DPG Media – €525,000 Fine (Netherlands, 2022)

The controller is DPG Media, a Dutch company that exploits books, magazines, and (news)papers. Between May 2018 and January 2019, the Dutch DPA received several complaints from data subjects who did not have an account with DPG Media, and had to provide a copy of their ID, as verification, before they could submit an access request pursuant to Article 15, or an erasure request pursuant to Article 17 GDPR (the same was not requested from users who had an account). DPG Media argued that the ID request was justified under Article 12(6) GDPR, as there were no other options to correctly verify the data subject’s identity. The DPA then started an investigation into how DPG Media dealt with access- and erasure requests of data subjects that did not have an account with DPG Media. The DPA noted that, although the controller must verify the data subject’s identity, it possibly violates Article 12(2) GDPR if it hinders the data subject from exercising their rights. Moreover, as follows from the principle of data minimisation, the identity verification must suffice the requirements of proportionality and subsidiarity. Hence, the controller must, in principle try to verify a data subject’s identity based on the information it already has on this data subject. The DPA further noted that, considering the very sensitive information an ID contains, one can only request a copy of the ID if there is a legal basis to do so. The DPA found that, considering the sensitive information on an ID, and that it is possible to verify the data subject’s identity based on other information (like subscription details, name, and email), it is disproportionate to request, in all cases, a data subject’s ID for verification. Hence, the DPA concluded that DPG Media violated Article 12(2) GDPR for not facilitating the data subject’s rights sufficiently. The DPA imposed a fine of € 525,000 and considered that this was appropriate, due to the sensitivity of the personal data, the systemic nature of