The confidentiality of Census data is protected in law. Under the 1920 Census Act it is an offence for any member of the census staff to disclose individual information without authority. The census forms are collected and processed in secure conditions. The Census Confidentiality Act 1991 makes unauthorised disclosure by anyone a criminal offence.
A digital image of each Census form is made for processing the data, the actual paper forms are destroyed.
The Census data is kept in physically secure conditions and managed in line with the good practices identified under the Data Protection Act 1998 and the British Standard on Information Security Management (BS 7799). For further information see the ONS Data Access and Code of Practice Protocol (2003) https://www.statistics.gov.uk/about/consultations/general_consultations/downloads/Protocol_o n_Data_Access_Confidentiality.pdf and the ONS Disclosure Control Report www.statistics.gov.uk/census2001/pdfs/ag0106.pdf
In addition, a range of technical measures are employed to try to make the data completely anonymised and prevent any inadvertent or deliberate disclosure of individual identities. Such measures include altering or perturbing data and limiting data release.
After a period of consultation, the data disclosure control measures for the 2001 England and Wales data include restricted output categories, the swapping of records, the adjustment of small counts and limitations on the details in tables produced for small populations. Recording swapping is where a sample of records is swapped with similar records in other geographical areas. The proportion of records swapped is also confidential.
It was proposed that for aggregate statistics the additional measure of rounding all counts to a multiple of three would be employed, however following widespread user concern rounding has been restricted to only small cell counts.
There are also minimum thresholds of numbers of person and households for the release of sets of output. For Census Area statistics these are 40 households and 100 persons and for the Standard Tables it is 1,000 people. See https://www.statistics.gov.uk/census2001/discloseprotect.asp
A condition of use also applies that states that the Census material must not be used to attempt to derive information relating to an identified person or household nor shall a claim be made that such information has been obtained or derived.
The Scottish Executive is adopting its own disclosure control measures. See www.gro-scotland.gov.uk/grosweb/grosweb.nsf/pages/scotcen19 . Across the European Union other measures are used. For example Eurostat, the statistical office of the European Union, has adopted a policy of rounding cells counts in tables to base 3. See www.europa.eu.int/comm/eurostat/ .