gdpr
Isn&#39;t it impossible to respond to certain data access requests?
<p>There is an european named A. He goes to a website and tells the website &quot;under my GDPR right to access (given by this <a href="https://gdpr-info.eu/issues/right-of-access/0" rel="nofollow noreferrer">one</a>) I hereby ask for my ip address which you logged on september 4, 2018.&quot; . Well no company can figure out which ip belongs to whom.What should they do?</p>

<h2>“What IP address is that?”</h2>
<p>Since this is A’s personal data, they must be able to identify the particular IP address they used and prove that it was theirs. If they can’t then the company is perfectly within its rights to say, “since you can’t prove it’s yours, we can’t disclose it to you”.</p>

<p>Per <strong>Art 11 GDPR</strong>, the data subject rights like the right to access <strong>do not apply</strong> if identification is not possible. The data controller is explicitly not required to keep data just in order to be able to respond to later data subject requests. In particular, a data controller might not even log IP addresses. Similarly, the data controller can request additional verification of the data subject's identity per Art 12(6) if there are reasonable doubts about the identity of the person making the request.</p>
<p>However, the data subject rights do apply again if the data subject provides the necessary information to identify them. E.g. indirect identification might be possible if the data subject provides the exact timestamp at which they visited a particular URL, provided that the controller keeps typical logs.</p>
<p>Furthermore, if indirect identification of the data subject would be extremely cumbersome, there might be an argument that the request would be excessive in the sense of Art 12(5) and could be denied – but the data controller would have the burden of proof here.</p>
