The GDPR is not explicit about this, but on balance I think Equifax is asking for a fine there.
On one hand, the GDPR places no formal conditions on valid requests. If a request is valid, the data controller must fulfill it, regardless of the form in which the request arrived. There are no applicable grounds to reject the request. Relevant excerpts from Art 12 GDPR:
(1) […] The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
(2) The controller shall facilitate the exercise of data subject rights
under Articles 15 to 22. […]
(3) […] Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
(5) […] Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may […] refuse to act on the request.
On the other hand, data controllers are allowed to ask for additional information to verify the identity before processing the request. It is possible that this verification might not be possible over some channels, e.g. via phone. From Art 12(6):
[…] where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
In the response you got, Equifax is asking you to open an account and then perform your DSAR in a self-service manner. Part of opening an account is an identify verification process. But this is problematic for the following reasons:
- They received a valid DSAR and are now telling you to f*** off and do it yourself. In essence, this is a rejection of your DSAR, but they have not provided valid grounds for rejection.
- They are allowed to ask for an identity verification. But here they're asking you to do that by opening an account, i.e. by entering an ongoing legal relationship with them. They expect you to read through and accept their privacy policy before opening the account, which is unreasonable for handling your DSAR. This is potentially placing conditions on your right to make a DSAR, yet the GDPR provides no grounds for such limitations of your rights.
The real question is whether they really rejected your DSAR you sent via email, or if they are merely offering and suggesting that you instead use their online platform which is of course much more convenient (for them). E.g. looking at Equifax' help center entry How do I make a data subject access request (DSAR) to Equifax? (screenshot, permalink), it seems that they accept requests via any medium (email, online, phone, letter) as long as you provide the material necessary for identity verification. Of course, the link to the form on that page is actually dead.
So it may be worth responding that you'd rather do this via email, and that they could please tell you what documents they need for identity verification. If they are actually rejecting your request, then consider lodging a complaint with the ICO (they should also actively inform you of that option). Equifax is not new to GDPR violations. E.g. their Spanish branch was fined 75 000 EUR for incorrectly refusing an erasure request.
