DPA case EDPBI:MT:OSS:D:2022:341 – Complaint Upheld (Malta, 2022)

The data subject filed an access request pursuant of Article 15 GDPR. The controller (most likely a game provider, specifics not disclosed) asked a certified copy of an identity card or passport. The data subject provided a photo of his identity card but stated that the request for an ID photo was contrary to the GDPR. The controller should have used other information it possessed for identity verification. The data subject filed a complaint against the controller at the Berlin DPA on 30 October 2020, which lodged a mutual assistance notification under Article 61 GDPR. After the Berlin DPA transferred the complaint, the Information and data protection commissioner of Malta (DPA) was the Lead Supervisory Authority in this Article 60 GDPR procedure. The controller stated that it had received false requests in the past and needed to adopt additional measures, such as requesting proof of identity. The controller's customer support agents occasionally requested additional methods of verification, such as a certified or notarised copy of user’s identification documents (defined in recital 64 GDPR as 'identity verification'). The controller stated at first that data subject had multiple user accounts, which had caused doubts regarding the identity of the data subject. However, the controller later informed the DPA that the data subject only had one account. Relevant provisions and considerations WP29 The DPA held that the controller violated Article 12(2) by not complying with the access request (Article 15 GDPR). The controller stated that Article 12(2) aims to ensure substantive rights for data subjects by establishing clear, proportionate and effective conditions as to how and when data subjects can exercise their rights. Also, the controller was not allowed not refuse to act on the request of data subjects for exercising their rights under Articles 15 – 22 GDPR, unless the controller was not able to identify the data subject. The controller should also us