A form for every register, and an identity document, were both too much

What happened

The Deputy Data Protection Ombudsman held that a telecommunications operator had not complied with Article 12(2) by routinely requiring that an access request be made on a register specific form, because it offered no way of asking at once for every piece of personal data it held, and a requester who does not know they appear in several registers fills in one form and receives a part. The operator had not complied with Article 12(3) either: it asked for identification twenty three days after the request, which is not without undue delay, and the request was met almost three months after it was made. Requiring a copy of an identity document breached Article 12(6) read with Article 5(1)(c), because the only data the operator held before the marketing call the request concerned was a telephone number, so the document supplied more personal data than were needed to identify the requester and nothing the operator could compare them against. The operator was entitled to refuse access to data possibly held in application server logs and analytics databases, because the requester offered but never supplied the further information that would have identified them there. Orders were issued on the form and on the identity document.