gdpr
Do I have to provide proof of citizenship - GDPR
<p>Recently, I've been going through some old accounts of mine (on online websites) and I started deleting them. Thanks to GDPR, this is now much easier.</p>

<p>Most companies' customer services have no problems with this; but I have encountered one where they were rather less cooperative. First they said that I can only <em>deactivate</em> my account, but I want to <em>delete</em> it (and <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Article 17 of the GDPR</a> gives me this right).</p>

<p>Therefore, I further emphasised that my wish is for them to <em>completely delete</em> my account. To this they <a href="https://i.stack.imgur.com/Nm6mG.png" rel="nofollow noreferrer">responded</a> that I have to send them my passport and ID to <em>prove</em> that I am an EU citizen. I understand that they may have this right - but do they <em>actually</em>? I cannot find anywhere online that I have to do so - and actually, sending in photos of my documents seems a bit iffy to me, at the very least.</p>

<p>You do not have to prove that you are an EU citizen, because EU citizenship is <em>entirely irrelevant to the GDPR.</em>  Have a look at <a href="https://gdpr-info.eu/art-3-gdpr/" rel="noreferrer">Article 3</a>, which basically says that GDPR applies if you are in the EU or if the company is in the EU.</p>

<p>If the company is in the EU, therefore, you do not need to send them anything or prove anything about yourself to invoke GDPR.  If the company is outside the EU, you can send proof of address or other evidence that you are in the EU, which might be something that they already have, like your IP address.</p>

<p>As a slightly different viewpoint, the company can ask for additional document to verify you are who you say you are.  Article 12(6) states:</p>

<blockquote>
  <p>where the controller has reasonable doubts concerning the identity of the natural person making the request ... the controller may request the provision of additional information necessary to confirm the identity of the data subject.</p>
</blockquote>

<p>There's no provision stating what specifically is necessary, I would expect a bank to require more stringent ID verification than a blogging site, but it's up to the controller (company) to make that determination.  There is no requirement to prove that you are an EU citizen.</p>
