A company demands a notarised passport for every trivial rectification of a typo in an email address. What principle should govern identity verification for rights requests?
Select an answer to reveal the explanation.
Short Explanation
Asking for a notarised passport to fix a misspelled email is using a vault door on a sticky note. Verify enough to stop impostors, but do not weaponise paperwork against people using their rights. Match the ask to the risk.
Full Explanation
Controllers may request additional information necessary to confirm identity under Article 12, but measures must be proportionate. Excessive verification for low-risk rectifications can unlawfully obstruct data-subject rights. Risk-based, reasonable checks strike the balance between security and accessibility.