From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact."
The Credit Industry Fraud Avoidance System (Cifas) says "If you wish to request a copy of any data held about you on the Cifas Database, the only way is to apply online", "In line with government recommendations the Cifas office is now closed and therefore we are unable to send or receive post" and "we are unable to handle requests over email as we require originals of some documents in order to prove your identity before releasing information about you". If you go through the web form (which requires javascript to even load) it provides an option for online verification (submission of images of Proof of ID and Proof of address). There appears to be no way to make a DSAR using the web form until after you have provided documents.
Is it consistent with the GDPR for companies to restrict the means through which a GDPR DSAR can be made, particularly if the restrictions require one to provide specific PII prior to being able to make a request, rather than after? Does it make a difference if the restriction makes technical sense, ie. so "only through post as we need originals" may be justifiable when "we will accept images submitted by a web form but not over email" may not be? If one sent an email request to these people, and at least one email reached its destination would that count as a valid DSAR? Is it reasonable to request original documents to complete a DSAR? While I may feel like I could trust Cifas, I really would not want to send any original documents to most data controllers.
