RE:- SAR

[Cozmo]

I have received a reply from a SAR request asking me to provide my Birth certificate and Passport to prove my identity, is this correct?

[Peridot]

Hi Cozmo,

I would say it is quite normal to ask for 2 forms of ID to prove the person making the request where personal information is involved is entitled to request the info and not some random person.

When requesting personal information it is correct that you should prove you are the person to whom the information relates. The nature of an SAR request means there could be sensitive personal information held which should not be revealed to others without the individual's written authority and equally requesting proof that you are who you say you are when making the request.

[Cozmo]

Should a photocopy be sufficient proof?

[Cozmo]

Thank you for responding.

[Peridot]

I suspect not. They may want the original or a certified copy. So if you do send copies you may need to take the original and the copy to a local solicitor for them to sign the copy confirming it is a true copy of the original which they have seen.

If you do decide to send original documents I would send registered post and insist they return them the same way. It may be worth calling the place you've requested the SAR from and asking what they would accept before doing so?

[Amethyst]

Can we ask an individual for ID?

If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality.

You need to let the individual know as soon as possible that you need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information.

Birth Certificate seems a bit extreme, your passport contains your name and DOB. Neither contains your address. Driving Licence contains name, DOB and address so that's likely to be a better option.

Presumably you have changed address, or name, since opening the account ? Who was the SAR to ? Ashley Longmann / Halifax / Cabot / Restons ?

[R0b]

I would have to disagree slightly with Peridot (sorry) on the point about sending originals, as I think in almost all cases copies would be sufficient.
Data controllers do have a duty under the GDPR to ensure they are able to confirm the identity of the data subject.

Data controllers do have a duty under the GDPR to ensure they have correctly identified the data subject and that the individual making the request is that person. Furthermore, Article 12(2) of the GDPR says that "the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject."

Also note Article 11(2) which says that "Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification."

As Amethyst has pointed out, it needs to be proportionate depending on the circumstances in which the request was made. For example, where you make a request for disclosure by a utility company, you could authenticate yourself by giving sufficient information within the SAR letter, such as the account number, your date of birth, full name, the address which the account is linked to or if you have broadband or mobile phone many set up a password on the account which could also be used to identify yourself.

In the above instance, it might not be necessary for the utility company to require further identification from you - they would need to have reasonable doubts as to who you are. At the same time, a requirement for your birth certificate and passport in order to verify you might not be relevant because there is no link to the verification documents and the data that they hold about you. On the other hand, it may be reasonable for a bank to request your passport because it's likely they have a copy of that on your file when you set up an account or entered into a mortgage agreement with them.

Many companies have tend to have a policy or automatic procedure to request further documentation to verify you without actually considering whether or not they have sufficient information already. To anticipate these kinds of problems and minimise delay, you could enclose copies of additional verification documentation as part of your SAR request letter.

In your case, a birth certificate and passport is overkill. I would probably say one of them plus a utility bill but not both would suffice depending on who the request is made to.

P.s I'm ranting because I have a gripe with some companies about this very point!

[Peridot]

Hi all,

Stand corrected rob I suppose I was thinking from the other side if someone sent my Bank an SAR I'd want to know they made damn sure it was me before handing over chapter and verse on my details, but see your points. I suppose it is dependant on the sort of institution you are requesting info from and the likely info they could hold on you.

[R0b]

Hey I'm not saying I'm right, just my own view of things and sometimes I think what companies ask for might be considered excessive and/or question whether it complies with certain principles e.g. data minimisation.

[Peridot]

Don't mind if you are saying you're right, carry on ranting I say. Appreciate the steer rob

[Cozmo]

Thanks everyone, will send ID within the initial SAR request going forward, maybe account number DOB, copies
first, at risk of delay.

[Amethyst]

This thread I think Cozmo ?