Recital 52*

Go to related Article 11
Go to related Article 15

Commission proposal

(52) The controller should use all reasonable measures to verify the identity of a data subject that requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the unique purpose of being able to react to potential requests.

EDRi’s Proposed amendment

(52) The controller should use all reasonable measures to verify the identity of a data subject that requests authenticity of a subject access request, in particular in the context of online services and online identifiers. A controller should not retain personal data for the unique purpose of being able to react to potential requests.

Justification
It is entirely possible that in some circumstances positive identification of the data subject would not be strictly necessary to provide access.

  • eu logo The launch and upkeep (until December 31, 2013) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
  • EDRi.org
%d bloggers like this: