Personal details removed from site over ‘identity theft’ concerns

Potentially sensitive personal details of every citizen born or who married in the State, including information often used for security questions for banking, were openly available on a government website until last Friday.

The Department of Arts, Heritage and the Gaeltacht has removed the database of civil registration records from the website irishgenealogy.ie following the intervention of Data Protection Commissioner Billy Hawkes.

While they are not defined as “sensitive” personal information in the legal sense under data protection law, details such as a birth date or a mother’s maiden name, which were on the site, could potentially be used to attempt fraud or identity theft.

Mr Hawkes said his office had been consulted about the launch of the irishgenealogy.ie portal but said this had been based on the understanding that the information used would be historical information and not information on living individuals.

“We had been consulted on it in the context of putting on the registers which were over 100 years old – that would be fine. But this was a total shock to us,” he said.

He said the person who had drawn the attention of The Irish Times to the site had performed "an important public service, before it became a treasure trove for people of evil intent".

While information on births, marriages and deaths is publicly available, previously anyone seeking it was required to pay a fee to get a copy of a record from the general registry. The information was not searchable online in a way that could be readily manipulated for potentially malicious purposes.

The genealogy database was structured in such a way that, with minimal information, anyone could carry out searches and build up a very accurate picture of a person’s family history, including birth dates, information on marital status, spouses and even children.

It appeared that, in the design of the site, no consideration had been given to the protection of the personal data of living individuals.

Access to the civil records was disabled within 24 hours of The Irish Times drawing it to Mr Hawkes's attention last Thursday.

In a note on its website, the department said the civil registration data was “temporarily unavailable” and that further updates would be provided.

Mr Hawkes said the issue was “very shocking” and an example of what could go wrong when organisations did not take into account the privacy impacts of projects.

When he launched irishgenealogy.ie in March last year, former minister for heritage Jimmy Deenihan said it would bring together important records such as the 1901 and 1911 censuses.