0

When one makes a subject access request it is required that the data controller is required to ensure the identity of the requestor, to prevent unauthorised individuals accessing personal data of others. This is implemented by many organisations (eg. cifas) by requiring the subject to provide documents such as photo id (driving license or passport) and one from a list of documents of which I only have a bank statement.

These documents contain a lot of personal information that I THINK the organisation does not have and I do not want to provide without good reason. This includes:

  • Special category data
    • Place and date of birth
    • Facial photograph
    • Nationality
  • Data useful to fraudsters
    • Which bank I use
    • Bank account number
    • Reoccurring payments (that are the usual security questions asked when I call my bank)
  • Personally sensitive data
    • Spending habits
    • Driving restrictions/convictions

It would seem appropriate to request from the data controller what data they hold about me, and redact any other information. However, as this is likely to be only name and address the redacted documents are likely to be mostly a black square with little boxes of text that would do a rather poor job of verifying my identity in that anyone who knows my name and address could probably generate them.

What are the legal limits of what a data processor can require before providing the response to a SAR? What can a data subject do to prevent further distribution of PII when trying to access data from a potentially untrustworthy data controller? Is there actually a solution that both provides for data security for the subject and verification of identify to the data controller?

Improve this question
1

1 Answer 1

Reset to default
3

Overview

The GDPR requires data controllers (DCs) to exercise reasonable care when responding to an access, modification, or deletion request, to ensure that it comes from the actual Data Subject (person whose data is involved, here a DS). The GDPR does not specify just what methods must or may be used to ensure that an access (or other) request comes from the DS. It does say, in Article 12, that "additional information" may be requested from the DS by the DC for this purpose that is "necessary to confirm the identity" of the DS.

If a DC receives data for identification purposes, it must be used only for those purposes, and retained no longer than needed.

Personal Data (PD) in general must be limited according to article 5, so that data is used only for the purposes it was collected for, retained for no longer than needed, adn appropriately secured against unauthorized use or access. The DC is responsible for adhering to these limitations. Recitals 57, 59, and 77 (quoted below) confirm this, and discuss identification.

If a DC violates these restrictions, it is subject to the same enforcement as it would be for violating any other GDPR provision.

If a DS thinks the data requested to support identification of the DS is excessive, the DS may first complain to the DC, and then to the relevant supervisory authority if the response from the DC is not acceptable (allow at least 1 month for a response). But perhaps knowing that the GDPR forbids the DC from distributing or using this data except for the purpose it was collected, that is, to identify the DS, and from retaining it longer than need be, might offer some reassurance.

A DS could also ask the DC what is the minimum data needed for identification, and redact data beyond this. The DC might need more than name and address, but not all that is on a bank statement or other ID document.

GDPR Sources

Article 12 (section 6) of the GDPR reads:

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

That includes access requests.

Paragraph 1 of Article 11 reads:

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.

Paragraph 1(b) of article 5 specifies that personal data shall be :

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

Paragraph 1(c) of art 5 specifies that such data shall be:

limited to what is necessary in relation to the purposes for which they are processed ...

Paragraph 1(e) of art 5 specifies that such data shall be;

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; [emphasis added]

Paragraph 1(f) of art 5 further specifies that such data shall be:

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing

Recital 59 reads:

Modalities should be provided for facilitating the exercise of the data subject’s rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests.

Recital 57 reads:

If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. 3Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.

Recital 77 reads:

Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the processing, their assessment in terms of origin, nature, likelihood and severity, and the identification of best practices to mitigate the risk, could be provided in particular by means of approved codes of conduct, approved certifications, guidelines provided by the Board or indications provided by a data protection officer. The Board may also issue guidelines on processing operations that are considered to be unlikely to result in a high risk to the rights and freedoms of natural persons and indicate what measures may be sufficient in such cases to address such risk.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .