united-kingdom gdpr data-protection subject-access-request
Why do some data controllers require two forms of ID and others only one?
<p>Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces.</p>
<p>Some police forces simply require scan of id with photo, name, dob, while others need two forms including proof of address. However it is not clear from their requirements whether both must indicate all the required informations or if they simply must both between them indicate all of them.</p>
<p>Are there rules on  what requirements may be deemed unlawfully or excessively onerous as preconditions for complying with a SAR?</p>
<p>And why would they require this when other perfectly analogous police forces are happy with one basic photo ID?</p>
<p>Both aspects: why do they need your address (and what if you are a vagabond/nomad with NFA?), And why is one id not good enough?</p>

<p>Verifying the identity of the person making an SAR is a requirement (for fairly obvious reasons) but there's no specified way this is to be done. As the ICO puts it:</p>
<blockquote>
<p>If you’re not sure the requester is who they say they are, you must check this quickly. You shouldn’t ask for formal ID unless it’s necessary and proportionate. Instead, you could ask questions that only they would know, about reference numbers or appointment details for example. Or you can ask for ID that you can actually verify. There’s little point insisting on photo ID if you don’t know what the requester looks like – it should be proportionate.</p>
</blockquote>
<p>The key word to take account of here is &quot;proportionate&quot; - and this is going to hinge on not just the data the SAR is asking for but the type of data that the Data Controller/Processor is handling.</p>
<p>A police force is likely to be storing far more sensitive data about the data subject than e.g. a retailer and you'd expect a more robust identification process.</p>
<p>The fact that the law doesn't specify ID requirements is what will lead to different organisations having different requirements - they've ultimately had a large amount of leeway in determining what is appropriate themselves, and that leads naturally to variation.</p>
<p>In general terms (rather than specifically for SARs) requiring two forms of ID is not uncommon, it does after all increase the security of the process. Pick-pocketing someone's wallet will often get you their driver's license but it will rarely get their wallet <em>and</em> their recent utility bill. Successfully intercepting a utility bill won't get you their driver's license. It's not perfect but it raises the difficulty of circumventing the check.</p>
<blockquote>
<p>Are there rules on  what requirements may be deemed unlawfully or excessively onerous as preconditions for complying with a SAR?</p>
</blockquote>
<p>If Bob feels the ID requirements are too extreme they can complain to the ICO and if they agree they can &quot;advise&quot; the data controller to ease up on the requirements and if this fails to reach a satisfactory outcome Bob ca take legal action - but I doubt the examples given would raise any concern. Even the two-forms level is only on a par with the requirements many agencies have for renting a car.</p>
<blockquote>
<p>why do they need your address (and what if you are a vagabond/nomad with NFA?)</p>
</blockquote>
<p>In addition to the ID-aspects having your address may be necessary in terms of communicating with you regarding the SAR. If you're someone of no fixed address this requirement may provide difficulties of course - but SARs are by no means unique in this regard. Talking to the data controller and seeing if they would be willing to accept either an alternative second form of ID or waiving the requirement altogether would be the logical first step in such circumstances.</p>
