Private donor-registry email addresses exposed in Donor Conception Information Service data breach

A State Government body that supports donor-conceived children and their families has apologised for a data breach that resulted in the email addresses of almost 50 people on a highly confidential register being made visible. Last week an email was sent from the Donor Conception Information Service to 48 recipients, advising them of the new assisted reproductive technology and surrogacy Bill that had been introduced to WA Parliament. The email addresses of all recipients were visible to everyone who received the email. The recipients belong to a voluntary register of donors, donor-conceived people and donor recipients, run by the DCIS. The register allows its members to potentially be matched with others who are genetically related to them, through a rigorous, lengthy and confidential process. A spokeswoman for the North Metropolitan Health Service said a review had commenced “into the matter to ensure it does not happen again”. “Privacy of information and data protection are a priority for DCIS and immediate action was taken when the error was identified,” she said. “We have contacted those directly impacted and apologised to them for the error. The data breach has also been recorded via formal North Metropolitan Health Service channels. “The Donor Conception Information Service is a highly valued service, supporting donor-conceived persons and their families.” A member of the register whose email was on the mail-out said she was surprised the DCIS used manual email to deal with such sensitive information. “Surely there are more secure ways of dealing with the data to mitigate the risk of things like this happening,” she said. “I do appreciate they tried to immediately rectify the situation by recalling the email but unfortunately those email addresses are now out there. “It’s super unfortunate as until now DCIS have been very professional in their services in my experience and it was a genuine mistake I’m sure but one that should have had processes in place to protect it from occurring.”