BIRTH INFORMATION & TRACING ACT 2022

Guides and further reference.

Published: 2nd October 2022
Last Updated: 4th November 2022: added link to first version of the interim guide.

INTRODUCTION

The information access elements of the Birth Information and Tracing Act 2022 come into effect on October 3rd 2022. Relevant persons may make applications for information from that date onwards.

If you are a person seeking information, the Birth Information and Tracing Act does not restrict in any way your GDPR right of access.

This means you can apply using the new system set out in the Birth Information and Tracing Act and also use the already-established information access system set out in European and Irish data protection law.

We strongly recommend that you follow both of these processes: apply using the Birth Information and Tracing Act 2022 and make Subject Access Requests to any bodies which you think may have been involved in your situation (your adoption, your illegal birth registration, your boarding out or your institutionalisation) and therefore may hold records relating to you using the GDPR.

All of the Clann Project‘s resources and guides are available at adoption.ie/help

APPLYING USING THE BIRTH INFORMATION ACT

The first version of our Interim Guide to applying for information is now available. We will be updating this guide as frequently as possible since the situation is still changing rapidly, and we are still gathering feedback about how the system operates.

MAKING A SUBJECT ACCESS REQUEST USING THE GDPR

The GDPR is a data protection law which applies across Europe. It gives people a range of rights in relation to their personal data. The most relevant of these rights in this situation is the Right of Access.

1. Your right of access under the GDPR entitles you to access a copy of all personal data held by any data controller.

Your adoption records hold personal data relating to you. This includes information about your physical identity, such as your physical condition and circumstances during your early months and years, including your place of birth, your care records, the names of the people responsible for your care; your genetic background and your cultural and social identity, such as your original name, your natural parents’ names, your natural family members’ names and the circumstances surrounding your adoption. 

The Birth Information and Tracing Act slices up your personal data into multiple different categories, with varying entitlements to access across these categories.

• Birth Certificate (only for the relevant person)
• Birth Information
• Early life information
• Care information (for those who were in a care arrangement
• Medical information
• Medical information relating to genetic relative
• Incorrect / Illegal / unlawful birth registration information
• Personal Information

This list is taken from the Tusla website, where more detail is provided on what information may be contained in each of these categories.

All of this information falls within the definition of personal data in the GDPR, and therefore you should be entitled to access a copy of it.

2. Your right of access under the GDPR entitles you to more than just a copy of your personal data.

In addition to a right to obtain a copy of any personal data being processed, the data controller is also obliged to confirm they are processing your personal data, a list of the categories of personal data it is processing and the purposes it is processing this personal data for, and more information A full list is available in Article 15.1 GDPR.

The data controller is obliged to give you this information even if it is using one of the very small number of available restrictions to withhold access to some of your personal data.

3. The GDPR has an appeals mechanism and independent supervision

If you are unsatisfied with the response to a Subject Access Request made using the GDPR you have a right to complain to the Data Protection Commission, the responsible independent Data Protection Authority.

There is no such similar mechanism in the system created by the Birth Information and Tracing Act.

This is not necessarily true, and as we still have no idea how well the new system will function we strongly recommend you do not only use it but instead also make Subject Access Requests under the GDPR.

The Right of Access in Article 15 of the GDPR entitles you to receive confirmation of whether a data controller, like the Department or Tusla, is processing your personal data. If this is the case then you also have the right to receive additional information such as the purpose of the processing; the categories of personal data concerned; and the time period for which the data will be retained.

Most importantly, the controller must provide you with a copy of the personal data that they hold, provided this does not adversely affect the rights and freedoms of others.

This depends on whether the information relating to another person is also your personal data.
 
The definition of personal data in the GDPR covers any information that relates to you.
 
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (GDPR, Article 4.1)
 
The Court of Justice of the EU confirmed in a case called Nowak v Data Protection Commissioner of Ireland (case C-434/16, 20 December 2017) that information may be the personal data of more than one person at the same time. This is commonly referred to as mixed personal data. Therefore, more than one person can have a right of access to the same personal data.

We recommend that you send Subject Access Requests to the Adoption Authority of Ireland, Tusla (or your adoption agency if it is still open), and any other body you are aware of that was involved with your situation, e.g. your adoption, your illegal birth registration, your boarding out or your institutionalisation.

Data controllers who receive a valid Subject Access Request must respond to the request without undue delay and at the latest within one month of receiving the request. Controllers can extend the time to respond by a further two months in certain circumstances, for example if several requests have been made or if the request is particularly complex.

You can copy the text below, make modifications and additions where indicated and send this to the data controller who you think may be processing your personal data. Many data controllers have their own Subject Access Request form – you are not obliged to use their form.

Dear [data controller],

This is a Subject Access Request under the Data Protection Acts and Article 15 of the General Data Protection Regulation (GDPR) for

+ a confirmation that you hold personal data relating to me,
+ a description of the data,
+ the purposes for which it is being processed,
+ a copy of all data you hold / are processing relating to me either on computer or in manual form.

The data you hold relating to me is likely to include:


+ Correspondence about me, including correspondence associated with the administrative process surrounding my [adoption/detention], and correspondence from my natural [mother / child] enquiring about me.
+ My medical care records including x-rays, tests, vaccine trials.
+ My physical condition and circumstances during my early months and years including early life care records.
+ My physical condition and circumstances before, during and after giving birth.
+ My natural family members' names including my natural mother and father's names (all of which are public records).
+ [add / delete as appropriate]

Please note the Court of Justice of the European Union (CJEU) acknowledged in Nowak v Data Protection Commissioner of Ireland (Case C 434/16, 20 December 2017) that information may be linked to more than one individual, but this does not affect each person's right of access. I also note that deceased individuals do not have a right to data protection under the GDPR and therefore my right of access cannot be restricted based on a deceased person's interests.

I have included below as much detail as I am aware of to aid your identification of records which contain my personal data [include relevant dates, times, location or institutional descriptions, your history as you know it here]

Please send your response, together with copies of my data in [electronic / written] format, to [insert your postal / email address].

I look forward to receiving your response to this request within one calendar month, in accordance with Article 12(3) of the GDPR.

Yours sincerely,

[insert your name]

THOSE EXCLUDED FROM THE BIRTH INFORMATION AND TRACING ACT SYSTEM

The Birth Information and Tracing Act excludes many categories of people who have been affected by Ireland’s adoption system and are also seeking information about their origins and early lives.

Yes, you can. This applies even if you are not located in Ireland. If a data controller in Ireland is processing your personal data then you can make a Subject Access Request.

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. (GDPR, Article 3.1)

Your adoption records hold personal data relating to you. This includes information about your physical identity, such as your physical condition and circumstances during your early months and years, including your place of birth, your care records, the names of the people responsible for your care; your genetic background and your cultural and social identity, such as your original name, your natural parents’ names, your natural family members’ names and the circumstances surrounding your adoption. 

Your right of access under the GDPR entitles you to access a copy of all personal data held by any data controller.

Only adopted people and mothers or relatives of children who died in certain institutions, or the next of kin of an adopted person who has died can apply for information under the legislation. We will be making guides available soon but in the meantime, if you are a mother you can apply for information under the GDPR using this template. Relatives of mothers or adopted people who are deceased may find the Justice for Magdalenes Research Guide for Relatives of assistance.

LINKS TO OTHER RESOURCES

The Irish State’s main Birth Information and Tracing website: birthinfo.ie
You can apply for information here, and add your details to the Contact Preference Register.

The child and family agency Tusla’s website: Birth Information and Tracing section

The Adoption Authority of Ireland’s website: Birth Information and Tracing section

All of the Clann Project‘s resources and guides are available at adoption.ie/help

Resources specifically prepared for requests made for access to to the records held by the Mother and Baby Homes Commission of Investigation which were transferred to the Department of Children, Equality, Disability, Integration and Youth are available at https://datasubject.ie/mbh/resources/, and there are links to further resources at the bottom of that page.

ABOUT

Produced by Article Eight Advocacy and The Clann Project / Adoption Rights Alliance.

We also encourage adopted people, natural parents and relatives to register with the new Contact Preference Register (CPR), which is run by the Adoption Authority of Ireland

PLEASE SHARE!

All content on this site and in the downloadable guides is published under a Creative Commons licence (CC BY-NC-ND 4.0) except if otherwise noted. You are free to copy and redistribute the material as long as you give appropriate credit, you do not use the material for commercial purposes, and you do not change the material.