THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
04 June 2020
Final Decision
Complaints against – Lawfulness of the processing
(Article 6 GDPR)
IMI A56ID: 81381
IMI Case: 92167
IMI A60DD: 92290
IMI A60RD: 125912
The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf-
ter “HBDI”) refers to various complaints against (hereinafter
“ ) concerning s authentication and identification procedure.
1. Case Description
HBDI has received several complaints against regarding its authentication
and identification procedure when confronted with claims for compensation payments
by
. To ensure the compensation payments reach
the entitled recipient, had asked the claimants for proof of identification and
required "a selfie photo of the holding their valid government issued ID (e.g.
passport, ID card, driver's license) with their face clearly visible". The complainants
considered this identification procedure unlawful.
2. Investigation Procedure
HBDI contacted in July 2019. In its answer, stated that under the
current the company is obliged to pay compensation to
. added that failure to comply with other parts of the contract,
such as the , might also result
in compensation under the . However, it must always be ensured
that the demanding person is an entitled
In this respect, was able to demonstrate to the HBDI that the identification
of a person entitled to claim is not sufficient solely based on the booking data
, since are often disposed of or not securely
stored by after the This means that third parties can easily access
Page 1 of 5
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 5
____________________________________________________________________________________________________
the relevant data. Furthermore, information about a is accessible to every-
one via publicly accessible platforms (such as , etc.). Conse-
quently, a third party who obtains the booking data, for example by finding a lost
, can very quickly find out whether she or he can assert illegitimate claims for
. The same also applies to , as only the knowledge that the
has been is required.
Furthermore, explained that due to a significant increase in fraud incidents
and in order to protect actual claimants, measures were introduced which should con-
tribute to the unambiguous identification of the claimant. As a result, in addition to the
booking data ) and the 's name,
also requested a copy of the claimant's ID and a photo showing the claimant together
with his ID.
stated, however, that the request to send a photo and a copy of the ID should
only be made if the claimant could not be unambiguously identified otherwise. As soon
as the e-mail address, telephone number or (for letters) the address was identical with
the contact data from the or the profile, the claimant was
deemed identified.
In this context, was able to demonstrate to the HBDI that it is often not pos-
sible to unambiguously identify the claimant on the basis of the data available to the
company.
explained, for example, that if a books his or her through a
, does not have the 's contact details because they
are either not entered by the or the passes on its own
contact details.
Identification by comparing the information is also not possible, since the
data is processed in a completely separate system and customer complaint
management is not given access for reasons of data minimization. Moreover, the data
were not useful for identification purposes.
further stated that a comparison with the data is only possible
if the number had already been entered at the time of booking. However,
this is not necessary.
also explained that the exclusive transmission of a copy of the claimant’s ID
does not seem to be a viable alternative either, given the high number of cases of fraud
in which manipulated IDs were submitted. Since serves customers all over
the world, would have to know the security features of the ID cards of all
countries in order to be able to detect manipulations.
Page 2 of 5
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 3 of 5
____________________________________________________________________________________________________
In the course of the proceedings, was thus able to demonstrate to the HBDI
that a clear identification of the demanding person is required in the event of reim-
bursement proceedings on the company’s part.
On 30 October 2019, HBDI met with ’s DPO to discuss the proceedings.
During this meeting, stated that due to the increasing uncertainty of
’s customers, it had already stopped requesting a photo of the persons con-
cerned since 1 October 2019 to ensure identification in the context of processing reim-
bursement transactions. On the same day, also acknowledged in writing that
the identification procedure in question had already stopped.
In this context, HBDI and agreed that in order to counter possible fraud in
future, may consider other less intervention-intensive identification proce-
dures but inform the HBDI prior to their introduction.
In its Draft Decision of 21 November 2019 (IMI A60DD 92290), HBDI concluded that
since had stopped the identification and authentication procedure in ques-
tion, the complaints have been settled and the proceedings can be concluded.
The Portuguese, Finnish and Belgian Data Protection Authorities commented on the
HBDI’s Draft Decision:
The Portuguese Data Protection Authority raised an objection stating that the decision
covers several complaints but does not specify for each of them whether there has
been effective collection of data on the identification and authentication procedure.
Further, the Portuguese DPA noted that the HBDI’s Draft Decision does not mention
whether data have been erased, since the identification mechanism has already been
suspended.
The Belgian and the Finnish DPA also commented on the Draft Decision and stated
that requiring “a selfie photo of the holding their valid government issued ID
(e.g. passport, ID card, driver’s license) with their face clearly visible” was in contradic-
tion with the data minimization principle (Article 5(1) lit. c GDPR). Besides, the Belgian
DPA wondered whether or not an active worldwide and especially in the Euro-
pean Economic Area, should not be in a position to have some knowledge of the se-
curity features of the European official IDs and that when the has been booked
by an intermediary such as a , it does not see why would not
be in a position to reach the and cross-check the data it got from the
consumer claiming some compensation (reimbursement), especially for instance, be-
yond the contact details of the consumer, his/her bank account number.
In its Revised Draft Decision of 18 May 2020 (A60RD 125912), HBDI replied the fol-
lowing in response to the objections from Portugal: The complaints received by the
HBDI concerning s authentication and identification procedure have been
dealt with individually and the complainants have received individual answers to their
specific complaints. The HBDI chose to create only one Article 56 procedure and only
Page 3 of 5
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 4 of 5
____________________________________________________________________________________________________
one entry in the Case register for these complaints as they are about the same con-
troller, same type of complaint and same type of data processing. This is in line with
the recommended practice developed by the IT User Expert Subgroup and reflected
in the EDPB IMI User Guide for bundling complaints to avoid the creation of a high
number of unnecessary Article 56 procedures and reduce workload for Supervisory
Authorities.
Further, HBDI informed the Portuguese DPA that there has not been effective collec-
tion of personal data in the course of the identification and authentication procedure,
since many complainants refused to submit a selfie and lodged a complaint with the
HBDI instead. When personal data was collected, HBDI has received the confirmation
of cancellation from
In response to the comments of the Belgian and Finnish DPA the HBDI stated the
following: The HBDI does not regard s authentication process as a violation
of the obligation to minimize data in accordance with Article 5(1) lit. c GDPR.
request to submit a selfie with photo identification was an immediate meas-
ure and was introduced as an interim solution until online and video identification pro-
cedures were developed, established and evaluated. It was introduced since an audit-
ing firm commissioned by had found that the number of suspicious refund
claims in the first quarter of 2019 had amounted to 400.000,00 EUR. In the first quarter
of 2015, by way of comparison, the figure was 1.423,00 EUR. In 2018 and the first
quarter of 2019 there had been a significant increase, which prompted to
take investment measures. The results of the audit by the auditing company were pre-
sented to the HBDI. It was suspected by that organised criminals had dis-
covered a possibility for themselves to obtain unjustified payments. In view of the high
losses, a quick reaction by was necessary to avert further damage. Up to
this point in time, the customer complaint management had no contact with the exam-
ination of the forgery-proofing of copies of identification documents and has to process
approximately 5000 refund claims per day. In addition, genuine copies of ID cards were
probably also presented without justification. A large number of are still booked
through . These agencies are then in possession of copies of
ID cards. There is no legal obligation for to hand over their cus-
tomers' information to The also require a data protection
legal basis for the release. On the other hand, the are - especially with
regard to account data - under no obligation to disclose customer data. Furthermore,
it could not be ruled out that in some cases the /their employees them-
selves might be involved in the alleged fraud. has credibly argued that au-
thentication based solely on the booking data ) was not
sufficient to contain the above-mentioned damage. It was clear that the demand for
additional authentication factors was legitimate. During this investigation procedure
and until the investigated authentication procedure was discontinued, no milder
measures were discernible which would be suitable to the same extent to avert the
Page 4 of 5
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 5 of 5
____________________________________________________________________________________________________
financial damage. The termination of the authentication procedure on the part of
was not due to data protection reasons, but rather to customer dissatisfac-
tion and the increasing number of complaints.
3. Decision
Since the objections and comments made against the Draft Decision were adequately
addressed and there were no objections to the Revised Draft Decision by the Supervi-
sory Authorities concerned, the proceedings can be concluded.
Page 5 of 5
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de