1

We have received an electronically signed GDPR data request from a person who has only provided his name and surname. We wanted to be sure that this person is who he claims he is, so we have asked to additionally provide his national ID number. But he has refused to do so.

There is a possibility that he may well be an identity thief.

How certain can we be that the one who has used the electronic signature is the real person and not an identity thief? Is electronic signature a proper mean for identification?

Improve this question
4
  • You want the truth? Most of the an electronic signature is probably sufficient but the reality is it’s really hard to tell if they don’t a national ID- they could be stubborn and lazy, or they could be an identity theft.
    – security_paranoid
    Commented Jul 10 at 5:25
  • 1
    Electronically signed by what? By a self-issued certificate, by a government issued certificate or what else? The trust you can get from the signature depends (among other things) on the trust you have in the issuer of the certificate.
    – Steffen Ullrich
    Commented Jul 10 at 7:46
  • 1
    Or, are you using the term 'electronic signature' to refer to a document signing solution (such as 'DocuSign'), which does not rely on certificates or crypto whatsoever?
    – mti2935
    Commented Jul 10 at 9:27
  • If I were the requester, I wouldn't give any important ID number to your organization unless you could prove there was a good reason to do so and the method of submitting it was secure.
    – Gerard Ashton
    Commented Jul 10 at 14:57

1 Answer 1

Reset to default
1

Short answer: the electronic signature is sufficient, if the signer can be trusted.

In legalese: “The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.”

The keyword here is 'reasonable' (not 'all').

You need to trust the signer somehow. That may be via a key-chain. PGP had another way, via public keys signed by someone you know.

If you do not have such a trust relation that ensures that the signing is done by the actual person, then no, it is not enough.

The asking for the national ID (Social Security number, Burger Service Number, numéro de sécurité social and the likes) may also not be sufficient. Do you have any serious way of checking whether this number actually corresponds to the requestor? If not, than that too is an insufficient measure to verify the identity.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .