In a context in which both purchases of goods and services and other procedures tend to be carried out exclusively online, we are repeatedly called upon to prove our identity to businesses and administrative bodies. Here, in this article, we suggest a few good practices in the interests of trust and security of personal information.
Proving your identity online
There is no law obliging you to have ID, although most online procedures require you to prove your identity.
Both administrative bodies and private law corporations will require proof of identity before providing a service, or after providing it where there are problems.
For example, when a .fr domain name holder cannot be reached, Afnic or the registrar receives a request from a third party or from an administrative body. The holder is then asked to confirm his or her contact data. In doing so, the holder provides proof of identity.
What kind of documents should be provided for this kind of procedure?
The obvious thing to do, and what most people do almost automatically, is to send a good, high-definition copy of an identity document – national ID card, passport or driving licence.
These are, of course, excellent proofs of identity, but is it actually a good idea to send them?
Online proof of identity can be provided in any way that is appropriate and pertinent to the objective pursued.
In the case of Afnic, this concerns the provision of these kinds of documents for:
- instigating a procedure with Afnic via one of the forms available on the website afnic.fr,
- responding, as a domain name holder, to Afnic’s procedure for verifying its data, or
- taking part in an Afnic SYRELI or PARL EXPERT alternative dispute resolution (ADR).
In order to protect privacy, the CNIL (French data protection authority), recommends establishing what minimum level of trust is needed for provision of the service and using that as the basis for identification and authentication requirements.
Good practices
Afnic encourages users of its services to assess whether it is necessary to provide identity documents depending on what has to be demonstrated, which in turn depends on the procedure in question.
In cases where it is necessary to prove one’s identity, Afnic recommends using a means of proof that allows you to keep control of how your data are distributed, and in particular:
- One-time proof of identity. This document, in pdf format, serves to prove your identity without sending a picture or copy of your identity document and at the same time limiting its use to a defined circle: https://france-identite.gouv.fr/justificatif/
- Digital watermarking, which allows you to indicate for example the exclusive scope of use of a document: https://filigrane.beta.gouv.fr/
In any case, the best protection is not to have your data processed at all or at least to minimise the amount of your data collected.
Afnic procedure as of 1 October 2024
In its SYRELI and PARL EXPERT ADR procedures, Afnic takes on the parties on the basis of the identities that they declare; so there is no obligation on the parties to provide identity documents.
In the event that a party does provide such a document, Afnic will remove it from the platform, store it offline and delete it on the date of notification of the Afnic’s decision to the parties.
In short, as well as encouraging you to consider providing documents allowing you to keep control of your personal data, Afnic is also limiting its processing of any proofs of identity provided by parties to SYRELI or PARL EXPERT ADR procedures.
So let’s work together to make sure your personal data are collected and processed appropriately and in proportion to the objectives you are pursuing!