Scotland's People data breach - adopted children

[ElizabethHerts]

https://www.bbc.co.uk/news/uk-scotland-66448432

Yet another data breach.

There are fears for children's safety as they could be tracked down. Also, some adults may have been totally unaware that they were adopted.

[kiterunner]

I'm not sure that the article is explaining what happened very clearly or accurately. Did she find their original names or their adoptive names? Surely it can't be true that "The whole adoption register was there online for everybody to see." I'm not sure that it is a data breach at all.

[ElizabethHerts]

I'm not sure that the article is explaining what happened very clearly or accurately. Did she find their original names or their adoptive names? Surely it can't be true that "The whole adoption register was there online for everybody to see." I'm not sure that it is a data breach at all.

On closer examination it does seem rather muddled. It reports that the information was removed. Does it mean the information specific to her child or all the information?

[Olde Crone]

I use SP a lot and have never seen any of this.

OC

[Olde Crone]

Right, I think I understand now. It is the original birth certificate which gives the new adoptive name. You would only know this if you paid for and ordered the certificate, but I agree, it does seem unnecessary and a breach of data protection.. I am very surprised that this is the first time anyone has noticed, though!

OC

[kiterunner]

I can't see anything in the news stories which says that, OC. Where did you find that information?

[Olde Crone]

Kate

On the 10pm news it showed the birth index with a reference AR next to it, then a page of birth certificates with some information in the right hand margin, which I could not read, but I presume gave the new surname along with the AR reference number.

You cannot look at a Scottish birth certificate on line within the last 50 years, so you couldn't access this information unless you ordered the certificate. I assume there's some kind of gate keeping at that point, when adoption is concerned, so I'm not sure what the problem is. There are whole agencies set up to trace adopted adults after all and my understanding is that it is illegal to try to trace an adopted minor.

OC

[kiterunner]

Thanks, OC.

[Olde Crone]

Durh. I realised at about 2 am that anyone can view any certificate if they visit the SP centre. So yes, this is a breach of data protection and always has been.

OC

[kiterunner]

I still can't find a proper explanation of what exactly the problem was in the news articles.

[kiterunner]

But I did find this in the Daily Mail's report: A spokesperson for National Records of Scotland said: 'We are currently reviewing the way indexed entries from the Adopted Children Register are presented on the ScotlandsPeople website. 'NRS has a statutory responsibility to make our registers open and searchable.
'Relevant entries have been removed as a precautionary measure while we review the way we make this information available.'

Interesting since I remember a few years ago, a website (I forget which one it was) put the England and Wales adoption index online and the GRO forced them to remove it. But it is still available to search at certain large libraries, though not on computers. But there is nothing linking a particular birth certificate with a particular adoption index entry. But I can't work out from the news reports whether there was some such link on Scotland's People, or if the mother who complained just knew the two records were for the same person because she had adopted him.

[kiterunner]

It does worry me that if they decide this is a breach of the adopted children's privacy, it might have wider implications for UK genealogy, since the privacy conventions that they are referring to don't seem to have special rules about adoption.

[Olde Crone]

Kate

Adoption has always been a special case, certainly in England and Wales (if not Scotland) because adoption is a private legal matter unlike births marriages and deaths. Birth and Adoption records aren't linked in any way in England, so there's no problem that I can see.

I must say, if Scottish certificates link births to new names then that is an extremely well kept secret, one which I have never heard or read about, even on the Scotland's People forum.

OC

[kiterunner]

There is some more information on Chris Paton's blog:

https://scottishgenes.blogspot.com/2023/08/scotlandspeople-provided-access-to.html?fbclid=IwAR0K1ntcaGY7WCdMeDH1g9uAv2lG8FBl8 KD-JigYvg59Dg0vo7HxTmbI4Qw

[kiterunner]

Having read that, I think I understand at least some of what happened. When Findmypast (and their predecessors) ran the website for the National Records of Scotland, you had to use a surname in any name search, and you had to pay to view a list of search results.

In 2016, Scotland's People was relaunched with a new design by "international technology company CACI Limited" and you no longer had to pay to view the list of search results, only to view the actual records. Also either at that time, or more recently, they changed things so that you no longer had to include a surname in your search.

So before CACI took over, you would not be able to search using given name only, and thus you would have to know the child's birth surname and adoptive surname to be able to find both records. And any search results would only be seen by people who paid to view them, not people doing casual searches for no particular reason.

As so often seems to be the case nowadays, I get the impression that NRS didn't have staff who liased closely with CACI on all details of the changes to the system and who checked that everything met requirements. Surely there should have been a data protection officer who signed off on all the changes, for instance, and you would hope that that person actually thought about everything rather than just rubber-stamp whatever they were told was going to happen.

[Olde Crone]

That makes sense, Kate. I had completely forgotten that searches had to be paid for at one time, so as you say, wouldn't have been of interest to the casual searcher.

I still think it's amazing that it has taken seven years for this to come to light and I agree, it does seem as if someone has not done their job properly.

OC