IDPC (Malta) - EDPBI:MT:OSS:D:2022:341

From GDPRhub
Revision as of 13:00, 9 November 2022 by Kv (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
IDPC - EDPBI:MT:OSS:D:2022:341
LogoMT.jpg
Authority: IDPC (Malta)
Jurisdiction: Malta
Relevant Law: Article 12(2) GDPR
Article 15 GDPR
Article 58(2)(b) GDPR
Article 58(2)(d) GDPR
Article 61 GDPR
Type: Complaint
Outcome: Upheld
Started: 30.10.2020
Decided: 04.03.2022
Published:
Fine: n/a
Parties: n/a
National Case Number/Name: EDPBI:MT:OSS:D:2022:341
European Case Law Identifier: EDPBI:MT:OSS:D:2022:341
Appeal: n/a
Original Language(s): English
Original Source: EDPB (in EN)
Initial Contributor: n/a

In an Article 60 GDPR procedure, the DPA of Malta reprimanded a controller pursuant of Article 58(2)(b) GDPR) for requiring an ID-photo as identification method to exercise an access request. The DPA also ordered the controller to comply with the request pursuant of Article 58(2)(d) GDPR.

English Summary

Facts

The data subject filed an access request pursuant of Article 15 GDPR. The controller (most likely a game provider, specifics not disclosed) asked a certified copy of an identity card or passport. The data subject provided a photo of his identity card but stated that the request for an ID photo was contrary to the GDPR. The controller should have used other information it possessed for identity verification.

The data subject filed a complaint against the controller at the Berlin DPA on 30 October 2020, which lodged a mutual assistance notification under Article 61 GDPR. After the Berlin DPA transferred the complaint, the Information and data protection commissioner of Malta (DPA) was the Lead Supervisory Authority in this Article 60 GDPR procedure.

The controller stated that it had received false requests in the past and needed to adopt additional measures, such as requesting proof of identity. The controller's customer support agents occasionally requested additional methods of verification, such as a certified or notarised copy of user’s identification documents (defined in recital 64 GDPR as 'identity verification'). The controller stated at first that data subject had multiple user accounts, which had caused doubts regarding the identity of the data subject. However, the controller later informed the DPA that the data subject only had one account.

Holding

Relevant provisions and considerations WP29

The DPA held that the controller violated Article 12(2) by not complying with the access request (Article 15 GDPR).

The controller stated that Article 12(2) aims to ensure substantive rights for data subjects by establishing clear, proportionate and effective conditions as to how and when data subjects can exercise their rights. Also, the controller was not allowed not refuse to act on the request of data subjects for exercising their rights under Articles 15 – 22 GDPR, unless the controller was not able to identify the data subject. The controller should also use all reasonable measures to verify the identity of a data subject, in particular in the context of online services and online identifiers (Recital 64).

The DPA held that the GDPR did not describe how to authenticate data subjects. Therefore, the DPA referred to the WP29 Guidelines on data portability for elaboration and held that the controller shall not refuse to act on a request where a data subject already provided additional information enabling their identification. Also, the controller’s ability to request additional information cannot lead to excessive demands and the collection of data which are not necessary or relevant.

The DPA continued with the fact that the GDPR does not define ‘reasonable measures’, but stated that the GDPR describes an example in the context of online services and identifiers in Recital 57: an authentication mechanism such as the same credentials, used by the data subject to log-in to the online service offered by the controller.

The DPA stated that the request to verify the identity of the data subject must be proportionate. The controller is not allowed to require a broader range of personal data other than that which has already been processed prior to the request, unless this is strictly necessary. The DPA stressed that when the controller asks for additional information for identity verification, this has to comply with the data minimisation principle (Article 5(1)(c) GDPR). The controller should also take into account the broad range of categories of personal data included in the copy of an identity document and the risk arising from the processing of such personal data.

Present case

The DPA determined that the controller’s own procedure for ID verification did not dictate that a certified copy of the ID is only requested in rare cases, where the controller’s customer service support representative has doubts about the data subject’s authenticity. The DPA was also not able to find any references concerning certified copies of ID’s for verification purposes in the submissions from the controller.

The DPA concluded that the controller had no reason to doubt the data subject's identity, especially after the controller confirmed that the data subject had only one account. The controller could have used other reasonable measures to verify the data subject’s identity, which could have been as equally effective and efficient. The DPA provided a few examples of such measures, such as matching the information and personal data provided by the data subject with the identity document on file, or requesting confirmation or further details, such as biographical details and details concerning the complainant’s activity or usage of the controller’s platform.

Because of the above, the controller unjustifiably requested a copy of the data subject’s ID for verification purposes and did not facilitate the data subjects access request (Article 15 GDPR). Therefore, the controller violated Article 12(2) GDPR. The DPA reprimanded the controller (Article 58(2)(b) GDPR) and ordered the controller to respond to the access request (Article 58(2)(d) GDPR).

Comment

The nature of the controller was not specified. However, the data subject was designated as a 'player' on the controller's platform, which might be an indication regarding the nature of the controller.

Also, this decision did not provide a case number from the DPA of Malta on the top on the first page, whereas this is usually the case. There was however an ECLI - number provided on the website of the EDPB.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.