The Information Commissioner (new name for the Data Protection Commissioner from Feb 1 2001) does actually recommend in its Guidance (on their website) that organisations get data subjects to complete a form to list the types of data they are seeking (to make it easier to find the data rather than to deliberately fail to supply it), to identify addresses the subject has lived at so no data at previous addresses is left out, and to identify the individual. Until proper identification is obtained, there is no obligation under the 1998 Act to provide any data at all!!! Subjects can be asked for up to 4 proofs of identity, covering their name and address. The time limit to respond starts from the date the identity is verified.(posted 8462 days ago)This requirement was introdued because criminals were using SARs to get information on ordinary people and using it to take out finance by impersonating them, and to make false claims to the DSS for benefits.