While they are not defined as ???sensitive??? personal information in the legal sense under data protection law, details such as a birth date or a mother???s maiden name, which were on the site, could potentially be used to attempt fraud or identity theft.