- Berlin Administrative Court ruled that authorities may only request confirmation of identity in cases of “reasonable doubt” (Art. 12 para. 6 GDPR).
- A copy of a passport or identity card may not be requested as standard if there are no concrete indications of misuse.
- The applicant’s known place of residence and previous deliveries speak against the need for additional proof of identity.
- Authority can use formal delivery to prevent misdirection instead of generally requiring qualified legitimation.
The Berlin Administrative Court has ruled Judgment of August 31, 2020 (1 K 90.19) ruled on the question under which circumstances the controller has “reasonable doubt as to the identity of the natural person” (Article 12(6) GDPR) who made an information request.
In this case, the request for information went to the Tiergarten District Court, whose president had rejected the request because the person concerned had not proven his identity in the required form; instead, the president had requested a copy of the identity card.
The VG Berlin upheld the data subject’s claim, based on Section 59 of the German BDSG, which uses the same wording as Article 12(6) of the GDPR. It applies a relatively strict standard to the question of proof of identity and does not allow a copy of a passport or ID to be requested if the recipient’s address is already known to be the address of the data subject and there is no indication that a third party may have made the request for information on behalf of the data subject:
The only question in dispute between the parties is whether the plaintiff must legitimize himself in the qualified form required by the defendant in order to be able to obtain the requested written information. This must be answered in the negative […]. According to this, the authority obliged to provide information may only request additional information to confirm the identity of an applicant only if “reasonable doubt” about its identity exist. Without special cause, the authority obliged to provide information may thus not demand proof of identity from an applicant […].
No special reason or circumstances have been presented or are otherwise apparent here. The address of the plaintiff has been known to the defendant for a long time. The Tiergarten District Court has already sent the plaintiff various decisions at his current address in the past. In addition, There is no indication that a third party could have an interest in the requested information. and therefore could obtain the information by using a false identity […]. Finally, the defendant can prevent its misdirection by a formal delivery of its information letter […].