The names of thousands of people who were adopted as children were published on a Scottish genealogy website.
Scotland’s People, run by the National Records of Scotland (NRS), removed the information 36 hours after a concerned mother noticed her adopted child’s details were published on the website, the BBC reported.
The mother said she was concerned the website could grant people access to find the new surnames of adopted children and track them down.
The woman told the BBC she searched for her adopted son’s first name and the year he was born.
To her shock, she noticed he was the first person to appear in the search results, with a reference number revealing he was adopted.
She said she also found the details of someone else she knows on the Scotland’s People site, and stated she is concerned for adults who do not know they were adopted as children.
The NRS is part of the Scottish Government.
Before the information was removed, the names of thousands of adopted people from as far back as 1909 were published.
The most recent entries were from last year.
The Children and Young People’s Commissioner for Scotland confirmed they were made aware of the issue.
This was of immediate concern for our office as it engages children’s rights to privacy and in some cases to protection from harm— Nick Hobbs, acting Children and Young People's Commissioner for Scotland
Nick Hobbs, acting commissioner, said: “On Monday we became aware that records on a National Records of Scotland website included a marker indicating that a child had been adopted.
“This was of immediate concern for our office as it engages children’s rights to privacy and in some cases to protection from harm.
“Some children who have been adopted may be subject to a legal order which ensures that information about them is withheld for their own safety.
“We contacted National Registers of Scotland immediately to raise our concerns on Monday highlighting the rights implications for children identified and the potential risks this posed.”
Mr Hobbs said he is “pleased” the NRS made the decision to remove the records, stating the decision “mitigates the immediate risk to children”.
He added: “We look forward to NRS confirming that any longer-term solution will respect children’s rights.
“We urge them to undertake a children’s rights impact assessment to consider and mitigate any further risks in relation to children’s records.”
We don’t appear to have received a formal breach report regarding this at this time— Information Commissioner's Office
A spokesperson for the Information Commissioner’s Office said: “It is important that organisations holding sensitive personal data ensure it is handled in line with data protection law.
“National Records of Scotland alerted us to the concerns raised and we provided advice on organisations’ duty to self-assess and conclude if an incident needs to be formally reported to the ICO.
“We don’t appear to have received a formal breach report regarding this at this time.”
A Scottish Government spokesperson said: “We understand people are concerned and that the National Records of Scotland are currently reviewing how they make this information available.
“All public bodies must ensure they meet UK GDPR obligations when sharing appropriate information.”
The NRS was contacted for comment.
