An Post has been accused of selling private information about heads of households, including financial and marital details, to private companies.
The Irish Council for Civil Liberties complained to the Data Protection Commissioner about the sale by GeoDirectory, a subsidiary of An Post, of the data, which is filtered by individual address and Eircode.
A typical entry in the GeoDirectory database includes records for an address, Eircode, building type, year of construction, electoral division, and GPS coordinates.
The company’s ‘GeoPeople’ database classifies an address’s residents by socioeconomic and marital status, with labels such as “affluent city singles,” “struggling older families” or “disadvantaged urban families.”
GeoDirectory’s marketing material recommends combining the different data sets to create a complete profile.
The source of the socioeconomic information is unclear. GeoDirectory’s website states that it is “supported by An Post and Ordnance Survey Ireland, and combines the former’s craftsmanship with the latter’s cutting-edge technology to bring you the most comprehensive data available on the market.”
The company’s website says that GeoPeople classifies “every address in Ireland into five broad neighborhood groups,” which are “rich,” “advantaged,” “strugglers,” “strugglers” and “deprived.” It then breaks those categories down even further to include familiar information like “rich, empty kids” or “struggling families.”
It adds that “each dimension” of the dataset for sale “is based on national census data points.” Census data is considered confidential and is generally retained for 100 years.
UCD Law Professor and Chairman of Digital Rights Ireland, TJ McIntyre, said of the GeoDirectory activity: “The most obvious question is what is the source of the data?”
“There are some different problems: maybe 80% is looking at An Post, the other is in the entities that provide that data,” he added.
“The Census tip is huge, as it has huge confidentiality statutes.”
The information GeoDirectory sells is used by health and insurance companies, although anyone can buy a dataset, at a cost of €150 for 1,000 records.
Before filing the complaint, ICCL human rights officer Olga Cronin said she had been able to “buy data on each of my neighbors, how much money they have and whether they are single or not”, adding that such “incredibly personal” is “particularly protected by EU law”.
In his complaint, seen by theThe ICCL argues that by selling that data, GeoDirectory has violated Article 5 of the GDPR in many ways, including in terms of legality and transparency, accuracy, purpose limitation, and liability.
The human rights body also points out that the GDPR establishes that profiling the “economic situation” of people creates a high risk for them.
Ms Cronin said the sale of the data in question is “deeply problematic”.
“EU data protection law defines any data that can identify a person ‘directly or indirectly’ as protected personal data. The law is clear. GeoDirectory, An Post and OSI are in breach of GDPR,” he said.
GeoDirectory is jointly owned by An Post and Ordnance Survey Ireland, with An Post being the majority shareholder with 51% ownership of the company.
The company was first formed in 1995 with a mandate to “conduct business as developers of databases containing map coordinates, address information, and other information,” and to act as wholesalers of those databases, according to the constitution of the company.
Socioeconomic data is not mentioned in that description.
A spokesman for the Data Protection Commission acknowledged that the complaint had been received and “is currently being evaluated.”