Organisations are required to "use all reasonable measures to verify the identity of a data subject who requests access". This has been implemented in some cases by requiring the data subject to provide images of "your valid passport or driving licence and an original bank statement or utility bill". These documents are likely to contain much richer information than most organisations would hold, in particular a recent facial photograph and details of financial transactions. It is therefore reasonable to not want to distribute this information. It would be relatively easy to make images that contained the information required to identify the individual to the data controller but other information changed, such as the photograph and actual transactions. This could be done either by editing an image of the real document (eg. put someone else's photograph over mine on an image of my driving licence) or an image from the web (eg. put my address on this).
Clearly to do this to obtain someone else's data would be wrong (fraud?). If I did this to access my data, and the changes were purely to protect my PII would I be committing any crime?