Scotland's People data breach - adopted children

[kiterunner]

But I did find this in the Daily Mail's report: A spokesperson for National Records of Scotland said: 'We are currently reviewing the way indexed entries from the Adopted Children Register are presented on the ScotlandsPeople website. 'NRS has a statutory responsibility to make our registers open and searchable.
'Relevant entries have been removed as a precautionary measure while we review the way we make this information available.'

Interesting since I remember a few years ago, a website (I forget which one it was) put the England and Wales adoption index online and the GRO forced them to remove it. But it is still available to search at certain large libraries, though not on computers. But there is nothing linking a particular birth certificate with a particular adoption index entry. But I can't work out from the news reports whether there was some such link on Scotland's People, or if the mother who complained just knew the two records were for the same person because she had adopted him.

[kiterunner]

It does worry me that if they decide this is a breach of the adopted children's privacy, it might have wider implications for UK genealogy, since the privacy conventions that they are referring to don't seem to have special rules about adoption.

[Olde Crone]

Kate

Adoption has always been a special case, certainly in England and Wales (if not Scotland) because adoption is a private legal matter unlike births marriages and deaths. Birth and Adoption records aren't linked in any way in England, so there's no problem that I can see.

I must say, if Scottish certificates link births to new names then that is an extremely well kept secret, one which I have never heard or read about, even on the Scotland's People forum.

OC

[kiterunner]

There is some more information on Chris Paton's blog:

https://scottishgenes.blogspot.com/2...g0vo7HxTmbI4Qw

[kiterunner]

Having read that, I think I understand at least some of what happened. When Findmypast (and their predecessors) ran the website for the National Records of Scotland, you had to use a surname in any name search, and you had to pay to view a list of search results.

In 2016, Scotland's People was relaunched with a new design by "international technology company CACI Limited" and you no longer had to pay to view the list of search results, only to view the actual records. Also either at that time, or more recently, they changed things so that you no longer had to include a surname in your search.

So before CACI took over, you would not be able to search using given name only, and thus you would have to know the child's birth surname and adoptive surname to be able to find both records. And any search results would only be seen by people who paid to view them, not people doing casual searches for no particular reason.

As so often seems to be the case nowadays, I get the impression that NRS didn't have staff who liased closely with CACI on all details of the changes to the system and who checked that everything met requirements. Surely there should have been a data protection officer who signed off on all the changes, for instance, and you would hope that that person actually thought about everything rather than just rubber-stamp whatever they were told was going to happen.

[Olde Crone]

That makes sense, Kate. I had completely forgotten that searches had to be paid for at one time, so as you say, wouldn't have been of interest to the casual searcher.

I still think it's amazing that it has taken seven years for this to come to light and I agree, it does seem as if someone has not done their job properly.

OC