The FAZ has reportedhow the right of access under Art. 15 GDPR can be misused to obtain information from third parties. On the one hand, companies must prevent this and identify the applicant for this purpose. On the other hand, they must not make the exercise of the right of access more difficult by imposing excessive identification requirements.
Apparently, the Federation of German Consumer Organizations is already conducting a case against a company because it demanded a copy of an ID card for identification purposes, even though the request was made from a known e‑mail address or a password-protected customer account. How the controversial Right to copy the question of correct identification will also occupy the courts.