An Post accused of selling economic and marital information of householders to private entities

The firm’s own website says GeoPeople categorises 'every address in Ireland into five broad neighbourhood clusters', these being ‘affluent’, ‘advantaged’, ‘striving’, ‘struggling’, and ‘deprived'. Picture: Denis Minihane

An Post has been accused of selling private information about householders, including economic and marital details, to private companies. 

The Irish Council for Civil Liberties has complained to the Data Protection Commissioner about the sale by GeoDirectory, a subsidiary of An Post, of the data, which is filtered by individual address and Eircode.

A typical entry on the GeoDirectory database includes records of an address, Eircode, type of building, year of build, electoral division, and GPS co-ordinates.

The company's ‘GeoPeople’ database categorises residents of an address by socioeconomic and marital status, with labels such as "affluent city singles", "struggling older families", or "deprived urban families".

Marketing material from GeoDirectory recommends combining the different data sets to build a full profile.

The source of the socioeconomic information is unclear. GeoDirectory’s website states it is “backed by An Post and Ordnance Survey Ireland, and combine the manpower of the former, with the cutting-edge technology of the latter to provide you with the most exhaustive data available in the market”.

The firm’s website says GeoPeople categorises “every address in Ireland into five broad neighbourhood clusters”, these being "affluent", "advantaged", "striving", "struggling", and "deprived". It then breaks those categories down further to include family information such as "affluent empty nesters" or "struggling families". 

It adds that “each dimension” of the dataset for sale “is based on data points from the national Census”. Census data is bound as confidential, and is generally withheld for 100 years.

GeoDirectory said it only uses publicly available information. was unaware of a complaint to the DPC but is happy to engage if required.

A spokesperson said it has been corresponding with the ICCL for some months on the matter and denied that the records in question constitute personal data as, they said, no one is identifiable.

UCD law professor and chair of Digital Rights Ireland TJ McIntyre said of GeoDirectory’s activity: “The most obvious question is what is the source of the data.” 

To say it is not personal data is hogwash. Personal data includes inferred data about someone, not just data directly or indirectly supplied by that person.” 

“There are a few different issues — maybe 80% of it is looking at An Post, the other is at the entities who’re giving that data,” he added. 

“The Census suggestion is huge as it has huge confidentiality statutes.” 

The information sold by GeoDirectory is used by insurance and healthcare companies, although anyone can purchase a dataset, at a cost of €150 for 1,000 records. 

'Incredibly personal information'

Ahead of making the complaint, the ICCL’s human rights officer Olga Cronin said she had been “able to buy data about each of my neighbours, how much money they have, and whether they are single or not”, adding that such “incredibly personal information” is “specially protected under EU law”.

In its complaint, seen by the Irish Examiner, the ICCL argues that in selling that data, GeoDirectory has infringed Article 5 of the GDPR in numerous ways, including in terms of lawfulness and transparency, accuracy, purpose limitation, and accountability.

The human rights body also points out that the GDPR states that profiling peoples' "economic situation" creates a high risk to them.

Ms Cronin said the sale of the data in question is “deeply problematic”. 

We’ve no idea who is buying this data. I did, anyone else could. What’s to stop people finding out about struggling rural families throughout Ireland?

“EU data protection law defines any data that can single out a person 'directly or indirectly' as protected personal data. The law is clear. GeoDirectory, An Post, and OSI are infringing the GDPR,” she said.

GeoDirectory is jointly owned by An Post and Ordnance Survey Ireland, with An Post being the majority partner with 51% of the company’s ownership.

The company was first formed in 1995 with a remit to “carry on the business as developers of databases containing mapping co-ordinates, address information and other information”, and to act as wholesalers for those databases, according to the company’s constitution.

Socioeconomic data is not mentioned in that description.

A spokesperson for the Data Protection Commission acknowledged the complaint had been received and "is currently being assessed”.