An Post has been accused of selling private household information, including economic and marital details, to private companies.
The Irish Civil Liberties Board has complained to the Data Protection Commissioner about the sale by GeoDirectory, a subsidiary of An Post, of data filtered by individual address and Eircode.
A typical entry in the GeoDirectory database includes records of an address, Eircode, building type, year built, electoral district, and GPS coordinates.
The company’s “GeoPeople” database categorizes an address’s residents by socioeconomic and marital status, with labels such as “affluent city singles,” “troubled elderly families,” or “disadvantaged urban families.” “.
GeoDirectory marketing materials recommend combining the different datasets to create a complete profile.
The source of the socio-economic information is unclear. GeoDirectory’s website says it’s “backed by An Post and Ordnance Survey Ireland, and combines the former’s manpower with the latter’s cutting-edge technology to bring you the most comprehensive data available on the market.” .
The company’s website says GeoPeople classifies ‘every address in Ireland into five broad neighborhood groups’, with these being ‘affluent’, ‘advantageous’, ‘striving’, ‘struggling’ and ‘deprived’. . It then breaks these categories down to include family information such as “affluent empty nesters” or “struggling families.”
He adds that “every dimension” of the dataset for sale “is based on national census data points.” Census data is considered confidential and is usually retained for 100 years.
TJ McIntyre, professor of law at UCD and chairman of Digital Rights Ireland, said of GeoDirectory’s activity: “The most obvious question is what is the source of the data.
“There are a few different issues – maybe 80% of them relate to An Post, the other relates to the entities providing this data,” he added.
“The census suggestion is huge because it has huge privacy statutes.”
Information sold by GeoDirectory is used by insurance and healthcare companies, although anyone can purchase a dataset, at a price of €150 for 1,000 records.
Before filing the complaint, ICCL human rights officer Olga Cronin said she had “been able to buy data on each of my neighbours, how much money they had and whether they were single or not,” adding that this “incredibly personal information” is “specially protected by EU law.”
In his complaint, seen by theICCL argues that by selling this data, GeoDirectory violated GDPR Article 5 in numerous ways, including legality and transparency, accuracy, purpose limitation, and liability.
The human rights body also points out that the GDPR states that profiling people’s “economic situation” creates a high risk for them.
Ms Cronin said the sale of the data in question is “deeply problematic”.
“European data protection law defines all data that can identify a person “directly or indirectly” as protected personal data. The law is clear. GeoDirectory, An Post and OSI violate GDPR,” she said.
GeoDirectory is jointly owned by An Post and Ordnance Survey Ireland, with An Post being the majority partner with 51% ownership of the business.
The company was established in 1995 with the mission “to carry on business as developers of databases containing map coordinates, address information and other information”, and to act as wholesalers for these databases, in accordance with the constitution of the company.
Socio-economic data are not mentioned in this description.
A spokesperson for the Data Protection Commission acknowledged that the complaint had been received and “is currently being investigated”.