- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
ABIS GmbH – Complaint Upheld (Germany, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
ABIS GmbH was found to have violated privacy rules by requiring a handwritten signature for a data access request. The data protection authority ruled that such a requirement was unnecessary and that the company must respond to requests through various channels. This case highlights the need for clear and accessible processes for users seeking their personal data.
What happened
ABIS GmbH required a handwritten signature to process a user's data access request.
Who was affected
A user who wanted to know what personal data ABIS held about them.
What the authority found
The authority upheld the complaint, stating that the company violated privacy rules by imposing unnecessary identification requirements.
Why this matters
This decision stresses that companies must make it easy for users to access their personal data without unnecessary barriers. It serves as a reminder for businesses to streamline their data access processes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Controller is ABIS, a German address management company that is a subsidiary of Deutsche Post Adress GmbH & Co. KG. It checks the addresses of their customers for accuracy, and updates them if needed. Data subject wanted to know what data was stored about them by ABIS, and submitted an access request. The controller responded by saying that the data subject had to provide a handwritten signature to authenticate their request, claiming they wouldn't be able to identify the data subject otherwise. Moreover, they notified the data subject that they would only respond via postal mail. The data subject filed a complaint with the Hessian DPA, pursuant to Article 77 GDPR. The DPA upheld the complaint. First, it noted that the GDPR does not impose any formal requirements on data subject requests and definitely does not allow the controller to require a signature for identification. Notably, the DPA stated that a signature cannot even be used to uniquely identify a data subject. Secondly, the DPA found that a controller violates Article 12(6) GDPR if their standard response to an access request, is for the data subject to provide additional data to identify themselves. This provision allows the controller only to request such information in the case of reasonable doubt concerning the identify of the data subject. Finally, the DPA considered that controllers have to respond to access request using different communication channels, and cannot respond exclusively via postal mail.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for ABIS GmbH in DE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. ABIS GmbH - Germany (2020). Retrieved from cookiefines.eu
Last updated: