CST letters' forum group thread

Umkomaas

A copy of your V5C and one of a recent utility bill confirming your address will be sufficient. If they give you any stress re photo ID, complain to the ICO. 

Tomy66

I spent about four months firing emails back and forth with regards to photo ID.
Don’t give them any, there is absolutely no reason to.
They will give up eventually and provide you with the information, for what it’s worth.
It did provide a few months of fun though. See if you can get the name of their DPO as they wouldn’t tell me. 

I suspect that they haven’t even got one lol

patient_dream

As Umkomaas says above

Photo ID is ok to show authorities but they are not an authority and they have no right to ask for it.

As long as you can prove your address, that is all they need.

And if they insist on photo ID to provide information, report them to the ICO

helenmiddlerasen

I will take the greatest of pleasure in reporting them to the ICO. I have just requested the name of their DPO. Will post here if I get it. Here is their response this morning. I no longer own the car, so provided them with a DVLA email confirming transfer of ownership, yet they are still insisting on the v5c, which I don't have any more, and as for as for ID I provided a bank statement (transactions redacted obviously)

KeithP

Once again they are asking for photo id.
What on earth are they going to compare it with?

patient_dream

I seem to recall we had a similar issue with this lot before

They want reasonable proof which is fine but Photo ID is unreasonable
and tells them nothing and could be a fake anyway.

You have been reasonable in what you have provided and especially the email from the DVLA

Time is now ticking for Group Nexus to provide the SAR info within 30 days as allowed by the ICO.  After the 30 days expires, you can then issue a complaint to the ICO

1505grandad

Not sure of the date of the this but:-

https://dpnetwork.org.uk/subject-access-requests-proof-of-id/

[Update] In the ICO’s detailed Right of Access Guidance (published October 2020) it states;

“You can ask for enough information to judge whether the requester (or the person the request is made on behalf of) is the person that the data is about. The key point is that you must be reasonable and proportionate about what you ask for. You should not request more information if the requester’s identity is obvious to you. This is particularly the case when you have an ongoing relationship with the individual.”

It continues to say:

“You should also not request formal identification documents unless necessary. First you should think about other reasonable and proportionate ways you can verify an individual’s identity. You may already have verification measures in place which you can use, for example a username and password.

However, you should not assume that on every occasion the requester is who they say they are. In some cases, it is reasonable to ask the requester to verify their identity before sending them information.

How you receive the SAR might affect your decision about whether you need to confirm the requester’s identity.”

Neither GDPR, nor the ICO provide specific details on what would be considered reasonable and proportionate. This is left for organisations to judge. (My bold)

Le_Kirk

Photo ID is NOT required, nor is it suggested in the NEWBIE sticky.  You don't need to show proof of ownership just send a  OPY of your V5C showing you are the registered keeper and that the address on the V5C matches the address on any paperwork the PPC has sent you. If they still refuse to play ball report them to the ICO.

helenmiddlerasen

Here is their latest response - I no longer have the v5c as I sold the car. I provided them with a screenprint of a .gov UK email confirming transfer of ownership and a bank statement. I have asked them to explain how they will verify photo ID and to explain why a bank statement is not sufficient, and also for the name of their DPO officer.

Tomy66

Standard response from them.
Quote them the ICO guidelines about relevant ID (along the lines of; there’s no point in asking for photo ID if you don’t know what the person
looks like). They will ignore it and be as obstructive as possible but it’s all good fun