is stripped from them.

This might be said to be Statistics Canada’s issue. Statistics Canada considers the confidentiality provisions of the Statistics Act to be one of the most effective ways it has to secure the cooperation of census respondents. It has expressed concern that a retroactive amendment to the legislation might diminish the public’s confidence in the agency.

While I sympathize with the specific concern of Statistics Canada, I do not think that it is just their issue or just limited to the census. I think that this is an issue for all Canadians, with implications for all of their relations with government. Retroactive amendment of this sort diminishes confidence, not just in specific agencies, but in government that professes to rule with the consent of the governed. Are we prepared to trivialize the pact between the government and the governed?

The proposal to amend the Statistics Act retroactively and release the post-1901 census records is said by its proponents to be innocuous. The promise of confidentiality is said to be "a legal technicality in an outdated piece of legislation," passed in another time "with entirely different notions of the state, public policy, research, and government accountability." Some have cast doubt on the validity of the promise, or have denigrated it, suggesting that if in fact it was made, it was simply for some grimy political purpose. Others have suggested that it means less than it says, that it was simply intended to assure people that the census representatives would do their job professionally, that none of those census respondents really understood it to mean that the information would be permanently inaccessible. It is observed that there was no outpouring of objection from census respondents or their families when the censuses of 1891 and 1901 were released. And besides, most of those people who filled out census forms in 1906 and 1911 are too old or too dead to matter anyway.

These contentions would be laughable in other circumstances. But because they are made by historians, they are not laughable. They are deeply troubling. In my view, they are inconsistent with the principles of historiography and ofideals of academic endeavour in general.

Historical argument, as Jacques Barzun once once wrote, is based not on plausibility or possibility, but on probability. And probability is based on evidence, not on supposition or sophistry.

What the Regulations for the 1906 and 1911 censuses said (and, with very minor differences, what they said for the 1906 census) was this: "Every officer or other person employed in any capacity on census work is required to keep inviolate the secrecy of the information gathered by the enumerators and entered in the schedules or forms. An enumerator is not permitted to show his schedules to any other person…[T]he same obligation of secrecy is imposed to commissioners and other officers or employees of the outside service, as well as upon every officer, clerk or other employee of the Census and Statistics Offices at Ottawa. The facts and statistics of the census may not be used except for statistical compilation, and positive assurance should be given on this point if a fear is entertained by any person that they may be used for taxation or any other object."

This was the regulation approved by the Governor in Council and published in the Canada Gazette, as required by the Census and Statistics Act.

Second-guessing Parliament, trying to determine what Parliament intended when it legislated, is tricky ground, where judges walk with great care. So should historians. Not one of the historians or genealogists who has publicly spoken to this issue has offered evidence in support of the proposition that the promise made to Canadians by Parliament, in regulations and in legislation, meant anything other than what it said.

Compare this with what was promised in the last census, in 1996: "The confidentiality of your census form is also protected by law. All Statistics Canada staff take an oath of secrecy, and only employees who work with census data see your form. Your personal census information cannot be given to anyone outside Statistics Canada—not the police, not another government department, not another person. That This is your right."

At the very least, if the decision is taken to amend the Statistics Act, this clear undertaking can be removed from future censuses, such that census respondents are under no illusion as to what is asked of them, and can act accordingly. The same cannot be done for the past.

Statistics Canada has developed two options for dealing with the current impasse. One is for Parliament to amend the Statistics Act such that future censuses will carry the same promise of confidentiality. The other is for legislation to remove retroactively the promise of confidentiality made in past censuses, and to see that it is never promised again. The genealogists and historians have indicated that the first option is unacceptable. I hope I have been as clear about my opinion of the second.

I have spoken and written on this issue a number of times, and my position today is consistent with what I have said in the past. The information in census returns is collected for a specific, stated purpose. In keeping with fundamental principles of privacy and data protection, the information should only be used for that purpose. Furthermore, once that purpose has been achieved, the information should be destroyed. Keeping the information around after its stated use (the use that Canadians consented to) has been completed serves no purpose and invites other demands for it, demands that are unrelated to the original purpose. This is "function creep," which I and other privacy advocates have talked about over the years. The current proposal by the historians and genealogists illustrates it nicely.

That said, I do not in any way want to dismiss competing legitimate views.

In trying to think of ways that this issue might be resolved, I have tried to go beyond the positions of the historians and genealogists, to determine exactly what their interests are in the release of the census returns. I have been unable to get very far, largely because they have not made any attempt to justify their position. I know of few other debates, about personal information or any other subject, that have been quite so riddled with unsubstantiated assertions about mysterious "rights"— the "right" of genealogists to satisfy their curiosity about their origins, the "right" of historians to conduct research into other people’s lives.

One question that would have benefited from the historians defending their claim is whether it is necessary to release the information with the names of the respondents, or whether depersonalized information would suffice. We know why the genealogists want the names of the individual census respondents, but we do not know exactly why the historians need it. If we knew that in fact their research needs could be met by depersonalized data, we might be able to look at it as an option. There is a question as to whether depersonalized data would actually be anonymous, given the number of ways in which identity can be reconstructed from things like birthdate, occupation, and unique characteristics. But be that as it may, it is at least an option that could be considered. Unfortunately, we have never got that far, because we have been presented with an all-or-nothing proposal.

If the Panel decides, preferably after having heard the historians back up and clarify their claim, that the release of the census returns is acceptable in spite of the massive privacy violation, may I ask at least that the Panel consider a compromise that will to some degree reduce the impact on privacy.

The compromise would involve first looking more closely at the census records in light of other available sources of the kinds of information historians and genealogists seek. It may be that, with respect to the early years of the 20^th century, the objectives of genealogists and historians simply cannot be met without their having access to the census materials. If their questions cannot be answered by any other means, the Panel may decide to accept that the information should be made available to them.

Using this approach of comparing the census materials with other available sources of information, it should be possible to establish a cut-off date, after which the census materials would not be so critical to the historians’ and genealogists’ work. This reflects my understanding of Statistics Canada’s own experience with searching census returns to support pension applications. There has been steadily less demand for this service because over time the Canadian population has become better and more widely documented.

The Panel may wish to consider the option of having census returns from before the cut-off date released to National Archives, where they would be available to researchers after the 92-year period set out in the Privacy Act. Census returns after that date, their legitimate statistical use fulfilled, would be destroyed, as would future census returns.

My staff’s research suggests that 1966 would be a reasonable cut-off date. By the time of the 1971 census—one of the most intrusive of all Canadian censuses—Canadians were well-documented elsewhere, in vital statistics registers, in birth registers, and through the Social Insurance Number. The justification, such as it is, for opening the census records to researchers would not be sustainable from 1971 onwards. These records, then, could be destroyed.

If the Panel is prepared to accept this compromise, I would also urge it to go one step farther, and consider whether "tombstone" data can be isolated from the more intrusive details. Even if the Panel rejects the compromise, I would urge it to consider this, especially for the censuses from 1971 on, when 1 of every 5 respondents was required to fill out the extended census questionnaire. As a basic principle, the least intrusive measure that will achieve the objectives should be tried first, with more intrusive measures considered only if the less intrusive are insufficient.

The Panel may wish to go further than this, and recommend that Parliament amend the Statistics Act such that future census returns are not kept confidential, and may find their way into the National Archives for eventual use by researchers. If this is the way future censuses are to be conducted, Canadians must be told. The process must be transparent. Statistics Canada must advise Canadians when it conducts the census of the intended uses of the census returns. If, as Statistics Canada says, the confidentiality provisions of the Statistics Act are one of the most effective ways it has to secure willing cooperation, Parliament will have to consider the implications of its decision. Parliament will have to renegotiate with Canadians, and find some other way of securing the cooperation, willing or otherwise, of respondents. Perhaps Parliament will choose to compensate for the loss of the confidentiality promise by increasing the penalties for non-participation.

If it is decided to make future censuses available to the National Archives, I would urge the Panel to consider the model decided on in Australia, where the 2001 census will allow respondents the choice to consent (on an "opt-in," rather than an "opt-out," basis) to have their returns retained and released after 99 years. The option of consent, exercised by every member of a household covered by a census questionnaire, and in response to a specific and clear statement of what the future uses of the information would be, would be an interesting approach. It might be particularly instructive to all of us to see how Canadians respond to the choice.

This is the task facing the Panel, and ultimately Parliament should it decide to change the existing system for the future—the normal way in which legislation is changed. If the Panel decides that the system should be changed retroactively—that the agreement between government and governed, as to the conditions under which they have already participated in the census, should be undone—there is of course no question of consent or renegotiation.

If that is the Panel’s recommendation, I urge again that the process be transparent: Let Parliament—every MP—consider to whether to implement it.

To sum up: We would prefer a Privacy Act that accepts no limitation on a person’s right to privacy, whether the person is living or dead. An amendment to that effect is included in our proposals for the reform of the Privacy Act. Our preferred position is contained in those sections of the Privacy Act which stipulate that information will not be used for purposes unrelated to its collection. No deviation from that principle should be contemplated without the most thorough debate before Parliament and the public. What is proposed by the advocates for access to census data in no way meets this test.

1. We recommend to the Panel that Canadians’ fundamental right of privacy be respected, and that Parliament’s assurance that the census returns would be used for statistical purposes and no other be honoured.

The information was collected for a specific purpose. That purpose has been fulfilled. In accordance with the principles of fair information practices, the information should not be retained. To retain it beyond its stated use is to invite pressure for other uses. No consent was given to other uses of the information. Many, though not all, of the census respondents are dead. We do not accept that privacy rights are extinguished upon death. Indeed, Parliament explicitly recognized such rights when it enacted the Privacy Act.

2. If the Panel decides that the release of the past census returns to the National Archives is acceptable in spite of the privacy violation and the undertaking of Parliament, we recommend that the Panel consider a compromise that will to some degree reduce the impact on privacy. In light of other available sources of information, census returns from before the 1971 census would be released to the National Archives, where they would be available to researchers after the 92-year period set out in the Privacy Act. Census returns after that date, their legitimate statistical use fulfilled, would be destroyed, as would future census returns.

By the time of the 1971 census—one of the most intrusive of all Canadian censuses—Canadians were well-documented elsewhere, in vital statistics registers, in birth registers, and through the Social Insurance Number. The justification, such as it is, for opening the census records to researchers would not be sustainable from 1971 onwards. These records, then, could be destroyed.

If this option is chosen, we would recommend that staff of the National Archives and the Office of the Privacy Commissioner work together to explore some means of limiting abuses of privacy, for example by restricting the release of raw data through sampling and depersonalisation.

3. If the Panel decides that future census returns should find their way into the National Archives for eventual use by researchers, Canadians must be told. Statistics Canada, when it conducts the census, must advise Canadians of the intended uses of the returns. Further, we recommend that every member of a responding household have the choice to consent, on an "opt-in" basis, to have their returns retained (in whole or in part) and released to the National Archives.

Specification of the intended use of personal information at the time of collection, and consent to use, are fundamental privacy principles. The option of consent, exercised by every member of a household covered by a census questionnaire, and in response to a specific and clear statement of what the future uses of the information would be, would allow Canadians to control their own personal information. It should be up to them—not to us, nor to historians and genealogists—to determine whether these uses of their personal information are acceptable.