Is it legal for Blizzard to demand a copy of my government id before deleting my account?

Question

I am trying to delete my Blizzard account, however they demand a copy of my government id before doing so.

I've seen a somewhat related question about Twitter at How can I get Twitter to delete my account?, however I do have full access to my own account and the connected email. The relevant quote at GDPR 12(6) says

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

Which is a fair point in the linked question, but since I do have full access and there is no reason to doubt that, can they actually legally demand a copy of my government id?

Note I would be totally fine with waiting for a few days to verify I have not been hacked. But I am not comfortable giving out my government id to a large company, let alone one with questionable ethics.

Answer 1

When you make a request based on the GDPR, Art. 12(6) GDPR applies.

6. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID:

Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.

A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID.

Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required.

You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.