Whilst companies can provide online forms to their customers to help with processing data requests, you are not obliged to complete them to see your request fulfilled.
When fulfilling requests, businesses will on occasion request further ID&V to make sure you are who you say you are, or double check the requested action, especially in the case of an erasure request as it may be a company that stores loyalty points for you for example!
Through the protect service, your requests were sent from your personal email so for most businesses this should be proof enough.
Companies should not request more information if the requesters identity is obvious to them so an email from a registered email address should ordinarily fulfill this! Anything beyond this should be reasonable and proportionate to what they are likely to hold on you.
Eg. Sainsbury's shouldn't be requesting photo ID as they don't hold a copy however your bank will likely choose to do so and are within their rights to.
Here's how to push back on this response:
Dear Privacy team
Whilst you can provide an online form to help with processing data requests, I am not obliged to complete it to get my request fulfilled. I have contacted you from an email I know you have on record for me as I have an email from you in my inbox.
Please search your systems using the email we are communicating via and if you find a current record of my information, delete it in line with my rights under UK GDPR.
Please confirm you have understood my request or whether you need further information from me at this time.
Comments
0 comments
Please sign in to leave a comment.