If they want to play games (DSAR)

by **daveiron** Tue Jun 06, 2023 8:52 am

It appears that an increasing number of DSAR requests are being refused until
evidence is provided as to the identity of the data subject.

As this is usually from a DC or DP ,personally I would not provide the ID they
want. My argument would be.

1. They have written to me at the address their data shows for me.

2. I have responded from that address with a signed dsar request.

3. Should they require further confirmation they are free to check the
Electoral register (if you are still on it).

If they want to play this game ,it works both ways. As they are the ones trying
to extract money from us ,and given all the scams around ,should we not be
asking the same from them ?
Ask them for the same as they ask us;
From the CEO, Copies of passport / driving licence / photo ID
Proof of address , bank statement / utility bill / tax bill.

They claim to take security seriously , well so do we especially with our money.

by Mobo Tue Jun 06, 2023 9:48 am

Maybe they would find away to say that you are the legal person and you agree to the debt I never trust Cabot.
But this is just my take on it, but happy to be corrected.

But at least if they want to play letter ping pong with this matter it's costing the time and money and that has to be a good thing lol!

by flyingfish Tue Jun 06, 2023 9:27 pm

Companies do have a duty to confirm identity, otherwise they could be handing out your personal and and confidential information to another party. There was some ICO guidance on this, which I can't find just now,. Essentially they were saying that companies should be verifying against information they already holdm and the process should not result in them acquiring more information. For example don't request photo ID if you don't have anything to compare the photo with.

by **daveiron** Tue Jun 06, 2023 9:59 pm

Yes the guidance says some companies may require id ,so it comes down
to company policy.
However we may have our own policies which are just as valid.
I begs the question ,just how many blindley accept a letter from a debt collector
as fact and enter into a payment plan or pay in full without any verification
as to whether or not they are genuine .
On the 3 or so occasions they have tried it with me ,i complained to the ICO
and all i asked for was supplied quickly

If you look at what Mobo was asked for in this thread;
https://goodf.forumotion.com/t370p25-subject-acess-request#41657

If they require it ,then we should to,if nothing else it cost them time and money.

by flyingfish Wed Jun 07, 2023 8:36 am

daveiron wrote:If you look at what Mobo was asked for in this thread;
https://goodf.forumotion.com/t370p25-subject-acess-request#41657

I saw that and it's exactly what guidance says they shouldn't do. Supplying those documents would mean they hold a bunch of extra personal information for which they have no business (or other) justification. They should be verifying against what they already hold, which after all was sufficient for them to open the account in the first place.

This sort of thing has been the subject of research in the security industry under the concept of "zero knowledge". Essentially all they need to know is "are you that person?". Yes or No. If that can be answered they don't need your passport number, or driving or banking history.

by Mobo Thu Jun 08, 2023 10:34 am

Thanks to all for their comments I will be sending them a letter informing them of my findings

by **Mrblue2015** Tue Jun 13, 2023 6:53 pm

Good advice DaveIron, thank you

by Sponsored content

If they want to play games (DSAR)

If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)

Re: If they want to play games (DSAR)