ABIS GmbH – Complaint Upheld (Germany, 2020)

Controller is ABIS, a German address management company that is a subsidiary of Deutsche Post Adress GmbH & Co. KG. It checks the addresses of their customers for accuracy, and updates them if needed. Data subject wanted to know what data was stored about them by ABIS, and submitted an access request. The controller responded by saying that the data subject had to provide a handwritten signature to authenticate their request, claiming they wouldn't be able to identify the data subject otherwise. Moreover, they notified the data subject that they would only respond via postal mail. The data subject filed a complaint with the Hessian DPA, pursuant to Article 77 GDPR. The DPA upheld the complaint. First, it noted that the GDPR does not impose any formal requirements on data subject requests and definitely does not allow the controller to require a signature for identification. Notably, the DPA stated that a signature cannot even be used to uniquely identify a data subject. Secondly, the DPA found that a controller violates Article 12(6) GDPR if their standard response to an access request, is for the data subject to provide additional data to identify themselves. This provision allows the controller only to request such information in the case of reasonable doubt concerning the identify of the data subject. Finally, the DPA considered that controllers have to respond to access request using different communication channels, and cannot respond exclusively via postal mail.