Is it against the law to forge identity documents if relevant information is accurate?
<p>Organisations <a href="https://gdpr.eu/Recital-64-Identity-verification/" rel="nofollow noreferrer">are required</a> to &quot;use all reasonable measures to verify the identity of a data subject who requests access&quot;.  This has been implemented in <a href="https://www.cifas.org.uk/contact-us/subject-access-request" rel="nofollow noreferrer">some cases</a> by requiring the data subject to provide images of &quot;your valid passport or driving licence and an original bank statement or utility bill&quot;.  These documents are likely to contain much richer information than most organisations would hold, in particular a recent facial photograph and details of financial transactions. It is therefore reasonable to not want to distribute this information.  It would be relatively easy to make images that contained the information required to identify the individual to the data controller but other information changed, such as the photograph and actual transactions.  This could be done either by editing an image of the real document (eg. put someone else's photograph over mine on an image of my driving licence) or an image from the web (eg. put my address on <a href="https://www.theguardian.com/uk/2012/jun/21/union-flag-uk-driving-licences" rel="nofollow noreferrer">this</a>).</p>
<p>Clearly to do this to obtain someone else's data would be wrong (fraud?).  If I did this to access my data, and the changes were purely to protect my PII would I be committing any crime?</p>

<p>I will answer this question by reference to the law of the United Kingdom, since you have added the relevant tag.</p>
<p><a href="https://www.legislation.gov.uk/ukpga/1981/45/section/1" rel="nofollow noreferrer">Section 1 of the <em>Forgery and Counterfeiting Act 1981</em></a> provides:</p>
<blockquote>
<p>A person is guilty of forgery if he makes a false instrument, with the intention that he or another shall use it to induce somebody to accept it as genuine, and by reason of so accepting it to do or not to do some act to his own or any other person’s prejudice.</p>
</blockquote>
<p><a href="https://www.legislation.gov.uk/ukpga/1981/45/section/9" rel="nofollow noreferrer">Section 9 of the Act</a> provides:</p>
<blockquote>
<p>An instrument is false for the purposes of this Part of this Act … if it purports to have been made in the form in which it is made by a person who did not in fact make it in that form …</p>
</blockquote>
<p><a href="https://www.legislation.gov.uk/ukpga/1981/45/section/10" rel="nofollow noreferrer">Section 10 of the Act</a> provides:</p>
<blockquote>
<p>[A]n act or omission intended to be induced is to a person’s prejudice if … it is one which, if it occurs … will be the result of his having accepted a false instrument as genuine … in connection with his performance of any duty.</p>
</blockquote>
<p>In addition, <a href="https://www.legislation.gov.uk/ukpga/2010/40/section/4" rel="nofollow noreferrer">section 4 of the <em>Identity Documents Act 2010</em></a> provides:</p>
<blockquote>
<p>It is an offence for a person (“P”) with an improper intention to have in P's possession or under P's control … an identity document that is false and that P knows or believes to be false …</p>
</blockquote>
<blockquote>
<p>Each of the following is an improper intention — (a) the intention of using the document for establishing personal information about P …</p>
</blockquote>
<p>It is likely that what you have proposed is prohibited by each of these laws. It is an unusual example of forgery, as there is no financial gain, and the false representation (that the identity document is genuine) is intended to establish a true conclusion (that you are authorised to have the data). Perhaps there is some room for a defence in here, although I’m not aware of any relevant cases. However, the <em>Identity Documents Act</em> seems intended to prohibit the use of false identity documents <em>per se</em>, without the need to prove a particular consequence.</p>

united-kingdom fraud data-protection