A genealogy website run by the Irish government left personal information of every citizen born or married in Ireland openly available to the public until last Friday, when Ireland’s Data Protection Commissioner intervened.
All civil registration records have been removed from the site, IrishGenealogy.ie, and will be unavailable until further notice.
The records, which were available free of charge, included birth dates, mothers’ maiden names, marital status info and names of children – details often used in security questions for banking and other online accounts, and particularly useful for committing fraud or identity theft.
Billy Hawkes, Ireland’s Data Protection Commissioner, described this oversight as “very shocking.”
The breach was first discovered by a site user, who informed the Irish Times, which then contacted Commissioner Hawkes. Access to the civil registration records was disabled less than 24 hours later.
Hawkes commended the person who discovered the issue for performing “an important public service, before [the records] became a treasure trove for people of evil intent.”
Ireland’s civil records have long been available, but for a fee and following an application process. It has now come to light that IrishGenealogy.ie left this information open to anyone with internet access and the ability to perform a basic site search.
The site launched in March 2013, under the direction of the Department of Arts, Heritage and the Gaeltacht. Its intended purpose was to gather important records, such as the 1901 and 1911 Irish Census, to aid people tracing their genealogy.
The Office of Data Protection was consulted prior to the launch. However, in a recently released statement, the office maintains that it only granted approval on the understanding that the civil records available would be at least 100 years old, not current records pertaining to the living.
“We had been consulted on it in the context of putting on the registers which were over 100 years old – that would be fine. But this was a total shock to us,” Hawkes told the Irish Times.
His office is currently working with the Department of Arts, Culture and the Gaeltacht "to ensure that the operation of this site complies with data-protection law, prior to the website going live again."