united-kingdom gdpr data-protection
What restrictions can organisations impose on the method of making a DSAR?
<p>From the <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/" rel="nofollow noreferrer">ICO</a> &quot;An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact.&quot;</p>
<p>The <a href="https://www.cifas.org.uk/contact-us/subject-access-request" rel="nofollow noreferrer">Credit Industry Fraud Avoidance System</a> (Cifas) says &quot;If you wish to request a copy of any data held about you on the Cifas Database, the only way is to apply online&quot;, &quot;In line with government recommendations the Cifas office is now closed and therefore we are unable to send or receive post&quot; and &quot;we are unable to handle requests over email as we require originals of some documents in order to prove your identity before releasing information about you&quot;.  If you go through the web form (which requires javascript to even load) it provides an option for online verification (submission of images of Proof of ID and Proof of address).  There appears to be no way to make a DSAR using the web form until after you have provided documents.</p>
<p>Is it consistent with the GDPR for companies to restrict the means through which a GDPR DSAR can be made, particularly if the restrictions require one to provide specific PII prior to being able to make a request, rather than after?  Does it make a difference if the restriction makes technical sense, ie. so &quot;only through post as we need originals&quot; may be justifiable when &quot;we will accept images submitted by a web form but not over email&quot; may not be?  If one sent an email request to <a href="https://rocketreach.co/cifas-the-uks-fraud-prevention-service-email-format_b5e54fadf42e67c7" rel="nofollow noreferrer">these</a> people, and at least one email reached its destination would that count as a valid DSAR?  Is it reasonable to request original documents to complete a DSAR?  While I may feel like I could trust Cifas, I really would not want to send any original documents to most data controllers.</p>

<p>GDPR (<a href="https://gdpr.eu/Recital-64-Identity-verification/" rel="nofollow noreferrer">Recital 64 Identity verification</a>) says about this topic:</p>
<blockquote>
<p>The controller should use all reasonable measures to verify the
identity of a data subject who requests access, in particular in the
context of online services and online identifiers. A controller should
not retain personal data for the sole purpose of being able to react
to potential requests.</p>
</blockquote>
<p>In the <a href="https://gdpr.eu/checklist/" rel="nofollow noreferrer">opinion</a> of ProtonMail, GDPR also means:</p>
<blockquote>
<p>It's easy for your customers to request and receive all the
information you have about them.</p>
<p>People have the right to see what personal data you have about them
and how you're using it. They also have a right to know how long you
plan to store their information and the reason for keeping it that
length of time. You have to send them the first copy of this
information for free but can charge a reasonable fee for subsequent
copies. Make sure you can verify the identity of the person requesting
the data. You should be able to comply with such requests within a
month.</p>
</blockquote>
<p>Looks like this is still open to interpretation how to handle this till there are first court decision.</p>
