Subject access requests used as reconnaissance

Statutory deadlines create pressure to respond, and identity verification is the step most often compressed. A well-prepared request can extract a detailed profile of a real person from an organisation acting in good faith.

Verification proportionate to the sensitivity of the data is permitted and rarely applied consistently.