they need to identify you, not necessarily using your id card.

https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2161-1-1

chapter 3, section 1, artcle 12, paragraphs 1 & 2.

i doubt there is profit to be made. it’s more to keep them busy and learning about gdpr.

they they need to id you everytime you exercise your gdpr rights. there is nothing they can do about this.

one of your rights under gdpr is that you are entitled (free of charge) to a listing of all the data the other party has about you.

when you ask them about this listing this request itself becomes data the party has about you. it should therefore he included in the listing. (it is self referential, but that’s how it is).

if the information that you requested such a listing is missing from the data they provide in response to you request, they are in breach of gdpr rules. from them on you might want to file a complaint.

( I’ve no idea whether this would result in any meaningful compensation, if at all. but at least it should keep them busy.)

i guess it’s related to the following; exercising your rights under gdpr requires the other party to be able to identify you. that’s why they need this information. if you want to (potentially) fuck with them: first ask for a listing of all the information they have about you, before asking for deleting your data. this listing must contain the request itself. if your request is missing, they are likely breaking compliance rules.

it might be related to this ram conserving thingie in Chrome