HBDI (Hesse) - 90.20.77:0245
| HBDI (Hesse) - 90.20.77:0245 | |
|---|---|
 | |
| Authority: | HBDI (Hesse) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 12(6) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 20.11.2020 |
| Published: | 19.12.2020 |
| Fine: | None |
| Parties: | ABIS GmbH |
| National Case Number/Name: | 90.20.77:0245 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | German |
| Original Source: | Datenanfragen.de (in DE) |
| Initial Contributor: | Benjamin Altpeter |
The DPA of Hesse (the HBDI) held that ABIS GmbH, an address management company, may not require a signature as identification for access requests as per Art. 12(6) GDPR and has to also respond to access requests via other transport mediums than postal mail.
English Summary
Facts
A data subject made an access request with ABIS, a German address management company. The company responded saying that the data subject had to provide a handwritten signature to authenticate their request, claiming they wouldn't be able to identify the data subject otherwise.
They further said they would only respond via postal mail.
Holding
The DPA held that the GDPR imposes no formal requirements on data subject requests and especially doesn't allow the controller to require a signature. The DPA said that a signature cannot even be used to uniquely identify a data subject.
The DPA further held that always requesting additional identification data from data subjects in response to requests violates Article 12(6) GDPR, which only allows this in the case of reasonable doubts concerning the identity of the data subject.
Finally, the DPA held that controllers have to respond to access request using different transport mediums, not only postal mail.
ABIS GmbH accepted the holding and confirmed to the DPA that they would cease both practices.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
