Client Alert
Billee Elliott McAuliffe, Melissa G. Powers
share this page:
Recently, the Spanish data protection authority—the Agenica Española de Protección de Datos—fined a Spanish gas company €12,000 (about $13,200) for responding to a data subject request (i.e., a person's requesting data about himself or herself) without properly verifying the data subject’s identity under European Union’s General Data Protection Regulation (GDPR). This enforcement action serves as a reminder for businesses to appropriately respond to and verify data subject requests or risk violating the law and paying fines. Similarly, when the California Consumer Privacy Act (CCPA) comes into effect on January 1, 2020, businesses will need to have analogous procedures for handling consumer requests from California residents.
The recent enforcement action from the Spanish data protection authority emphasizes that a business must confirm the identity of the individual making a request. If a business is unsatisfied as to the identity, Article 12(6) of the GDPR provides that a business can request further information to confirm identity. However, businesses still need to comply with the GDPR’s overarching principles, including confidentiality and data minimization. In accordance with the latter, the GDPR states that a data controller should not retain personal data for the sole purpose of being able to certify potential requests.
The Article 29 Working Party (a data privacy and protection advisory body that was replaced by the European Data Protection Board after GDPR enactment) confirmed that there are no specific procedures in the GDPR on how to verify a person making a request for information about himself or herself. The GDPR simply states that a data controller should use “all reasonable measures” to verify the identity of a person making a request, especially online. It is left to businesses to create and follow procedures to verify the identity of a requestor and ensure that they do not disclose personal data to the wrong person, infringe any data subject rights, or make it too difficult for the data subjects to exercise their rights, any of which would violate the GDPR.
The CCPA proposed regulations include guidance on verifying consumer requests. Although not yet enacted, the proposed regulations’ verification procedures give businesses a sense of what would likely be acceptable under the CCPA. The proposed regulations note that, whenever feasible, businesses should match the identifying information provided in the request to the personal information of the requestor already maintained by the business, or use a third-party identity verification service. Businesses should seldom request additional information for verification, but if a business does collect new personal information for verification, the proposed regulations require businesses to delete it as soon as practicable after processing the request. Further, businesses should avoid collecting unnecessary sensitive personal information.
Under the CCPA proposed regulations, the type of request mandates the standard of certainty needed for verification. For example, for a request to know the categories of personal information collected, a business needs to verify the requestor’s identity to a "reasonable" degree of certainty, which may include matching at least two data points provided by the requestor with data points maintained by the business. However, for a request to know specific personal information collected, a business must verify the requestor’s identity to a "reasonably high" degree of certainty, which may include obtaining a signed declaration that the requestor is the consumer whose personal information is the subject of the request.
Ideally, mechanisms for users to request personal information should include the information needed to verify the requestor's identity.
The extent to which additional information might be needed for identity verification can vary.
If additional information is required to verify the requestor's identity, use discretion.
If you need assistance complying with or creating policies for the GDPR, the CCPA, or other privacy laws, please contact one of our Cybersecurity & Data Privacy attorneys.
