Last Updated: 24th July, 2022

GDPR Deadlock: The General Data Protection Regulation (GDPR)’s principles are indeed simple and obvious: An international law to continue to ensure data protection and personal privacy for all of the EU and European Economic Area common citizens.

One of the most important aspects of GDPR is the ability for citizens to see what data is held on them by an organization and how it is being used. However, in the rush to comply with the data retention, security and usage requirement of General Data Protection Regulation (GDPR), the process for enabling consumers the right to access their data is still somewhat ad-hoc for many organizations.

One of the most challenging issues is how does an organization determine that a request from an EU citizen to see retained data, is truly from the person making the request? Recently a security researcher managed to trick over 75 organizations into handing over personal information on his girlfriend by making spurious access requests armed initially only with only her phone number and email address.

GDPR is vague on how an organization should verify that they are the legitimate person and different processes are starting to evolve that could cause some serious GDPR Deadlock issues. For example, requesting copies of physical documents such as passports or driving licenses, which would need to be verified (and potentially held for audit), are a potential goldmine for criminals engaged in identity theft. If badly handled, this could lead to a GDPR compliance breach.

GDPR Deadlock: From Digital To Paper

The public and private sector are both impacted – although government agencies have more leeway across GDPR compliance in general due to requirements to retain and use data to deliver services to citizens. In terms of what best practice should be in dealing with a request, the advice from the UK’s Information Commissioner’s Office is that there should be a policy for recording all “subject access requests” and that based on Recital 59 of the GDPR, organizations “provide a means for requests to be made electronically, especially where personal data are processed by electronic means.”

This process will start with an access request form, but when it comes to identity – the guidance is unclear. A number of organizations are asking for a similar set of documents that most banks require to open an account which includes a “proof of identity” such as a passport, photo driving license or birth certificate along with a “proof of address” such as a utility bill, bank statement or credit card statement.

This requirement to verify from copies or scans of electronic documents is a major weakness in this process. With a modicum of Photoshop skill, faking a photocopy of a passport and utility bill is an easy task and as such, some organizations instead require stronger validation methods.

GDPR Deadlock: Better, Best And Worst

The UK banks have possibly the best method of validating identity through the e-banking processes. Although banks must accept subject access requests by letter, many are prompting account holders to make the request through online banking platforms. This has many advantages as the platforms are linked to an account which was opened using validated identification and access and is further strengthened by Multi-Factor Authentication (MFA).

This concept of using an online identity to act as an arbitrator for GDPR compliance is gaining favor. This process, especially when it is tied to a credit or debit card which tied to a physical account holder and address, provides responders to a GDPR compliance request with at least, a verifiable trail to assure identity.

However, the right to access issues exposed by GDPR point of a larger challenge around how people can confirm identity in the digital age.

Estonia’s digital identity scheme, which although had a short outage when a vulnerability was discovered and later rectified, has become a model for best practice in the field of identity. The Estonian ID-kaart is a mandatory identity document for citizens of Estonia, and along with a photo and chip and pin, the ID-kaart has a companion smart-ID app that is compatible with standard X. 509 and TLS infrastructure.

The government issues a client certificate to each citizen that has made it a convenient means of identification for web-based government services, medical records, tax claims, online banking and to make secure General Data Protection Regulation (GDPR) subject access requests.

For public services and local government that want to ensure a citizen’s identity, the best advice is to sign up for GOV.UK Verify, which the Department for Work and Pensions (DWP) uses to check the identities of users who apply for Universal Credit.

GDPR Deadlock: Keep The Shredder At The Ready

Unfortunately, until GOV. UK Verify or similar services emerge that can help third parties to carry out digital identity assurance for free, or at least at low cost; the requirement to gain copies of physical documents will remain.

However, to ensure that documents submitted for access requests don’t themselves become targets for cyber-criminals; organizations must develop verifiable processes to destroy these documents after they have been examined and the request has been delivered.

For organizations that have developed rigorous customer onboarding processes for internet services that include identity validation methods, this website interface provides the most effective way to verify and process access requests.

However, this cannot be an exclusive option as non-electronic means must also be available to meet General Data Protection Regulation (GDPR) requirements.