Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier.

Most companies' customer services have no problems with this; but I have encountered one where they were rather less cooperative. First they said that I can only deactivate my account, but I want to delete it (and Article 17 of the GDPR gives me this right).

Therefore, I further emphasised that my wish is for them to completely delete my account. To this they responded that I have to send them my passport and ID to prove that I am an EU citizen. I understand that they may have this right - but do they actually? I cannot find anywhere online that I have to do so - and actually, sending in photos of my documents seems a bit iffy to me, at the very least.

  • 1
    When you would send them a copy of your ID, they process personal data. Based on Art. 13 GDPR they have to inform you why they need it, what they exactly need, how they secure it, how long they keep it, etc. So first ask them that information before you send a copy. They may never ask a full copy of your ID, so you can redact data they don't need. In particular they probably have no right to your photo and national identification number. You should also add a watermark to the copy of the ID containing the name of the organistion, to avoid identity fraud.
    – wimh
    Commented Oct 22, 2018 at 20:09
  • 1
    @wimh that belongs in an answer, not a comment.
    – phoog
    Commented Oct 22, 2018 at 20:15

2 Answers 2


You do not have to prove that you are an EU citizen, because EU citizenship is entirely irrelevant to the GDPR. Have a look at Article 3, which basically says that GDPR applies if you are in the EU or if the company is in the EU.

If the company is in the EU, therefore, you do not need to send them anything or prove anything about yourself to invoke GDPR. If the company is outside the EU, you can send proof of address or other evidence that you are in the EU, which might be something that they already have, like your IP address.

  • 2
    correct, and if you are able to prove you are inside the EU using for example your IP address, they may not even ask for your ID, because of the data minimisation as specified in Art. 5
    – wimh
    Commented Oct 22, 2018 at 20:13

As a slightly different viewpoint, the company can ask for additional document to verify you are who you say you are. Article 12(6) states:

where the controller has reasonable doubts concerning the identity of the natural person making the request ... the controller may request the provision of additional information necessary to confirm the identity of the data subject.

There's no provision stating what specifically is necessary, I would expect a bank to require more stringent ID verification than a blogging site, but it's up to the controller (company) to make that determination. There is no requirement to prove that you are an EU citizen.

  • thanks! That's a good point! Nobody pointed that out before :)
    – bearmohawk
    Commented Nov 30, 2018 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .