in practice, privacy has more to do with availability of the data than having the ability to get the data

Bingo. You're more private if it costs 10x the amount to get at your data. For example, if you have to phone up the records office yourself to find the records, you're not going to wind up with random people being interested in them, generally speaking - but if they turn up on the first page of google when someone searches your name, there's a lot more people are going to find them. Privacy is all about creating friction - similar to hashcash or similar.

> I wasn't aware genealogy was private. I'd assume the opposite, as birth and marriage records are public matters.

And you are totally in the right.

>I wasn't aware genealogy was private

It is if a large part of your family is poor or you're related to a felon or political extremist. Sure it's not as private as bank records but it's not the kind of thing anyone with a brain would want to make it trivial to find.

Public record is not the same as google-able.

Security questions by default often include Mother's Maiden name.

Right which is why that has always been and will always be a miserable security question.

There has never been a point in the past 20 years when someone's maiden name was difficult to find.