gdpr
Can a company force you to create an account on their system to comply with a GDPR request?
<p>This is an EU question.</p>
<p>I did a request Equifax to send me a copy of all my personal data (not my credit report, but all personal data), under GDPR.</p>
<p>In reply, they are asking me to create an account on their system to process the request.
If I refuse, can they refuse to comply with the request?</p>
<p>From their email:</p>
<blockquote>
<p>You can log in at <a href="http://www.equifax.co.uk/subjectaccess" rel="nofollow noreferrer">www.equifax.co.uk/subjectaccess</a> and from here create
an account. You will be asked to verify your identity either through a
series of questions or you will be requested to send us verification
documents. Once verification is approved, you can log in and submit
your data subject access request (DSAR) by completing the order form
online.</p>
</blockquote>
<p>I'm seeing quite a few companies asking people to 'jump into their model' in order to process requests, whereas I was under the impression that a simple communication to them was enough for them to comply.</p>
<p>What is the law saying about this?</p>

<p>On first sight, this appears legal.</p>
<p>An &quot;account&quot; can mean as little as an identified set of personal data. Equifax can <em>and must</em> identify you when executing a data subject access request. Obviously they can't send that data to just anyone!</p>
<p>If creating an account involves specific legal steps in addition to providing the necessary data, some of those steps might be illegal. But at first glance, I don't see such steps.</p>
<p>Note that under the GDPR, Equifax may not hold your data for longer than necessary, which includes this account data. It was created for the sole purpose of accessing your data. Equifax may hold on to some of this data for a reasonable period to prove that they received and processed your request, but the copies of the verification documents themselves are not required for this.</p>

<p>The GDPR is not explicit about this, but on balance I think Equifax is asking for a fine there.</p>
<p>On one hand, the GDPR places no formal conditions on valid requests. If a request is valid, the data controller must fulfill it, regardless of the form in which the request arrived. There are no applicable grounds to reject the request. Relevant excerpts from Art 12 GDPR:</p>
<blockquote>
<p>(1) […] The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.</p>
<p>(2) The controller shall facilitate the exercise of data subject rights
under Articles 15 to 22. […]</p>
<p>(3) […] Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.</p>
<p>(5) […] Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may […] refuse to act on the request.</p>
</blockquote>
<p>On the other hand, data controllers are allowed to ask for additional information to verify the identity before processing the request. It is possible that this verification might not be possible over some channels, e.g. via phone. From Art 12(6):</p>
<blockquote>
<p>[…] where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.</p>
</blockquote>
<p>In the response you got, Equifax is asking you to <em>open an account</em> and then perform your DSAR in a <em>self-service manner</em>. Part of opening an account is an identify verification process. But this is problematic for the following reasons:</p>
<ul>
<li>They received a valid DSAR and are now telling you to f*** off and do it yourself. In essence, this is a rejection of your DSAR, but they have not provided valid grounds for rejection.</li>
<li>They are allowed to ask for an identity verification. But here they're asking you to do that by opening an account, i.e. by entering an ongoing legal relationship with them. They expect you to read through and accept their privacy policy before opening the account, which is unreasonable for handling your DSAR. This is potentially placing conditions on your right to make a DSAR, yet the GDPR provides no grounds for such limitations of your rights.</li>
</ul>
<p>The real question is whether they really rejected your DSAR you sent via email, or if they are merely <em>offering</em> and <em>suggesting</em> that you instead use their online platform which is of course much more <em>convenient</em> (for them). E.g. looking at Equifax' help center entry <a href="https://help.equifax.co.uk/EquifaxOnlineHelp/s/article/How-do-I-make-a-data-subject-access-request-to-Equifax" rel="nofollow noreferrer">How do I make a data subject access request (DSAR) to Equifax?</a> (<a href="https://i.stack.imgur.com/Ss7xN.png" rel="nofollow noreferrer">screenshot</a>, <a href="http://archive.today/h1eLC" rel="nofollow noreferrer">permalink</a>), it seems that they accept requests via any medium (email, online, phone, letter) as long as you provide the material necessary for identity verification. Of course, the link to the form on that page is actually dead.</p>
<p>So it may be worth responding that you'd rather do this via email, and that they could please tell you what documents they need for identity verification. If they are actually rejecting your request, then consider lodging a complaint with the ICO (they should also actively inform you of that option). Equifax is not new to GDPR violations. E.g. their Spanish branch was fined 75 000 EUR for incorrectly refusing an erasure request.</p>
