Why do some data controllers require two forms of ID and others only one? Meet Bob. Bob has submitted a number of subject access requests to various data controlling bodies, including businesses and several police forces. Some police forces simply require scan of id with photo, name, dob, while others need two forms including proof of address. However it is not clear from their requirements whether both must indicate all the required informations or if they simply must both between them indicate all of them. Are there rules on what requirements may be deemed unlawfully or excessively onerous as preconditions for complying with a SAR? And why would they require this when other perfectly analogous police forces are happy with one basic photo ID? Both aspects: why do they need your address (and what if you are a vagabond/nomad with NFA?), And why is one id not good enough?
Verifying the identity of the person making an SAR is a requirement (for fairly obvious reasons) but there's no specified way this is to be done. As the ICO puts it: If you’re not sure the requester is who they say they are, you must check this quickly. You shouldn’t ask for formal ID unless it’s necessary and proportionate. Instead, you could ask questions that only they would know, about reference numbers or appointment details for example. Or you can ask for ID that you can actually verify. There’s little point insisting on photo ID if you don’t know what the requester looks like – it should be proportionate. The key word to take account of here is &quot;proportionate&quot; - and this is going to hinge on not just the data the SAR is asking for but the type of data that the Data Controller/Processor is handling. A police force is likely to be storing far more sensitive data about the data subject than e.g. a retailer and you'd expect a more robust identification process. The fact that the law doesn't specify ID requirements is what will lead to different organisations having different requirements - they've ultimately had a large amount of leeway in determining what is appropriate themselves, and that leads naturally to variation. In general terms (rather than specifically for SARs) requiring two forms of ID is not uncommon, it does after all increase the security of the process. Pick-pocketing someone's wallet will often get you their driver's license but it will rarely get their wallet and their recent utility bill. Successfully intercepting a utility bill won't get you their driver's license. It's not perfect but it raises the difficulty of circumventing the check. Are there rules on what requirements may be deemed unlawfully or excessively onerous as preconditions for complying with a SAR? If Bob feels the ID requirements are too extreme they can complain to the ICO and if they agree they can &quot;advise&quot; the data controller to ease up on the requirements and if this fails to reach a satisfactory outcome Bob ca take legal action - but I doubt the examples given would raise any concern. Even the two-forms level is only on a par with the requirements many agencies have for renting a car. why do they need your address (and what if you are a vagabond/nomad with NFA?) In addition to the ID-aspects having your address may be necessary in terms of communicating with you regarding the SAR. If you're someone of no fixed address this requirement may provide difficulties of course - but SARs are by no means unique in this regard. Talking to the data controller and seeing if they would be willing to accept either an alternative second form of ID or waiving the requirement altogether would be the logical first step in such circumstances.
Identification rules vary from state to state, but there is no state which would require a person in Mr. Walker's position to identify themselves to law enforcement. The passenger is compelled to produce identification to law enforcement through the threat of illegal violence.
According to this article, the Malmö Administrative District Court found that the intent of the user is immaterial to whether a camera is being used for surveillance, so even if that is not why you are doing this, it counts legally as "surveillance". The law requires a permit from the länsstyrelse (county? government), according to the Kameraövervakningslag (2013:460) (article 8 states the requirement for permit, art. 16 tells you who to apply to). I believe that a tennis court would be considered a "public place", even if privately owned. Art. 17 tells you what goes into an application (there is probably a form), and art. 18 says that the kommun gets to weigh in. Presumably it would be critical to have a consent form signed before any recording happens, and you would include that in the application.
Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are: the data subject has given consent to the processing of his or her personal data for one or more specific purposes. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. processing is necessary for compliance with a legal obligation to which the controller is subject. processing is necessary in order to protect the vital interests of the data subject or of another natural person. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. So unless you have some very compelling reason to need to process that person's data without their consent, you can't legally do it. Therefore it is hard to see how you could produce this "template", and even if you somehow did the person receiving it might not have a lawful basis for fetching (processing) that data anyway.
It depends. Can the data controller or another person, with &quot;means reasonably likely to be used,&quot; (see clause 26 of the preamble of the GDPR) use that data alone or in combination with other data to identify a natural person? If yes, it is personal data within the meaning of the GDPR. If no, it is not personal data within the meaning of the GDPR. Anonymous data is not subject to the GDPR. &quot;The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.&quot; Assigning an unique alphanumeric code to a thing does not necessarily make the code and/or the thing &quot;personal data&quot;. But if you have a set of data that is or can be linked by the unique alphanumeric code (e.g. as a primary key in a set of tables) and you can use it to identify a person, then it is personal data. Either way, to be GDPR-compliant / to mitigate risk you should make some kind of record to reflect that process of thinking and what you decided. And if the answer is Yes, it is personal data, then you should record your &quot;lawful basis&quot; for processing the data and how you decided that.
The common law is permissive That is to say that, in a common law jurisdiction, the law is about what you must not do rather than about what you must do. Now, particular statutes may be phrased as requiring certain actions but, if you read them the “common law way” to coin a phrase, they are really imposing sanctions for doing the prohibited thing that falls outside those parameters. Since there is no legal prohibition on using multiple names (simultaneously or sequentially) you are free to do so. Now, there are common law prohibitions of, for example, fraud or tax evasion. So, if you use different names for the purpose of doing those prohibited things, then that is illegal but it is the specific criminality that is sanctioned, not the use of the alias in perpetrating it. The UK has a law that makes it a crime to not register the birth of a child. It also imposes some (and by most country’s standards, very few) restrictions on the name a child can be registered under. But there is no legal obligation on the child or their parents to use the registered name in any particular circumstances. There may be difficulties (amounting to impossibility in some cases) in obtaining a passport, opening a bank account, or claiming social security under a non-registered name but that is due to the necessity to identify the individual for which the name serves as a proxy. However, outside the requirements of specific statutes or administrative procedures, the common law position is that your name is what people call you and you identify as your name. The second part is important - I have been called dickhead on many occasions but I do not consider it to be my name. The UK has a patronymic tradition for surnames so, usually, on marriage, the female adopts the surname of the male and that, through the marriage certificate, becomes her registered name. However, it is extremely common for women to continue to use their original (and now not registered) name in their professional life and her new name in her private life. This can be problematic. My wife, has on server all occasions been refused permission to board a plane because the ticket (booked by others) was in her maiden name - a name for which she has no official identification. However, that’s a procedural problem - she didn’t do anything illegal.
Reporting that an SS card is lost or stolen could be useful for two reasons: obtaining a replacement, and finding and prosecuting the perpetrator. You can obtain a replacement card from SSA at any time, and they do not require a justification for a card (they do not investigate thefts). The local police can investigate, but will only investigate a theft (not a simple loss). Their interest would be in prosecuting the perpetrator (and possibly retrieving the stolen property). In the course of investigating, the police will ask (in some form) if you have a clue where it is, and if you do not admit that you know where it is, they can prosecute you, because that would violate your state's version of the false statement law (Washington example here). The physical card is not so important: loan applications etc. don't require producing a physical SS card: what they need is the number on the card.
As a native English speaker I would read this as requiring the DPO to monitor all the things listed (i.e. you are correct). Furthermore it would be ridiculous for the DPO to be personally responsible for doing all of these things. If you were supposed to perform "assignment of responsibilities" yourself that would pretty much make you the Chief Operations Officer. If you are only required to monitor job assignments for compliance then by the same logic you are only required to monitor training. Having said that, there is an established principle in the safety industry that compliance should have an independent reporting line up to the top management, and I think its the same for financial regulations too. You cannot be an effective DPO if you are just watching from the sidelines. So I would expect a DPO to have: Line responsibility for audits and routine compliance work such as privacy impact assessments, with a dedicated team of people if necessary. This ensures that there is an independent reporting line from everyday work up to the DPO. Do not accept a situation where data protection work is carried out by the project and then handed to you to file once it is complete, because it never will be. Project managers have a lot of competing priorities and they are extremely good at avoiding anything that sits between them and project completion. You MUST have your own people in the project to see what is happening and the power to stop a project if it is not compliant. If they won't give you that, turn down the job. Budget responsibility for training (with the work actually done by specialist contractors or the company in-house training department) Notification of job assignments where data protection is part of the responsibility.