4

I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.

I never provided them my passport data before (as passport section on my profile is empty) and I feel that's quite unreasonable request - if they really want to confirm it's valid request they can just do email verification as most other sites would do. In the end my goal is for them to have less of my data not even more.

My question is - can they really require scan of my passport on data deletion request?

I'm citizen of Poland living in the UK (as that probably matters for GDPR and similar).

Improve this question

1 Answer 1

Reset to default
4

Per Art 12(6), they are allowed to ask for additional identify verification:

where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

Additionally, Recital 64:

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

There is no consensus regarding what this means in practice:

  • Must the controller use all measures that they can be reasonably be required to use?
  • Or only those measures to verify the identity to a reasonable level of certainty?

I agree with you that asking for a passport is excessive, and that email verification would be sufficient. However, that is just my personal opinion. The GDPR can also be interpreted in a way that asking for a copy of your passport is OK.

Where they process a copy of your passport, that is personal data as well. You also have data subject rights with regards to this processing, for example the right to be informed of the purpose of this processing and of when the data will be deleted. If it is only used for the purpose of verifying your identity, the copy of your passport should be deleted immediately afterwards.

The data controller may have additional obligations because a passport or ID card is a very sensitive document. E.g. Art 87 allows member states to impose additional rules. Most sensible controllers will therefore want to avoid processing passports, unless they only operate in specific EU member states.

Improve this answer
3
  • 1
    The Austrian DPA (Datenschutzbehörde) has determined that it is not allowed to process additional personal data to identify someone (par. 16-18). If you have the login name and password it is sufficient to identify the account. Unfortunately that document is available in German only.
    – wimh
    Jan 9, 2020 at 19:57
  • @wimh Thank you for that link. I'm surprised they didn't discuss Art 12(6), but it's good to have a precedent towards a sane interpretation.
    – amon
    Jan 10, 2020 at 6:36
  • waybackmachine asked me to provide them with such identifying data, too. They had specified several ways, but the only one I could fulfill would be sending my passport. Would this make any difference to the question if the content provider displaying my identifying information had never gotten the data directly from me but from whoever made the snapshots?
    – kaiya
    Jul 10, 2020 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .