1

Organisations are required to "use all reasonable measures to verify the identity of a data subject who requests access". This has been implemented in some cases by requiring the data subject to provide images of "your valid passport or driving licence and an original bank statement or utility bill". These documents are likely to contain much richer information than most organisations would hold, in particular a recent facial photograph and details of financial transactions. It is therefore reasonable to not want to distribute this information. It would be relatively easy to make images that contained the information required to identify the individual to the data controller but other information changed, such as the photograph and actual transactions. This could be done either by editing an image of the real document (eg. put someone else's photograph over mine on an image of my driving licence) or an image from the web (eg. put my address on this).

Clearly to do this to obtain someone else's data would be wrong (fraud?). If I did this to access my data, and the changes were purely to protect my PII would I be committing any crime?

Improve this question
5
  • 1
    I know it's not what you're asking about, but why not just put a black square over the photograph on your real passport?
    – user253751
    Nov 27, 2020 at 15:21
  • That would certainly be an option. My concern is that after all PII other than name and address was removed from these documents they would be mostly black boxes, and so may well not be accepted.
    – Dave
    Nov 27, 2020 at 15:27
  • 1
    They wouldn't be mostly black boxes, they'd be mostly blank space, with a lot of black boxes. e.g. I would black out all the numbers and names of the financial transactions, so there is no information (except for how many there are) but not the whole section where they appear (so it's not just a solid black box)
    – user253751
    Nov 27, 2020 at 15:30
  • As an aside, It's reasonable for a credit agency for ask for financial information to validate who you are, because they already have access to it for the most part, but a photo is another class of data (biometrics) so they shouldn't complain if you blank it out.. iapp.org/news/a/… It may not be reasonable for every company to do so, and you could refuse to comply and complain to the ICO that they are unreasonably withholding access to your information.
    – JeffUK
    Nov 27, 2020 at 17:07
  • The overlap between the set of data contained on a random bank statement with that reasnobly processed by a credit agency is pretty small, and even smaller for a fraud agency.
    – Dave
    Nov 27, 2020 at 22:26

1 Answer 1

Reset to default
2
+50

I will answer this question by reference to the law of the United Kingdom, since you have added the relevant tag.

Section 1 of the Forgery and Counterfeiting Act 1981 provides:

A person is guilty of forgery if he makes a false instrument, with the intention that he or another shall use it to induce somebody to accept it as genuine, and by reason of so accepting it to do or not to do some act to his own or any other person’s prejudice.

Section 9 of the Act provides:

An instrument is false for the purposes of this Part of this Act … if it purports to have been made in the form in which it is made by a person who did not in fact make it in that form …

Section 10 of the Act provides:

[A]n act or omission intended to be induced is to a person’s prejudice if … it is one which, if it occurs … will be the result of his having accepted a false instrument as genuine … in connection with his performance of any duty.

In addition, section 4 of the Identity Documents Act 2010 provides:

It is an offence for a person (“P”) with an improper intention to have in P's possession or under P's control … an identity document that is false and that P knows or believes to be false …

Each of the following is an improper intention — (a) the intention of using the document for establishing personal information about P …

It is likely that what you have proposed is prohibited by each of these laws. It is an unusual example of forgery, as there is no financial gain, and the false representation (that the identity document is genuine) is intended to establish a true conclusion (that you are authorised to have the data). Perhaps there is some room for a defence in here, although I’m not aware of any relevant cases. However, the Identity Documents Act seems intended to prohibit the use of false identity documents per se, without the need to prove a particular consequence.

Improve this answer
4
  • Thank you for the answer. Can I ask where "document" is defined? I would expect my driving licence to be a document, but an image of my driving licence may not be. Forgery and Counterfeiting Act would appear to not apply, because whether I make the image from my own licence with a camera or from an image on the web with photoshop I made it and purport to have made it.
    – Dave
    Dec 5, 2020 at 12:02
  • "Identity document" is defined in section 7. if you are minded to reject my view that a falsified electronic copy of a document is a "false instrument," please note that I have not attempted to exhaustively list all offences that may be involved in this conduct, just the two that seemed like the best fit to me. Creating false or deceptive documents is generally frowned upon, and prohibited by a huge number of laws that apply in specific contexts.
    – sjy
    Dec 5, 2020 at 13:15
  • I am interested in this very specific context. If it makes a difference if something is "generally frowned upon" I may say the current zeitgeist is against unethical data controllers, and requiring individuals to provide special category data (such as issuing authority of driving licence or passport) to make a DSAR is just the sort of thing that should generate such frowns. Your answer is a great step for my investigations.
    – Dave
    Dec 5, 2020 at 14:00
  • It is not clear that an unreasonable requirement is actually being imposed, as you have assumed above that a document which has been redacted in the normal, non-deceptive way "may well not be accepted." If the controller does go beyond s 52 of the Data Protection Act 2018 in requiring you to verify your identity, you should complain about your unfulfilled DSAR rather than create a false document.
    – sjy
    Dec 5, 2020 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .