3

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so.

I've seen a somewhat related question about Twitter at How can I get Twitter to delete my account?, however I do have full access to my own account and the connected email. The relevant quote at GDPR 12(6) says

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

Which is a fair point in the linked question, but since I do have full access and there is no reason to doubt that, can they actually legally demand a copy of my government id?

Note I would be totally fine with waiting for a few days to verify I have not been hacked. But I am not comfortable giving out my government id to a large company, let alone one with questionable ethics.

  • Basically they are not even allowed to ask for a copy of your goverment id. You only need to show that you are the owner of the account. Related blogpost but it is in Dutch. – wimh Oct 13 at 8:22
  • @wimh The linked blogpost provides an unusual reading of Art 12 and of Recital 57, which should probably be read in conjunction with Art 11 instead. I can see nothing in the GDPR that would specifically forbid or require the use of government ID for identification. Of course, individual supervisory agencies or national laws could offer more specific guidance. E.g. I believe that asking for a copy of ID cards would be legal in Germany. – amon Oct 14 at 6:39
  • @amon I agree that it should probably read in conjunction with Art 11. And Art 11 does not really apply in this situation. However I still think the conclusion is correct, but it will be based on 'data minimisation' combined with the definition of identification in Recital 57 and common sense that there is no reason to process data for identification if they cannot identify someone with that data. Also note that the data entered online, does not need to be identical to the data on the identity document. I have written an answer, but feel free do downvote if you don't agree. – wimh Oct 14 at 21:45
3

When you make a request based on the GDPR, Art. 12(6) GDPR applies.

  1. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID:

Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.

A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID.

Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required.

You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.