Lensway Group AB – Complaint Upheld (Sweden, 2023)

A data subject in Finland contacted Lensway Group AB (“controller”) and made an erasure request. The controller replied that the data subject needed to send them his postal address so that they could send him documents related to the request, which should be signed and returned by him. The controller also asked the data subject to verify his identity by sending a copy of his ID by email. The data subject refused to provide this information. The data subject therefore lodged a complaint with the Finnish DPA. Another data subject, in Denmark, contacted the same controller, also for an erasure request. To comply with the request, the controller asked the data subject to provide his social security number and a copy of his ID. The data subject questioned the need for the controller to collect personal data in order to delete his personal data and suggested that it could confirm his identity by sending an email to the address it had registered for him. The controller refused. These two data subjects lodged complaints against the controller in Finland and Denmark. Given the cross-border nature of the processing, the Swedish DPA (“IMY”) made use of the cooperation and consistency mechanisms provided by the GDPR. Regarding the documents that the data subject was required to submit, the controller argued that the name, email address and signature asked in these documents were mandatory to confirm the data subject’s identity and to ensure that they had read the information and given consent. The controller also indicated that they should always ensure that the right person is contacting them regarding requests to exercise a right under the GDPR and that in the present case, the data subjects had not been identified on a good and secure way when contacting the controller. Indeed, the customer relationship could be established on two ways: either by making a purchase, or by creating an account. Firstly, regarding the information requested, the DPA assessed if the controller had reasonable grounds to doubt the identity of the data subjects. The DPA pointed out that under Article 12(6) GDPR additional information may be requested if the controller has reasonable grounds to doubt the identity of the controller. The DPA considered that in the present case, the controller had not demonstrated that there were reasonable grounds to doubt the data subjects’ identity. The DPA also examined if the information requested was necessary to confirm the data subjects’ identity. The IMY considered that providing a copy of an ID is an intrusive measure and is only appropriate when alternative less intrusive verification methods are inappropriate. In the present case for example, data subjects could have logged into their accounts. The DPA found that in the present case, the controller did not demonstrate that a copy of an ID or a signature were absolutely necessary or appropriate. Therefore, the DPA concluded that the controller breached Article 12(6) GDPR. Secondly, regarding the sending of the documents by mail, under Article 12(2) GDPR, the use of ordinary mail as the only means of contact is accepted in exceptional circumstances. The DPA added that alternative ways of submitting requested data should be offered. The IMY held that sending a copy of an identity document may entail special risks which may justify that the document be sent by post, if this is necessary to confirm the identity of the data subject. However, as this was not the case, the DPA found that the controller violated Article 12(2) GDPR. Thus, the DPA issued a reprimand to the controller for breaching Articles 12(2) and 12(6) GDPR.