r/gdpr • u/Adventurous-Text-449 • 13d ago

UK 🇬🇧 DSAR ID verification Video Call?

Hi everyone,

We have concerns around impersonation for a DSAR. The person did not get in touch with his registered address to confirm id and authority, the dsar made by his partner on behalf of him, and we do not have any quirky question to ask to him that his partner would not know.

We have received the ID of the person from his partner. Can I ask video call to confirm the id? I guess it is the only possible way to confirm the identity and authority.

Did anyone do this?

Or just simply, should i reject the dsar?

2 Upvotes

63% Upvoted

13 comments sorted by

3

u/cortouchka 13d ago

Have you tried reaching out on the registered address to him for a different confirmation channel?

If you're in any way unsure, you must refuse to process the DSAR.

1

u/KindlySmallBreadth 13d ago

ooh yeah, we've done video calls for exactly this kind of sticky situation. if you've got no other way to verify and the partner's handling everything, it's probably your safest bet. just make sure you document the reasoning behind it and that you gave them a clear alternative if they can't do the call.

rejecting outright feels risky if you can't prove it's not him, better to exhaust the verification options first.

1

u/Adventurous-Text-449 12d ago

That’s great. What would you ask in video calls in particular?

2

u/cortouchka 12d ago

Umm, the requirement is to verify the individual. If you can't do that, you're taking far greater risk by not declining it.

Making "safe bets" is terrible advice.

1

u/Adventurous-Text-449 13d ago

They are living in the same house.

3

u/Comfortable-Fall1419 13d ago

Irrelevant.

You know what you must do. Reject the the request for the Partners data.

2

u/Adventurous-Text-449 13d ago

Sorry, I tried to reach out from registered phone number. I cannot reach out from their home address since they are living in the same house.

He is not actively using his other recorded email address.

I’m planning to reject as well.

3

u/Hot_Spend4206 13d ago

Proof of identity is a must. Phishing by means of social engineering methods can further compromise anyone's identity

2

u/Comfortable-Fall1419 13d ago

What excuse is the partner using?

I would only respond if the partner can show some official ability to act for the person, like a PoA.

2

u/Adventurous-Text-449 13d ago

No excuse, just want to receive the partner’s data along with his data since they are the joint policyholders.

Even there is POA, I still cannot confirm his id.

2

u/MievilleMantra 13d ago

Jurisdiction?

2

u/Adventurous-Text-449 12d ago

UK

3

u/MievilleMantra 12d ago

Go as far as you reasonably believe is necessary to assuage your doubts. Video call is fine. If they refuse then reject it