Humphreys riled by comments on data security

Minister for Heritage Heather Humphreys admonished the Data Protection Commissioner for comments made to the press after that office ordered her department to remove records of births, marriages and deaths from its genealogy website over concerns they would be used for criminal

purposes.

The Minister's officials, along with a delegation from the Department of Social Protection, attended a meeting at the commissioner's office in Portarlington on July 25th and read a statement on her behalf, four days after The Irish Times published a story about the matter.

Civil registration data, which had gone live on the irishgenealogy.ie site several weeks earlier, had been removed the previous Friday after the commissioner’s office indicated it would take enforcement action if it was not taken down.

The presence of the records on the site had been drawn to the attention of the commissioner's office by The Irish Times after a concern was raised by a member of the public who had found their own personal data on it.

While civil records on births, marriages and deaths are public records, they had never before been searchable in such an extensive way online for free.

Members of the public could visit the General Register Office’s research facility or pay a fee online for copies of specific records. Some Irish civil records up to 1958 have also been available on a site operated by the Church of the Latter Day Saints (Mormons).

Billy Hawkes, who was data protection commissioner at the time, said there were "obvious risks" associated with the availability of citizens' personal data on the site, including the potential for identity theft.

‘Total shock’

Mr Hawkes, who retired in August, said his office had been consulted about the genealogy site in the context of putting up registers over 100 years old. But the presence of “live” records up to and including 2013 had come as a “total shock” to his office.

Limited records on the matter have been released under the Freedom of Information Acts by both the Department of Arts, Heritage and the Gaeltacht and the Department of Social Protection (DSP), which is responsible for the General Register Office data.

An email from a DSP official to colleagues indicated there were two options. The first was putting the records back online and awaiting enforcement action by the Data Protection Commissioner, which it could then appeal to the Circuit Court.

Compromise

It instead chose a compromise involving an amendment to the current Civil Registration Bill, given the importance of maintaining good relations with the commissioner’s office.

A briefing note prepared for Tánaiste and Minister for Social Protection Joan Burton on July 21st also said the department was "unclear where the data protection laws have been breached".

A note of the meeting at the commissioner's office in Portarlington on July 25th reveals Department of Arts official Kevin Lonergan read a statement from the Minister "in which she expressed concern and disappointment at how the DPC had handled the matter and in particular the comments that had been made to the press".

‘Independent office’

In response, assistant data protection commissioner John O’Dwyer “stated that the DPC was an independent office and had a right to speak to the press”.

Following a “lengthy debate” at the meeting, a compromise was agreed.

This involved the insertion of a committee-stage amendment to the Civil Registration Bill 2014 so that records of births, marriages and deaths would only be searchable on the genealogy site in a limited way.

The DPC agreed that if it was limited to data on births more than 100 years old, marriages more than 75 years old and deaths more than 50 years old, that the website could be put back up.

The Bill passed the committee stage last week.