The continuing publication of names, full addresses and citizens’ status as adults or minors in the State’s official gazette – while mandated by law – is unwise.
Publication of the names and addresses of new Irish citizens in Iris Oifigiúil is provided for under the Irish Nationality and Citizenship Act 1956.
While the Data Protection Commissioner notes that the restrictions on processing someone's personal information do not apply if such processing is required under an enactment or rule of law, it is clear that the 1956 legislation did not anticipate the internet or the tools that are now used to harvest data for malicious and other purposes.
With the introduction of new and unique ways of identifying individuals and their homes, including Eircode and the individual health identifiers, every citizen has reason to ensure that any information publicly available about them is minimised.
Living details
Last year, the irishgenealogy.ie database was rolled out by the
Department of Arts
,
Heritage and the Gaeltacht
, containing millions of records on living individuals supplied by the General Register Office.
Then data protection commissioner Billy Hawkes immediately ordered that the records be removed from the site once the matter was drawn to his attention. He threatened to take enforcement action against the department if it did not do so.
Hawkes told the department the website disclosed key security questions such as place of birth and mother’s maiden name which were used by many organisations to verify a person’s identity for use of services.
Officials from the Department of Social Protection, which is responsible for the civil registration data, asked the commissioner to explain why the information should be removed when it was publicly available on registers anyway. Sense (and the commissioner) prevailed and the records eventually restored to the genealogy site were more limited in scope.
The major issue is the hyper-accessibility of the information.
Being able to walk into a government office and examine a specific birth cert, for which a fee is paid, is a far cry from being able to use a powerful search function to guess someone’s date of birth within an unlimited date range and being able to build a picture of their family connections within minutes.
The Data Protection Commissioner's office states that Iris Oifigiúil cannot be searched by the individual name of the person naturalised and that this is an "important and significant" difference between this information and that which was published on the genealogy site.
In fact, the details are readily searchable online via web browsers.
The Department of Justice contends that naturalisation is a public event and “should not be conducted in secret”.
Relevant facts
Thousands of people are awarded certificates of naturalisation every year and the ceremonies are conducted in public in the presence of the Minister for Justice. The publication procedure needs change to ensure that only relevant details, perhaps just the fact of a certificate having been granted, are made publicly available.
The potential for misuse far outweighs any benefit to having the information available online.
One possible option to resolve the matter would be for Iris Oifigiúil to cease indexing for internet search purposes the pages containing the names and addresses of new citizens.
Data protection consultant Daragh O'Brien said that in the absence of the Data Protection Commissioner acting to have the data removed from online searches, the alternative was for any concerned individual to ask Google to remove it from its listings under the "right to be forgotten" ruling.