Birthlink Data Breach 2021 - Apology and FAQs
Apology from The Board
It is important to be clear that records relating to services other than post‑adoption support were not affected, and no adoption records were destroyed.
Birthlink has long held physical records for individuals linked through the Adoption Contact Register since 1984. In 2021, some records belonging to people supported by our post‑adoption service and linked on the Register were destroyed. No log was kept of what was destroyed or who was affected. While many items could be replaced, we acknowledge that some irreplaceable documents were lost.
Deeply personal documents central to people’s histories, identities, and sense of self were not handled with the care they deserved. Our investigation, supported by the ICO’s findings, identified significant gaps in our awareness of and compliance with core data‑protection principles. The correct procedures were not in place. This was unacceptable.
Due to historic record‑keeping practices, it is not possible to determine precisely how many people were affected. We recognise the distress and uncertainty this may cause. The only way forward is with honesty, sensitivity, and transparency.
We understand that trust in our organisation may have been damaged. We encourage anyone concerned about their records to contact us.
The Board is committed to ensuring Birthlink is run responsibly and safely. We have strengthened data protection and information governance, introduced improved digital systems, recruited a Board Member with specialist expertise, and embedded ongoing learning and review processes. We accept the ICO’s findings in full and are committed to continuous improvement.
To anyone affected, directly or indirectly, we are profoundly sorry. If you have concerns or believe you may have been impacted, please contact us confidentially on 0131 225 6441 or dataprotection@birthlink.org.uk We are here to listen, support, and help.
Frequently Asked Questions
What type of records were destroyed?
Post Adoption Service records where people had already been linked in different ways with family members they sought. The majority of records can be replaced, including information from public record.
From what timeframe were the records destroyed?
- The Post Adoption Service records were created from circa. 1984– April 2021. Not every record from this timeframe was destroyed.
- Where you have received initial support from the post adoption service after April 2021 you will not be affected.
Is there a record of what records were destroyed?
No, no log was kept of what was destroyed.
How many people have been affected?
We don’t know exact numbers of people as no log was kept but we estimate regrettably that around 10% of the 4800 (480 or less) may have had irreplaceable items within the records.
What was destroyed that is irreplaceable?
Photographs, letters and notes may have been destroyed.
What was destroyed that is replaceable?
Here are examples of information within the records that are replaceable, this is not an exhaustive list:
- Copies of original birth certificate/extract (OBE). These are replaceable and you can request another copy should you need to for any purpose.
- Records that Birthlink helped you access from other organisations. This includes any information found on public record for example, records held by The National Records of Scotland and records held by The Registrar General for Scotland who has maintained the Adopted Children Register since 1930.
- Special category data or information you shared verbally with us. This could include information you shared about your racial or ethnic origin, information about your health or family health, information concerning your sex life or sexual orientation, political opinions, religious or philosophical beliefs, criminal convictions or trade union membership. If you provided this information to us, it can be replicated.
Information that we did not hold
Genetic and Biometric Data
- Genetic data, “genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question”.
- Biometric data, “biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”. Dactyloscopic data is fingerprint data e.g. an electronic fingerprint scanning system.
Where people were linked, would the relevant personal items have been shared with each other?
Yes, it is likely that many people will have already had items passed on by Birthlink as they had requested.
Was the Post Adoption Contact Register affected?
No, the Post Adoption Contact Register (ACR) was not affected.
Were any adoption records destroyed?
No, Guild of Service and Family Care adoption records were not destroyed.
Were any other records destroyed?
No, no records from any other service provided by Birthlink, past or present, were destroyed.
What have we done to ensure this does not happen again?
There has been a full review of information governance and data protection across the organisation. All policies relating to data protection, records and data security have been reviewed. What we mean by this is the following action has been taken:
– A suite of Data Protection policies has been implemented
– Record Retention and Data Destruction policies have been implemented
– Data Protection Impact Assessments have been carried out on all processes
– There is an ongoing programme of Data Protection Training across the organisation
– The process for reporting data breaches has been reviewed
– Our privacy notice is available on our website
– Indexing of physical records held within the organisation is ongoing
– An audit of irreplaceable items still held within physical records has been completed
– Implementation of an improvement plan
We are committed to ongoing learning and development and the continuous improvement of information governance and data protection.
How can we support you?
There is a range of ways in which we can support you. We will use a person-centred approach, at a pace that suits you.
How do you contact us to find out more about your personal situation?
We have set up a unique email address and phone option which will take you to dedicated support staff. Please contact us by phone or email and we can discuss your situation confidentially with you:
Email: dataprotection@birthlink.org.uk
Telephone: 0131 225 6441, select option 2
I am a professional, how do I contact you?
I work in media, how do I contact you?
Email: hello@wordupscot.co.uk