Identification & Authentication

“Identification” is the ability to uniquely identify a user of a system or an application. This is the difference to “authentication”, which is the ability to ensure that an identified data set relates to a specific person.

In practice, many controllers request unrelated additional data when users exercise their rights, claiming that this is necessary for authentication purposes, when the main goal behind this tactic is to frustrate users. In many cases, controllers require identification documents, when it would be sufficient to verify the user via the login details of an account.

Our project aims at stopping unnecessary routine identity checks by data controllers in an effort to ensure that data subjects can exercise their rights, while ensuring data security by shifting to stronger and more relevant forms of authentication.