Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Alice has requested access to her personal data from a shopkeeper.
Barbara has submitted a SAR to a police force for BWV footage.
They both require one item of identification and another for evidence of the subjects’ addresses.
What if one doesn’t possess materials that satisfy their acceptable documents list? Or one has no fixed abode. Does one’s subject access rights become null? Are such requirements then lawful?
It depends.
Article 12(6) GDPR says:
Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21 [Article 15 relates to SARs], the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Recital 64 says:
The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.
The Information Commissioner's Office guidance says:
Can we ask for ID?
Yes. You need to be satisfied that you know the identity of the requester (or the person the request is made on behalf of). If you are unsure, you can ask for information to verify an individual’s identity. The timescale for responding to a SAR does not begin until you have received the requested information. However, you should request ID documents promptly.
It used to also say: "However, it is important that you only request information that is necessary to confirm who they are."
What if one doesn’t possess materials that satisfy their acceptable documents list? Or one has no fixed abode.
Tell them and discuss some other means of satisfying them about your identity.
Complain.
Does one’s subject access rights become null? Are such requirements then lawful?
It depends.
On the one hand you want your SAR response. On the other hand you don't want them to give your personal data to any old Tom, Dick or Harry pretending to be you and making subject access requests.
If the response contains data that won't adversely affect your rights and freedoms then it would be inappropriate to make you jump through multiple hoops. If the response contains sensitive data you will want them to be more careful.
The process must be reasonable and proportionate.
Some organisations are institutionally stupid and they have blanket rules that in specific cases are not reasonable or proportionate and none of the frontline staff can (for whatever reason) help you. In such a case you must find someone in the company who can make a reasonable decision. If you can't do that then you must go through the complaints procedure to assert your legal right.
Of course, if the response will be sent by post then an address is necessary.
