AP (The Netherlands) - DPG Media fined for unnecessarily requesting proof of identity
|AP (The Netherlands) - DPG Media Magazines B.V.|
|Authority:||AP (The Netherlands)|
|Relevant Law:||Article 5(1)(c) GDPR|
Article 12(2) GDPR
Article 12(6) GDPR
|National Case Number/Name:||DPG Media Magazines B.V.|
|European Case Law Identifier:||n/a|
|Original Source:||DPA's Fine Decision Letter (in NL)|
|Initial Contributor:||Giel Ritzen|
The Dutch DPA issued a €525,000 fine against a media company for a violation of Article 12(2) GDPR by asking data subjects to upload a copy of their ID to verify their identity in order to exercise their rights of access and erasure.
English Summary[edit | edit source]
Facts[edit | edit source]
The controller is DPG Media, a Dutch company that exploits books, magazines, and (news)papers. Between May 2018 and January 2019, the Dutch DPA received several complaints from data subjects who did not have an account with DPG Media, and had to provide a copy of their ID, as verification, before they could submit an access request pursuant to Article 15, or an erasure request pursuant to Article 17 GDPR (the same was not requested from users who had an account).
DPG Media argued that the ID request was justified under Article 12(6) GDPR, as there were no other options to correctly verify the data subject’s identity. The DPA then started an investigation into how DPG Media dealt with access- and erasure requests of data subjects that did not have an account with DPG Media.
Holding[edit | edit source]
The DPA noted that, although the controller must verify the data subject’s identity, it possibly violates Article 12(2) GDPR if it hinders the data subject from exercising their rights. Moreover, as follows from the principle of data minimisation, the identity verification must suffice the requirements of proportionality and subsidiarity. Hence, the controller must, in principle try to verify a data subject’s identity based on the information it already has on this data subject. The DPA further noted that, considering the very sensitive information an ID contains, one can only request a copy of the ID if there is a legal basis to do so.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.