How do you verify the identity of an individual requesting access to their data or that data be deleted?
The Dutch Data Protection Authority, Autoriteitpersoonsgegevens, offers guidance which can be helpful and instructive not only for GDPR but for CCPA as well:
- If at all possible, refrain from asking for a copy of a formal ID.
Some alternatives may be:
- Via an existing login system.
- A form of two-factor authentication. For example:
- After receiving a request via e-mail request a confirmation by SMS. This mobile number must then match the customer data from your administration.
- Request confirmation of the telephone request by e-mail. This e-mail address must match the customer data from your administration.
- Ask for the last 3 digits of the account number, the date of birth and / or the customer number for verification.
- Ask someone to come by and show you his ID proof without making a copy. Note, however, that this cannot be used to set up a threshold to allow access and should only offered as an alternative.
More details from Autoriteitpersoonsgegevens.
[View source.]
