A company demands a notarised passport for every trivial rectification of a typo in an email address. What principle should govern identity verification for rights requests?
Select an answer to reveal the explanation.
Short Explanation
Asking for a notarised passport to fix a misspelled email is using a vault door on a sticky note. Verify enough to stop impostors, but do not weaponise paperwork against people using their rights. Match the ask to the risk.
Full Explanation
Identity verification for rights requests must be proportionate to the risk of unauthorised disclosure or alteration of personal data. Demanding a notarised passport for every trivial rectification of a typo in an email address erects an abusive barrier that can unlawfully hinder exercise of rights. Match the assurance level to sensitivity and to what is already known about the requester through an authenticated existing relationship.
Controllers must not always require notarised identity documents for any rights request. Completely skipping identity checks is also unsafe where impersonation could expose or change data. Biometric face scans are not the only acceptable method and may themselves be disproportionate—and special-category intrusive—for low-risk corrections.
Exam caveat: proportionality of ID checks is a recurring exam theme—neither fortress nor free-for-all. Operational check: define tiered verification (logged-in account confirmation for low risk; stronger proof for high-risk access packs), avoid collecting excess ID copies, and delete verification artefacts when no longer needed. Civic portals should help residents fix obvious typos without turning every correction into a notary appointment that chills rights and wastes public resource.