Data deletion requirements
<p>I'm trying to get my account deleted from AirAsia site. Sent them request and in response I was asked to provide them scan of my passport as confirmation it's really me requesting it.</p>

<p>I never provided them my passport data before (as passport section on my profile is empty) and I feel that's quite unreasonable request - if they really want to confirm it's valid request they can just do email verification as most other sites would do. In the end my goal is for them to have less of my data not even more.</p>

<p>My question is - can they really require scan of my passport on data deletion request?</p>

<p>I'm citizen of Poland living in the UK (as that probably matters for GDPR and similar).</p>

<p>Per Art 12(6), they are allowed to ask for additional identify verification:</p>

<blockquote>
  <p>where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.</p>
</blockquote>

<p>Additionally, Recital 64:</p>

<blockquote>
  <p>The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.</p>
</blockquote>

<p>There is <em>no consensus</em> regarding what this means in practice:</p>

<ul>
<li>Must the controller use all measures that they can be reasonably be required to use?</li>
<li>Or only those measures to verify the identity to a reasonable level of certainty?</li>
</ul>

<p>I agree with you that asking for a passport is excessive, and that email verification would be sufficient. However, that is just my personal opinion. The GDPR can also be interpreted in a way that asking for a copy of your passport is OK.</p>

<p>Where they process a copy of your passport, that is personal data as well. You also have data subject rights with regards to this processing, for example the right to be informed of the purpose of this processing and of when the data will be deleted. If it is only used for the purpose of verifying your identity, the copy of your passport should be deleted immediately afterwards.</p>

<p>The data controller may have additional obligations because a passport or ID card is a very sensitive document. E.g. Art 87 allows member states to impose additional rules. Most sensible controllers will therefore want to avoid processing passports, unless they only operate in specific EU member states.</p>

gdpr