Kyanar:

nunz: 
Turning back to the census. One of the first processes your information goes through is anonimisation. You are turned from Joe Bloggs into a gendered person of certain age, socio econominc demographics, race, religion and other statisitcally relevant features. At this point you are nothing more than a number which cannot be traced back to an individual. Think of it this way - your data is fed into a black box program that a on the other side of an impenertrable wall assigns a number against your stats and then hands it off to the statistical crunching machine.

Your name is no longer able to be put against your stats as the black box doesnt know who you are and the feeder of data doesnt know what number you were given. Your stats are divorced from you.

Studies have actually proven, however, that given sufficiently large data sets, the anonymization process is actually reversible.

I very much doubt that StatsNZ would ever intentionally allow this to occur (its very existence is predicated on the gathering of information deemed either too sensitive or too worthless for the private sector to do it, and census data is the very definition of sensitive) but the fact remains that
a) the forms are not destroyed.  This is a huge risk, though one suspects mitigation of said risk is a key goal there
b) the information in the hands of a malicious individual with sufficient determination and resources can be reversed into data regarding an individual.

It would do a lot to mitigate concern if Stats NZ was a bit more transparent in how they handle the data, and weren't to actually keep it in its original form.