Census 2022 compliant with data protection?

On May 15, 2022, the regular census is launched. Not only because of the amount of data to be collected, but also because of certain service providers used in the online questionnaire, data protection concerns are surfacing.

You can find out everything you need to know here.

What is the census?

The census is a statistical survey conducted throughout Germany. Here one collects information about the number of the population, their living as well as working situation. The purpose of this is to serve as a basis for future policy. Colloquially, one also speaks of a "census". Every ten years, only a small proportion of the population is surveyed to serve as a sample. Due to a one-year delay caused by the pandemic, not only the German but also the European census will start this year.

Census and DSGVO

The Census 2022 is the first census to take place under the scope of the GDPR. An appropriate level of security is therefore also to be maintained for the 2022 census. For this reason, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the Federal Office for Information Security (BSI) are monitoring the Census 2022. The first priority here is the so-called "prohibition of replay", which means that collected data may not be forwarded to authorities or the judiciary.

The rules of the 2022 census are also laid down in the Census Act. This also contains the regulation that the citizen surveyed has a so-called duty to provide information. If a citizen refuses to provide information, he or she may face a fine.

Criticism of the census

Criticism of the 2022 census has been voiced by data protection experts in particular. Not only does the census law actually provide for the collection of religious affiliation, which would affect the principle of data minimization. But they also criticized the fact that the American service provider Cloudflare was used for the online questionnaire. This could have resulted in data being transferred to the USA.

Census Act

In contrast to the last sharply criticized census in 2011, there is no question about religious affiliation in the 2022 census. At least, that is what the sample questionnaire says.

Nevertheless, this query is still possible in the German Census Act. This rightly meets with criticism, but is not implemented in practice for this very reason.

Use of American service providers

Already on May 12, the BfDI became aware that there could be violations of the protection of personal data in the online questionnaire of the Census 2022 due to the use of the service provider "Cloudflare".

"Cloudflare" is an American service provider that provides a content delivery network, Internet security services, and distributed DNS services that act as a reverse proxy for websites.

The fear was that by using an American service provider, unauthorized third parties (in the USA) could have access to the data. After a review, however, the BfDI determined that at no time had this risk existed. The data entered was secure, but further investigations were being conducted to determine whether the transmission of metadata when the page was called up was lawful. According to the BfDI's own statement, the intervention at least resulted in corresponding changes being made to the website so that "Cloudflare" is no longer used when the page is called up and thus no data is transmitted at all.